Shulou(Shulou.com)12/24 Report--

Thanks to CTOnews.com netizens for the delivery of clues about the past. CTOnews.com, December 8, the State Internet Information Office openly solicited opinions on the measures for the Administration of Network Security incident reports (draft for soliciting opinions).

According to reports, the purpose of the "measures" is to standardize the reporting of network security incidents, reduce the losses and hazards caused by network security incidents, and maintain national network security.

The draft for soliciting opinions proposes that in the event of a network security incident, the operator should promptly initiate an emergency plan to deal with it. According to the guidelines for the Classification of Network Security events, if it belongs to a large, major or particularly significant network security event, it shall be reported within 1 hour.

Among them, if the network and system belong to the various departments of the central and state organs and the enterprises and institutions under their management, the operator shall report to the network letter working organization of the department. If it is a major or particularly major network security incident, the network letter working organs of each department shall report to the state network letter department within 1 hour after receiving the report.

If the network and system are key information infrastructure, the operator shall report to the protection department and the public security organ. If it is a major or particularly major network security incident, the protection department shall, within 1 hour after receiving the report, report to the state Internet communication department and the public security department under the State Council.

Other network and system operators shall report to the local network information department. If it is a major or particularly major network security incident, the local network letter department shall, after receiving the report, report to the network letter department at a higher level within 1 hour.

If there is a competent regulatory department of the industry, the operator shall also report in accordance with the requirements of the competent regulatory department of the industry.

The operator shall report the incident in accordance with the Network Security incident Information report form, including at least the following:

The name of the unit involved in the incident and the basic information of the facilities, systems and platforms where the incident occurred.

The time, place, type, impact and harm caused by the discovery or occurrence of the event, and the measures and effects taken. In the case of blackmail software attacks, the amount, method and date of the ransom demand shall also be included.

The trend of the situation and its possible further impact and harm

A preliminary analysis of the causes of the incident

Clues needed for further investigation and analysis, including possible attacker information, attack paths, vulnerabilities, etc.

Proposed further response measures and requests for support

Protection at the scene of the incident

Other circumstances that should be reported.

When the incident disposal is over, the operator shall, within 5 working days, comprehensively analyze and summarize the causes of the incident, emergency measures, hazards, responsibility handling, rectification, lessons learned, etc., and report the report in accordance with the original channels.

CTOnews.com is attached with "Network Security event grading Guide" and "Network Security event Information report form". Click the link to view it directly.

Referenc

Circular of the State Internet Information Office on the measures for the Administration of Network Security incident reports (draft for soliciting opinions)

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.