英国NCSC更新网络安全评估框架CAF v3.2：强化关键设施保护

需积分: 5 45 浏览量更新于2024-06-13 收藏 1.72MB PDF 举报

英国国家网络安全中心(NCSC)近期发布了网络安全评估框架CAF的最新版本，即CAF v3.2。该框架是一个目标驱动的评估工具，旨在帮助组织衡量其网络安全管理的成熟度和网络弹性。CAF的核心围绕四个高级目标和14个原则展开，这些原则强调的是需要达成的结果而非具体的行动列表，体现了其灵活性和实用性。自CAF v3.1版本发布以来，由于在全球范围内获得了广泛应用，特别是在关键国家基础设施(CNI)保护方面的需求增加，使得NCSC有必要对框架进行更新。在新版本中，NCSC特别关注了远程访问、特权操作、用户访问级别和多因素认证等领域的改进，这是基于对全球CNI所面临的网络威胁日益增长的观察。 CAF v3.2版强调了以下几个关键点： 1. **CAF要求**：框架要求组织根据自身情况设定和实现网络安全和弹性的目标，并提供了一套指导原则和良好实践指标(IGPs)，以便于实施和自我或第三方评估。 2. **CAF原则与贡献成果**：每个原则都有相应的贡献成果，这些成果表明了达到原则要求后应实现的效果。例如，CAF-Objective A关注的是管理安全风险，而Objective B则聚焦于保护免受网络攻击。 3. **设定目标**：CAF鼓励组织设定特定的网络安全和韧性目标，这些目标应根据组织的具体业务环境和CNI特性进行定制。 4. **CAF的适用性**：CAF不仅适用于一般组织，还能适应不同行业的特定需求，确保针对不同部门和领域的网络安全策略具有针对性。 5. **变更记录**：NCSC在网站上提供了从v3.1到v3.2以及以前版本的所有变更记录，便于用户了解新旧版本的差异和更新内容。 CAF v3.2版作为一项重要的网络安全评估工具，帮助组织不断优化网络安全措施，应对不断变化的威胁环境，确保关键基础设施的安全和稳定性。随着全球对网络安全关注度的提高，CAF的实用性和适应性将使其在国际范围内持续发挥关键作用。

7 of 40

A1.b Roles and Responsibilities

Your organisation has established roles and responsibilities for the security of network and information

systems at all levels, with clear and well-understood channels for communicating and escalating risks.

Not Achieved Achieved

At least one of the following statements is true All the following statements are true

Key roles are missing, left vacant, or fulfilled on an

ad-hoc or informal basis.

Staff are assigned security responsibilities but

without adequate authority or resources to fulfil

them.

Staff are unsure what their responsibilities are for

the security of the essential function(s).

Key roles and responsibilities for the security of

network and information systems supporting your

essential function(s) have been identified. These

are reviewed regularly to ensure they remain fit for

purpose.

Appropriately capable and knowledgeable staff fill

those roles and are given the time, authority, and

resources to carry out their duties.

There is clarity on who in your organisation has

overall accountability for the security of the

network and information systems supporting your

essential function(s).

A1.c Decision-making

You have senior-level accountability for the security of network and information systems, and delegate

decision-making authority appropriately and effectively. Risks to network and information systems related

to the operation of your essential function(s) are considered in the context of other organisational risks.

Not Achieved Achieved

At least one of the following statements is true All the following statements are true

What should be relatively straightforward risk

decisions are constantly referred up the chain, or

not made.

Risks are resolved informally (or ignored) at a local

level when the use of a more formal risk reporting

mechanism would be more appropriate.

Decision-makers are unsure of what senior

management's risk appetite is, or only understand

it in vague terms such as "averse" or "cautious".

Organisational structure causes risk decisions to be

made in isolation. (e.g. engineering and IT don't

talk to each other about risk).

