Umthethonqubo wokuphepha kwe-inthanethi: imithetho, amazinga kanye nezibopho

Umhlahlandlela we-Alpha » Imidlalo » Umthethonqubo wokuphepha kwe-inthanethi: imithetho, amazinga kanye nezibopho

Imithethonqubo yokuphepha kwe-inthanethi isibe yinsika eyisisekelo yamabhizinisi , ohulumeni bomphakathi, kanye nezakhamuzi ukuthi basebenze ngokuthula kwengqondo endaweni yedijithali eqhubeka nobudlova. Ukuhlaselwa kwe-Ransomware, ukwephulwa kwedatha okukhulu, ukwebiwa kobunikazi, kanye nokucekelwa phansi kwengqalasizinda ebalulekile akusezona izimo zesikhathi esizayo, kodwa kunalokho kuyizinto ezenzeka nsuku zonke ezinhlanganweni zabo bonke ubukhulu.

Njengoba lesi simo siqhubeka, ikhambi alikwazi ukukhawulelwa ekufakeni isofthiwe ye-antivirus kanye nokuthemba okungcono kakhulu: kudingeka uhlaka lokulawula oluqinile, oluhambisanayo, noluhlala lushintsha ukuze kuchazwe izibopho ezicacile, kusungulwe amazinga okuphepha aphansi, futhi kukhuthazwe ukubambisana kwamazwe ngamazwe. Ezigabeni ezilandelayo, uzothola umbono ophelele wohlaka lwezomthetho lwaseSpain nolwaseYurophu, amazinga obuchwepheshe abaluleke kakhulu (i-ISO, i-NIST, i-ENS), izibopho zezinkampani, kanye nemikhuba yokulawula evelayo.

Kuyini ukuphepha kwe-inthanethi futhi yiziphi izinhlobo zezinsongo ezilawulwa ngumthetho?

Uma sikhuluma ngokuphepha kwe-inthanethi, sikhuluma ngokuvikela izinhlelo, amanethiwekhi, kanye nedatha kunoma yikuphi ukufinyelela okungagunyaziwe, ukusetshenziswa, ukuguqulwa, noma ukubhujiswa. Incazelo esetshenziswa yi-U.S. National Initiative for Cybersecurity Careers and Studies (NICCS) ichaza lokhu njengomsebenzi, inqubo, noma ikhono lapho izinhlelo zolwazi kanye nokuxhumana, kanye nolwazi eziluqukethe, zivikelwa khona ekulimaleni noma ekuxhashazweni.

Empeleni, lokhu kuhunyushwa kube yisethi yezinyathelo zobuchwepheshe, zenhlangano, zomthetho, kanye nezokuqeqesha ezihlose ukuvikela ulwazi lwedijithali endaweni yenethiwekhi exhumene. Ukuphepha kwe-inthanethi kuwela ngaphansi kwesambulela sokuphepha kolwazi, kodwa kugxilwe kakhulu ezingozini ezivela ikakhulukazi endaweni ye-inthanethi.

Kulo mongo, kuvela imiqondo ehlobene nemithethonqubo egxile kuyo, njengobugebengu be-inthanethi, izinsongo ze-inthanethi, kanye ne-cyberspace uqobo . Ubugebengu be-inthanethi buhlanganisa ukuziphatha kobugebengu okwenziwa nge-inthanethi (ukukhwabanisa ku-inthanethi, ukuhlaselwa kohlelo, ukuphanga nge-ransomware, njll.). Izinsongo ze-inthanethi zingamathuba noma amathuba okubangela ukulimala kusetshenziswa izindlela zedijithali. Futhi i-cyberspace iqondwa njengeqiniso elixhumene elidlulela ngale kwe-inthanethi futhi lihlanganise amanethiwekhi, amadivayisi, nezinhlelo emhlabeni jikelele.

Imisebenzi engekho emthethweni ewela ngaphansi kwalesi sambulela ihluke kakhulu: kusukela ekukhwabaniseni nge-e-commerce noma ukwebiwa kweziqinisekiso kuya ekufakweni kwe-malware ezinhlelweni zenkampani, ukusabalala kwezindaba ezingamanga ukuze kulimaze umuntu, ukuzenza ongeyena umkhiqizo, noma ukuhlaselwa ngamabomu kwengqalasizinda ebalulekile. Ngakho-ke, ukuphepha kwe-inthanethi kuxhumana namagatsha ahlukahlukene omthetho njengomthetho wobugebengu, umthetho womphakathi, ukuvikelwa kwedatha, kanye namalungelo okuhlonipha nobumfihlo.

