information technology Information technology (IT) is the use of computers to create, process, store, retrieve, and exchange all kinds of data . and information. IT forms part of information and communications technology (ICT). An information technology system ...

, benchmarking of

computer security Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, t ...

requires measurements for comparing both different IT systems and single IT systems in dedicated situations. The technical approach is a pre-defined catalog of security events (security incident and

vulnerability Vulnerability refers to "the quality or state of being exposed to the possibility of being attacked or harmed, either physically or emotionally." A window of vulnerability (WOV) is a time frame within which defensive measures are diminished, com ...

) together with corresponding formula for the calculation of security indicators that are accepted and comprehensive. Information security indicators have been standardized by the

ETSI The European Telecommunications Standards Institute (ETSI) is an independent, not-for-profit, standardization organization in the field of information and communications. ETSI supports the development and testing of global technical standard ...

Industrial Specification Group (ISG) ISI. These indicators provide the basis to switch from a qualitative to a quantitative culture in IT Security Scope of measurements: External and internal threats (attempt and success), user's deviant behaviours, nonconformities and/or vulnerabilities (software, configuration, behavioural, general security framework). In 2019 the ISG ISI terminated and related standards will be maintained via the ETSI TC CYBER. The list of Information Security Indicators belongs to the ISI framework that consists of the following eight closely linked Work Items: # ISI Indicators (ISI-001-1 and Guide ISI-001-2): A powerful way to assess security controls level of enforcement and effectiveness (+ benchmarking) # ISI Event Model (ISI-002): A comprehensive security event classification model (taxonomy + representation) # ISI Maturity (ISI-003): Necessary to assess the maturity level regarding overall

SIEM Siem is a surname. Notable people with the surname include: *Charlie Siem (born 1986), British violinist * Kjetil Siem (born 1960), Norwegian businessperson, journalist, author and sports official * Kristian Siem (born 1949), Norwegian businessman ...

capabilities (technology/people/process) and to weigh event detection results. Methodology complemented by ISI-005 (which is a more detailed and case-by-case approach) # ISI Guidelines for event detection implementation (ISI-004): Demonstrate through examples how to produce indicators and how to detect the related events with various means and methods (with classification of use cases/symptoms) # ISI Event Stimulation (ISI-005): Propose a way to produce security events and to test the effectiveness of existing detection means (for major types of events) # An ISI-compliant Measurement and Event Management Architecture for Cyber Security and Safety (ISI-006): This work item focuses on designing a cybersecurity language to model threat intelligence information and enable detection tools interoperability. # ISI Guidelines for building and operating a secured SOC (ISI-007): A set of requirements to build and operate a secured SOC (Security Operations Center) addressing technical, human and process aspects. # ISI Description of a whole organization-wide SIEM approach (ISI-008ETSI GS ISI 008 (V1.1.1): Description of an Overall Organization-wide Security Information and Event Management (SIEM) Approach (2018-06

/ref>): A whole SIEM (CERT/SOC based) approach positioning all ISI aspects and specifications. Preliminary work on information security indicators have been done by the French Club R2GS. The first public set of the ISI standards (security indicators list and event model) have been released in April 2013.

References

{{reflist

External links

ETSI ISG ISI members

ETSI TC CYBER (responsible for ISI maintenance)

ETSI ISI flyer

ISI Quick Reference Card

ISI events Quick Reference Card

Club R2GS portal
Data security Security