Risk priorities are too vague to make meaningful

distinctions between them. (e.g. almost all risks are

rated 'medium' or 'amber').

Senior management have visibility of key risk

decisions made throughout the organisation.

Risk management decision-makers understand

their responsibilities for making effective and

timely decisions in the context of the risk appetite

regarding the essential function(s), as set by senior

management.

Risk management decision-making is delegated and

escalated where necessary, across the

organisation, to people who have the skills,

knowledge, tools and authority they need.

Risk management decisions are regularly reviewed

to ensure their continued relevance and validity.

8 of 40

Principle A2 Risk Management

The organisation takes appropriate steps to identify, assess and understand security risks to the network

and information systems supporting the operation of essential functions. This includes an overall

organisational approach to risk management.

A2.a Risk Management Process

Your organisation has effective internal processes for managing risks to the security of network and

information systems related to the operation of your essential function(s) and communicating associated

activities.

Not Achieved

Partially Achieved

Achieved

At least one of the following

statements is true

All the following statements

are true

All the following statements are

true

Risk assessments are not based on

a clearly defined set of threat

assumptions.

Risk assessment outputs are too

complex or unwieldy to be

consumed by decision-makers

and are not effectively

communicated in a clear and timely

manner.

Risk assessments for network and

information systems supporting

your essential function(s) are a

"one-off" activity or not done at all.

The security elements of projects or

programmes are solely dependent

on the completion of a risk

management assessment without

any regard to the outcomes.

There is no systematic process in

place to ensure that identified

security risks are managed

effectively.

Systems are assessed in isolation,

without consideration of

dependencies and interactions with

other systems. (e.g. interactions

between IT and OT environments).

Security requirements and

mitigations are arbitrary or are

applied from a control catalogue

without consideration of how they

contribute to the security of the

essential function(s).

Your organisational process

ensures that security risks to

network and information

systems relevant to essential

function(s) are identified,

analysed, prioritised, and

managed.

Your risk assessments are

informed by an

understanding of the

vulnerabilities in the network

and information systems

supporting your essential

function(s).

The output from your risk

management process is a

clear set of security

requirements that will

address the risks in line with

your organisational approach

to security.

Significant conclusions

reached in the course of your

risk management process are

communicated to key

security decision-makers and

accountable individuals.

You conduct risk assessments

when significant events

potentially affect the

essential function(s), such as

replacing a system or a

change in the cyber security

threat.

Your organisational process

ensures that security risks to

network and information systems

relevant to essential function(s)

are identified, analysed,

prioritised, and managed.

Your approach to risk is focused

on the possibility of adverse

impact to your essential

function(s), leading to a detailed

understanding of how such

impact might arise as a

consequence of possible attacker

actions and the security

properties of your network and

information systems.

Your risk assessments are based

on a clearly understood set of

threat assumptions, informed by

an up-to-date understanding of

security threats to your essential

function(s) and your sector.

Your risk assessments are

informed by an understanding of

the vulnerabilities in the network

and information systems

supporting your essential

function(s).

The output from your risk

management process is a clear

set of security requirements that

will address the risks in line with

your organisational approach to

security.

剩余39页未读，继续阅读

lurenjia404

粉丝: 4499
资源: 162

英国NCSC更新网络安全评估框架CAF v3.2：强化关键设施保护

网络安全评估

网络安全与英国：国家网络安全中心的运作检视.pdf

NCSC发布最常被黑客入侵的10W密码列表

英国最新报告狠批华为：2019华为网络安全评估年度报告（中文）-2019.3-90页.pdf.pdf

英国国家网络安全中心正式启动.pdf

英国启动《国家网络安全战略2016-2021》.pdf

CANSSI-NCSC-Ferry-Delays

网络安全及其防范措施

基于网络安全技术的CTF竞赛.pdf

riddler:Riddler是一种轻量级，高性能的微服务，可根据最常用密码的NCSC顶部列表检查密码

最新资源