Isihluthulelo sisesigabeni sokuziphatha okuku-inthanethi kanye nomthelela wako : lapho kuhlaselwa endaweni yedijithali, isivinini sokusabalala, ukufinyelela kwendawo, kanye nobunzima bokuhlukaniswa kushintsha ngokuphelele imithetho yomdlalo. Lokhu kuqinisekisa ukulungiswa okusheshayo komthetho ukuze kuhlanganiswe izimo ezazingakaze zicatshangelwe ngisho nasemhlabeni wezinto ezibonakalayo.

Uhlaka lwemithetho yaseYurophu yokuphepha kwe-cyber

I-European Union isungule uhlaka oluphelele lokulawula ukubhekana nezinsongo ze-cyber , ihlanganisa iziqondiso, imithethonqubo, namasu athile. Inhloso ikabili: okokuqala, ukuphakamisa izinga eliphansi lokuphepha kuwo wonke amazwe angamalungu; kanti okwesibili, ukuvimbela ubuthakathaka bezwe elilodwa ekubeni yisango lokufaka engcupheni amanye.

Iziqondiso ze-NIS kanye ne-NIS2: inhliziyo yokuphepha kwe-inthanethi e-EU

Isinyathelo sokuqala esikhulu kule nqubo kwakuyi -Directive 2016/1148, eyaziwa ngokuthi i-NIS Directive , eyasungula izinyathelo zokuqinisekisa izinga elifanayo lokuphepha kwamanethiwekhi nezinhlelo zolwazi kulo lonke i-EU. Lo mthethonqubo udinga ukuthi amazwe angamalungu amukele amasu kazwelonke okuphepha kwe-cyber, adale amaQembu Okuphendula Izehlakalo Zokuphepha Kwamakhompyutha (ama-CSIRT), futhi aqaphe abaqhubi bezinsizakalo ezibalulekile kanye nabahlinzeki bezinsizakalo zedijithali.

Isiqondiso se-NIS silawula ngqo izibopho zabaqhubi bezinsizakalo ezibalulekile (njengezamandla, ezokuthutha, ezempilo, kanye nezamabhange) kanye nabahlinzeki bezinsizakalo ezithile zedijithali. Kudingeka bathathe izinyathelo zobuchwepheshe nezenhlangano ezihambisana nengozi, baqinisekise izinga elifanele lokuphepha, futhi bazise ngokushesha igunya elifanele noma i-CSIRT kazwelonke ngezigameko ezibalulekile.

Kodwa-ke, ukwanda kobugebengu be-inthanethi kanye nokusheshisa kokwenziwa kwedijithali ngemuva kobhubhane kwabonisa isidingo sokuqhubekela phambili. Lokhu kwaholela ekwamukelweni kweSiqondiso (EU) 2022/2555, esaziwa ngokuthi yi-NIS2 , esandisa imikhakha ehlanganisiwe, siqinise izidingo zokuphathwa kwezingozi, futhi sifinyeze kakhulu izinsuku zokugcina zokubika izehlakalo (amahora angama-24 esaziso sokuqala).

I-NIS2 ifaka izibopho ezintsha zokuphepha, isungula izindlela zokuphatha eziqinile kanye nezijeziso zomnotho ezifanele zezinhlangano ezibalulekile nezibalulekile, futhi ikhomba ngokusobala umthwalo wemfanelo wezinhlangano zokuphatha, okumele zihileleke ekuphathweni kokuphepha kwe-inthanethi futhi zingajeziswa uma kwenzeka ubudedengu obukhulu.

Uhlelo lokulawula kanye nesitifiketi se-EU Cybersecurity

Enye insika ebalulekile yi- 2019 EU Cybersecurity Regulation , eqinisa igunya le-ENISA (i-European Union Agency for Cybersecurity) futhi idale uhlaka lwesitifiketi se-cybersecurity yaseYurophu lwemikhiqizo, izinsizakalo kanye nezinqubo ze-ICT.

Ngenxa yalolu hlaka, inkampani ingaqinisekisa umkhiqizo noma isevisi yokuphepha kwe-inthanethi kanye nje bese leso sitifiketi samukelwa kulo lonke elase-EU, okwenza kube lula ukuhweba kwangaphakathi nokukhulisa ukuzethemba kwemakethe. Isitifiketi siba uphawu lwekhwalithi okwenza kube lula ukubonisa ukuhambisana nezidingo zokuphepha ezifunwa amakhasimende nabalawuli.

