ISO IEC 27034-5：2017：应用安全协议与数据结构详解

版权申诉

5星 · 超过95%的资源 34 浏览量更新于2024-07-18 1 收藏 15.97MB PDF 举报

ISO IEC 27034-5：2017，全称为"信息技术 - 安全技术 - 应用安全 - 第5部分：协议和应用安全控制数据结构"，是国际标准化组织/国际电工委员会发布的一份关于应用安全的重要标准。这份标准旨在规范和指导在信息技术领域中确保应用程序的安全性，它涵盖了应用安全控制结构的设计与实施。该标准的目的是为了应对日益增长的信息系统复杂性和全球化的挑战，强调了对数据完整性的保障、多语言和多区域数据的处理能力，以及确保跨组织交流中的信息安全。它定义了一系列关键术语和缩写，帮助读者理解和应用这些概念。 5.2节重点阐述了应用安全控制（ASC）的信息需求，包括整体概述，强调了保护数据完整性的必要性，以及支持跨国界的数据存储和处理，考虑到不同地区的法规和语言环境。这部分内容对于理解和设计全球化的应用安全策略至关重要。 5.3节深入讨论了ASC数据结构的推荐，包括通用原则，如数据交换的标准化和一致性，以及确保数据在不依赖外部环境的情况下也能保持完整性（自包含性）。这样的设计有助于提高数据管理的效率和安全性。 6.1和6.2章节介绍了应用安全生命周期参考模型，这一模型将应用安全管理划分为多个阶段，包括一般原则，以及针对应用管理层面的具体指导。例如，6.2.1部分着重于应用管理层的管理策略，包括但不限于项目规划、开发过程中的安全考虑、测试和维护等环节。 ISO IEC 27034-5不仅提供了技术性的框架，还鼓励企业在设计、开发和部署应用程序时采用这些标准，以降低安全风险，保护用户隐私，满足法规遵从性和商业合规性。通过遵循这一标准，组织可以提升其应用程序的安全管理水平，从而保障业务的稳定运行和客户信任。

INTERNATIONAL

STANDARD

1S0/IEC

27034-5:2017(E)

Information technology - Security techniques -

Application security -

Part

Protocols and application security controls data structure

1 Scope

This

document

outlines

and

explains

the

minimal

set

essential

attributes

ASCs

and

details

the

activities

and

roles of

the

Application

Security

Life Cycle Reference Model

(ASLCRM).

2 Normative

references

The following

documents

are

referred

the

text

in such a

way

that

some

all of

their

content

constitutes

requirements

this

document. For

dated

references, only

the

edition cited applies. For

undated

references,

the

latest

edition of

the

referenced

document

(including any

amendments)

applies.

ISO/IEC 27034-1, Information technology - Security techniques - Application security - Part

Overview and concepts

3 Terms and definitions

For

the

purposes

this

document,

the

terms

and

definitions given in ISO/IEC 27034-1

and

the

following apply.

ISO

and

IEC

maintain

terminological

databases

for

use

standardization

the

following addresses:

3.1

ISO

Online

browsing

platform: available

http://www.iso.org/obp

IEC

Electropedia: available

http://www.electropedia.org/

activity

set

of actions

tasks

carried

out

actor

during

the

application's life cycle

3.2

information

group

record

list of information elements

which

organization

can assign labels, such as names, description

and

categorization values

Note 1

entry:

avoid confusion, information

group

name

should be unique

within

the

organization.

3.3

information

element

piece of

information

that

should

categorized

and

identified

a name, description,

and

domain

values ( e.g. a field in a database)

Note 1

entry:

information group can be

seen

information element.

ISO

/IEC

2017

All

rights

reserved

poorest

ISO/IEC

27034-5:2017(E)

4 Abbreviated

terms

ASC

Application

Security

Control

ASLC

ASLCRM

ICT

ONF

Application

Security

Life Cycle

Application

Security

Life Cycle Reference Model

Information

and

Communication Technology

Organization Normative

Framework

5 Application Security Control Structure

5.1 General

Each Application

Security

Control

(ASC)

defines a

security-related

activity

performed

a specific

point

application's life cycle

mitigate a

risk

to satisfy a

requirement.

The

security

activity is

supplemented

a verification

measurement

(activity)

that

specifies

the

necessary

steps

to verify its

successful application. For

both

the

security

activity

and

verification

measurement,

ASC

specifies

how, where,

when

and

whom

the

activity should be implemented. Information

about

the

required

effort

is also

captured.

The

purpose

this

clause is

provide a specification of

the

ASC

information

requirements

and

data

structure

recommendations. Organizations may choose

implement

the

information

requirements

and

data

structure

requirements

using

either

narrative

approach

other

suitable

data

structure,

which

best

suits

organizational

needs

and

requirements.

NOTE

identifiy

the

minimum

set

attributes

needed

define a valid

ASC,

the

name

each

ASC

attribute

defined

this

document

includes

the

mention

"(M)"

when

the

attribute

mandatory,

the

mention

"(O)"

when

the

attribute

optional.

NOTE

The

inclusion

optional

attribute

could

require

the

implementation

subsequent

mandatory

attributes.

Mandatory

attributes

under

optional

attribute

are

mandatory

only

when

the

optional

attribute

implemented

[e.g.

see

5.2.4.2. e)].

The

purpose

this

clause is also to provide a list of possible activities enabling

the

ONF

Committee

attach

ASCs

into

the

Application

Security

Life Cycle Reference Model

(ASLCRM).

ASC

developers should align

their

vocabulary

with

ISO/IEC

27034

(all

parts)

when

they

need

describe

assets.

5.2

ASC

information

requirements

5.2.1 Overview

This subclause defines

the

recommended

information

requirements

for individual application

security

controls. For a

concrete

implementation in form of

XML

Schema of

this

document, please

refer

ISO/IEC 27034-5-1.

Note

that

this

document

does

not

define

how

the

various

ASC

information

items

are

identified

managed. For details

about

the

latter,

consult

the

management

and

audit

process defined in

ISO/IEC 27034-2, ISO/IEC 27034-3

and

ISO/IEC 27034-4.

NOTE

Explicit

indication

inheritance

hierarchy

not

implemented

the

ASC

structure,

but

could

implemented

future

versions.

2 ©

ISO

/IEC

2017

All

rights

reserved

poorest

剩余40页未读，继续阅读

alarmano

粉丝: 26
资源: 1万+

ISO IEC 27034-5：2017：应用安全协议与数据结构详解

ISO_IEC27034-2-2015

ISO IEC 27034-6

ISO IEC 27034-3

ISO IEC 27034-2

ISO IEC 27034-1

ISO/IEC 27034-2 Draft

ISO/IEC 27034-1：应用安全概述与概念

ISO IEC TS 27034-5-1 Information technology - Application security- Part 5-1：Protocols and application security controls data structure, XML schemas - 完整英文版（83页）.pdf

ISO-IEC-7816-4-2005.zip_7816-4_IEC_ISO IEC 7816-4_ISO7816-4_iso-

ISO IEC 20000-3-2019中文-信息技术-服务管理-第3部分：ISO IEC 20000-1的范围定义和适用性指南

最新资源