GB/T 20986-2023Information security technology—Guidelines for category and classification of cybersecurity incidents (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules for Standardization Documents" drafting.

This document replaces GB/Z 20986-2007 "Guidelines for Classification and Grading of Information Security Technology Information Security Incidents", and GB/Z 20986- Compared with 2007, except for structural adjustment and editorial changes, the main technical changes are as follows:

a) Changed from the guiding technical document GB/Z to the recommended national standard GB/T;

b) Changed the expression of "scope" (see Chapter 1, Chapter 1 of the 2007 edition);

c) In "Terms and Definitions", the definition of "information system" was changed (see 3.1, 2.1 of the 2007 edition), and "data, network security Security and network security incidents" (see 3.1~3.4);

d) Changed the "Abbreviation", deleted the content of the original abbreviation (see Chapter 3 of the 2007 edition), and added a new abbreviation "APT, BGP, DDOS, DNS, IP, WLAN" etc. (see Chapter 4);

e) In "Classification of Network Security Events", the expression of "Classification Method" has been changed, and the classification of network security events has been increased from 7 categories to Class 10 (see 5.1, 4.1 of the 2007 edition).

1) In the "malicious program event", 3 events of "malicious code host site event, ransomware event, and mining virus event" were added event subclasses (see 5.2.1, 4.2.1 of the 2007 edition);

2) Added "backdoor implantation events, credential attack events, web page tampering events, dark link implantation events" in "cyber attack events" events, domain name hijacking events, domain name transfer events, DNS pollution events, WLAN hijacking events, traffic hijacking events, BGP Hijacking attack event, broadcast fraud event, lost host event, supply chain attack event, APT event" 14 event sub-class (see 5.2.2, 4.2.2 of the 2007 edition);

3) Change the name of "Information Destruction Event" to "Data Security Event", and change the event subcategory to "Data Tampering Event, Data Fake Event" Incidents of fraud, data leaks, data theft, data loss", added "social engineering incidents, data interception event, location detection event, data poisoning event, data abuse event, and privacy violation event" (see 5.2.3, 4.2.3 of the 2007 edition);

4) In "Information Content Security Incidents", the number of incident subcategories has been increased from 4 to 8, and the name has been changed to "Reactionary Propaganda Incidents, Violence and Terrorism Incidents" Publicity incidents, pornography incidents, false information dissemination incidents, rights infringement incidents, information spamming incidents, network fraud incidents documents and other information content security incidents" (see 5.2.4, 4.2.4 of the 2007 edition);

5) In "Equipment and Facility Failure Events", the number of event subcategories is increased from 4 to 5, and the name is changed to "Technical Failure Events, Supporting Facility failure events, physical damage events, radiation interference events, and other equipment and facility failure events" (see 5.2.5, 2007 version 4.2.5);

6) Added the category of "violation operation events", including "authority abuse events, authorization forgery events, behavior denial events, intentional violations Operation events, misoperation events, personnel usability damage events, unauthorized resource use events, copyright violation events, etc. Operation violation event" 9 event subcategories (see 5.2.6);

7) The category of "potential security incidents" has been added, including "network vulnerability incidents, network configuration compliance defect incidents, and other potential security incidents". Event" 3 event subclasses (see 5.2.7);

8) Added "abnormal behavior events" category, including "abnormal access events, traffic abnormal events and other abnormal behavior events" 3 event subclasses (see 5.2.8);

9) Change "catastrophic event" to "force majeure event", including "natural disaster event, accident disaster event, public health event events, social security events, and other force majeure events" (see 5.2.9, 4.2.6 of the 2007 edition);

f) In "Classification of Network Security Events", change "Information System" to "Event Affected Objects".

1) Changed the expression of "grading method" (see 6.1, 5.1 of the 2007 edition);

2) Added descriptions of 3 important levels of "Event Affected Objects" (see 6.1.2);

3) Change "system loss" to "business loss", and "system critical data" to "important data/sensitive personal information Information" (see 6.1.3, 5.1.3 of the 2007 edition);

4) Change "Social Impact" to "Social Harm" (see 6.1.4, 5.1.4 of the 2007 edition);

5) Changed the expression of "event level" (see 6.2.1~6.2.5, 5.2 of the 2007 edition);

6) Added "event grading process" (see 6.3);

g) In order to facilitate applications such as information reporting, event research and judgment, "Appendix B" is added, and event classification codes are given.

Introduction

The prevention and disposal of network security incidents is an important link in the national network security system, and it is also an important work content. network The classification and grading of security incidents is one of the foundations for quickly and effectively handling network security incidents. The purpose of this document is to:

a) Facilitate the collection and analysis of security incident data;

b) facilitate the identification of the severity of security incidents;

c) facilitate the exchange and sharing of security incident information;

d) facilitate automated reporting and response to security incidents;

e) Improve the efficiency and effectiveness of security incident notification and emergency response.

In Appendix A, the relationship between security event classification and security event classification is given.

1 Scope

This document describes the classification and grading methods of network security incidents, defines the categories and levels of network security incidents, and specifies the network security Full event classification code.

This document is applicable to network operators and relevant departments to carry out research and judgment of network security incidents, information notification, monitoring and early warning and emergency response, etc. Activity.

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text. Among them, dated references For documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document.

GB/T 22240-2020 Information Security Technology Network Security Classified Protection Grading Guide

GB/T 25069-2022 Information Security Technical Terminology

3 Terms and Definitions

The following terms and definitions defined in GB/T 25069-2022 apply to this document.