GB/T 40652-2021Information security technology—Guide to malware incident prevention and handling (English PDF)
信息安全技术 恶意软件事件预防和处理指南
This is a limited preview
Buy now to download the full PDF (24 pages)
Need quotation for your management?
Get a formal quotation for GB/T 40652-2021 in 30 minutes.
Issued by
SAMR; SAC
Level / Type
National · Recommended
Issue date
October 11, 2021
Implementation date
May 1, 2022
Scope
GB/T 40652-2021 is the English-translated version of 信息安全技术 恶意软件事件预防和处理指南.
GB/T 40652-2021 is the Chinese national guide to preventing and handling malware incidents, building on the incident management framework of GB/T 20985.1-2017 and GB/T 20985.2-2020.
It follows an incident from planning and preparation, with the incident response team, basic precautions, security awareness education, vulnerability prevention and malware prevention, through discovery and reporting, evaluation and decision-making, to the response itself.
The response covers the malware incident response plan, containment, identification of infected hosts, eradication, tracing of the incident and system recovery, closing with a summary of lessons learned.
Informative annexes give handling scenarios and common containment techniques. It is written for computer system administrators, network administrators and security incident response teams. It was issued on 11 October 2021 and has applied since 1 May 2022.
Found what you need?
Document preview — GB/T 40652-2021
National Standard of the People's Republic of China
- ICS
- 35.030
- Classification
- L 80
Issued by: State Administration for Market Regulation; Standardization Administration of the PRC
Contents
- Foreword
- 1 Scope
- 2 Normative references
- 3 Terms and definitions
- 4 Abbreviations
- 5 Planning and preparation
- 5.1 Overview
- 5.2 Incident Response Team
- 5.3 Basic precautions
- 5.4 Safety awareness education
- 5.5 Vulnerability prevention
- 5.6 Malware prevention
- 6 Discovery and Report
- 6.1 Overview
- 6.2 Malware incident discovery
- 7 Evaluation and decision-making
- 8 response
- 8.1 Overview
- 8.2 Malware Incident Response Plan
- 8.3 Containment of Malware Incidents
- 8.4 Identifying the infected host
- 8.5 Eradication of Malware
- 8.6 Traceability of Malware Incidents
- 8.7 System Recovery
- 9 Summary of experience
- Appendix A (Informative) Malware Incident Handling Scenario
- Appendix B (Informative) Common Techniques for Containing Malware
- Reference
Foreword
This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules of Standardization Documents" Drafting.
1 Scope
This document is based on GB/T 20985.1-2017 and GB/T 20985.2-2020, for the prevention and The process gives further guidance.
This document is suitable for computer system administrators, network administrators, security incident response teams, etc. to prevent and handle malware incidents.
2 Normative references
The contents of the following documents constitute the indispensable clauses of this document through normative references in the text. Among them, dated quotations Only the version corresponding to that date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document.
GB/T 20985.1-2017 Information Technology Security Technology Information Security Incident Management Part 1: Principles of Incident Management
GB/T 20985.2-2020 Information technology security technology Information security incident management Part 2: Incident response planning and standards Preparation guide
GB/T 25069 Information Security Technical Terms
3 Terms and definitions
The following terms and definitions defined in GB/T 25069 apply to this document.
3.1 Malware
Software specially designed to damage or destroy the system and attack the confidentiality, integrity or availability.
Note: Viruses and Trojan horses are examples of malware. [Source: ISO /IEC 27033-1:2015, 3.22]
3.2 Malware incident
Information security incidents that are caused by malicious software and cause breaches of confidentiality, integrity, or availability.
3.3 Antivirus software
The program that monitors the host and the network, detects malware through its characteristics, whitelists, and abnormal behaviors, and can identify and clear them. In addition to malware.
Note: Anti-virus software is also called anti-virus software and anti-virus software.
3.4 Virus
Insert a group of computer instructions into a computer program that destroy computer functions or data, affect the use of the computer and can copy itself Order or program code. [Source: GB/T 31499-2015, 3.6]
......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 24 pages — is available in the English PDF.
Referenced standards
Normative references
- GB/T 20985.1-2017Cybersecurity technology - Cybersecurity incident management - Part 1: Principles and process
- GB/T 20985.2-2020Cybersecurity technology - Cybersecurity incident management - Part 2: Guidelines to plan and prepare for incident response
- GB/T 25069Information security techniques—Terminology
Similar standards
How to Download GB/T 40652-2021
- 1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
- 2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
- 3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
- 4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.
Related Standards
GB/T 20985.1-2017 — Cybersecurity technology - Cybersecurity incident management - Part 1: Principles and process
GB/T 20985.2-2020 — Chinese standard
GB/T 25069-2022 — Information security techniques—Terminology
Secure payment via Stripe
Payments accepted
GB/T 40652-2021
$420.00