ISO/IEC 27002 m o c . 5 信息技术-安全技术-信息安全控制实用 规则 b u Information technology-Security techniques h t i g -Code of practice for information security controls 目 次 前言 .................................................................................. I 引言 ................................................................................. II 0 简介 ............................................................................... II 0.1 背景和环境 ....................................................................... II 0.2 信息安全要求 ..................................................................... II 0.3 选择控制措施 .................................................................... III 0.4 编制组织的指南 .................................................................. III 0.5 生命周期的考虑 .................................................................. III 0.6 相关标准 ........................................................................ III 1 范围 ................................................................................ 1 2 规范性引用文件 ...................................................................... 1 3 术语和定义 .......................................................................... 1 4 本标准的结构 ........................................................................ 1 4.1 章节 .............................................................................. 1 4.2 控制类别 .......................................................................... 1 5 信息安全策略 ........................................................................ 2 5.1 信息安全的管理方向 ................................................................ 2 6 信息安全组织 ........................................................................ 4 6.1 内部组织 .......................................................................... 4 6.2 移动设备和远程工作 ................................................................ 6 7 人力资源安全 ........................................................................ 9 7.1 任用之前 .......................................................................... 9 7.2 任用中 ........................................................................... 10 7.3 任用的终止或变更 ................................................................. 13 8 资产管理 ........................................................................... 13 8.1 对资产负责 ....................................................................... 13 8.2 信息分类 ......................................................................... 15 8.3 介质处置 ......................................................................... 17 9 访问控制 ........................................................................... 19 9.1 访问控制的业务要求 ............................................................... 19 9.2 用户访问管理 ..................................................................... 21 9.3 用户职责 ......................................................................... 24 9.4 系统和应用访问控制 ............................................................... 25 10 密码学 ............................................................................ 28 10.1 密码控制 ........................................................................ 28 11 物理和环境安全 .................................................................... 30 11.1 安全区域 ........................................................................ 30 11.2 设备 ............................................................................ 33 12 操作安全 .......................................................................... 38 12.1 操作规程和职责 .................................................................. 38 12.2 恶意软件防护 .................................................................... 41 12.3 备份 ............................................................................ 42 h t i g b u m o c . 5 12.4 日志和监视 ...................................................................... 12.5 运行软件的控制 .................................................................. 12.6 技术脆弱性管理 .................................................................. 12.7 信息系统审计考虑 ................................................................ 13 通信安全 .......................................................................... 13.1 网络安全管理 .................................................................... 13.2 信息传递 ........................................................................ 14 系统获取、开发和维护 .............................................................. 14.1 信息系统的安全要求 .............................................................. 14.2 开发和支持过程中