TFL Vsebine / Revija SIR*IUS

Cyber Security Review

Pojem kibernetske varnosti ni soglasno določen, zato pregled tega področja zahteva jasno določitev ciljev, omejitev in predvsem sodil pregleda. Pri sodilih je razen splošnih okvirov upravljanja in vodenja informacijskih sistemov, kot sta COBIT 2019 in ITIL, ali standardov, kot je SIST EN ISO/IEC 27001:2017, smiselno uporabiti tudi podrobnejše izvedbene tehnične smernice in dobre prakse, kot so na primer okvir NIST in CIS-ove kontrole. Le z dovolj podrobnimi sodili je mogoče utemeljeno, brez proste presoje, izvesti pregled ter strokovno utemeljiti ugotovitve in priporočila. Ne glede na uporabljene smernice je pregled kibernetske varnosti povezan s podrobnimi tehničnimi kontrolami, pri pregledu katerih mora smiselno sodelovati ustrezno usposobljen strokovnjak.

The concept of cyber security is not defined unanimously, so the review of this area requires a clear definition of the objectives, limitations, and, above all, the review criteria. In addition to general frameworks for the management and governance of information systems such as COBIT 2019 and ITIL or standards such as SIST EN ISO / IEC 27001: 2017, it makes sense to use more detailed technical guidelines and good practices, such as the NIST framework and CIS Controls. Only with the use of sufficiently clear criteria is it possible to carry out a reasoned review and professionally substantiate findings and recommendations without discretion. Irrespective of the guidelines used, the cyber security review is linked to detailed technical controls, the assessment of which must involve a suitably qualified professional.