IKhomishini yaseYurophu ibilokhu ilungisa lolu hlaka futhi iphakamise izinguquko ezithile, njengalezo ezavunywa ngoJanuwari 2025, ukuvumela izinhlelo zesitifiketi zaseYurophu ezisebenza ezinsizeni zokuphepha eziphethwe (ukusabela ezigamekweni, ukuhlolwa kokungena, ukuhlolwa kokuphepha, ukubonisana, njll.). Inhloso ukuqinisa ukwethembana ezinsizeni ezibalulekile ekuvimbeleni, ekutholeni, nasekululameni ekuhlaselweni kwe-cyber.

Indima entsha ye-ENISA

I-ENISA isuke ekubeni yinhlangano yobuchwepheshe kanye neyokweluleka ngokuyinhloko yaba yinhlangano enegunya elihlala njalo neliqinisiwe . Imisebenzi yayo eyinhloko ihlanganisa ukulungiselela isisekelo sezinhlelo zokuqinisekisa, ukubika esidlangalaleni ngezitifiketi ezikhishwe, ukusekela ukubambisana kokusebenza phakathi kwamazwe angamalungu, kanye nokusebenza njengendawo yokubhekisela ezigamekweni ezinkulu eziwela imingcele.

Ngaphezu kwalokho, iKhomishini iphakamise ukuthi i-ENISA ithuthukise ikhono elifanayo lokuphatha ubuthakathaka le-EU , inikeze izinsizakalo kubabambiqhaza futhi isebenzise indawo eyodwa yokungena yokubika izehlakalo, njengoba kucatshangelwe ezinhlelweni ezifana ne-Digital Omnibus. Konke lokhu kuhlose ukuvumelanisa ukuphathwa kobuthakathaka nokuthuthukisa impendulo ehlelekile ekuhlaselweni okuyinkimbinkimbi.

I-GDPR, i-eIDAS, i-DORA nezinye izinto ezibalulekile

Kanye ne-NIS2 kanye ne-Cybersecurity Regulation, eminye imithetho yaseYurophu inomthelela oqondile ekuphepheni kwe-cyber. I -General Data Protection Regulation (GDPR) idinga ukwamukelwa kwezinyathelo zobuchwepheshe nezenhlangano ezifanele ukuqinisekisa ubumfihlo, ubuqotho, kanye nokutholakala kwedatha yomuntu siqu, kanye nezinhlawulo ezingafinyelela ku-4% wenzuzo yomhlaba wonke.

Umthethonqubo we-eIDAS , wona, usungula uhlaka lwezinsizakalo zokuhlonza nge-elekthronikhi kanye nezokuthembana (izisayini ze-elekthronikhi, izisimboli, izitembu zesikhathi, ukulethwa nge-elekthronikhi okuqinisekisiwe, ukuqinisekiswa kwewebhusayithi). Ngokubeka izidingo zokuphepha eziqinile kakhulu, kuba yinto ebalulekile yokuqinisekisa ukwethenjwa kokuthengiselana kwedijithali kokubili emkhakheni womphakathi kanye nowangasese.

Emkhakheni wezezimali, uMthethonqubo we-DORA (Digital Operational Resilience Act) unezela ungqimba olwengeziwe lwezibopho mayelana nokuqina kwedijithali, ukuhlolwa kokungena okuthuthukile, ukuphathwa kwe-ICT okubucayi komuntu wesithathu kanye nesaziso sezehlakalo, okuhambisana nomoya we-NIS2 kodwa ngokugxila kakhulu ezinsizeni zezezimali.

Umthethonqubo wokuphepha kwe-inthanethi eSpain

ISpain ibilokhu iguqula imithetho yayo ukuze ivumelane nezidingo zaseYurophu ngenkathi ngesikhathi esifanayo ibhekana nezidingo zayo zokuvikela. Iphuzu elibalulekile lokubhekisela yiKhodi Yomthetho Wokuphepha Kwe-Cyber ​​​​eshicilelwe ku-Official State Gazette (BOE), ehlanganisa imithethonqubo eyinhloko ethinta le ndawo.

Umthetho Wesinqumo Sasebukhosini 12/2018 kanye nentuthuko elandelayo

UMthetho Wesigwebo Sasebukhosini 12/2018, mayelana nokuphepha kwamanethiwekhi nezinhlelo zolwazi , umthetho oguqula iSiqondiso sokuqala se-NIS sibe umthetho waseSpain. Uchaza izidingo zokuphepha kanye nezibopho zokubika izehlakalo kubasebenzisi bezinsizakalo ezibalulekile kanye nabahlinzeki bezinsizakalo ezithile zedijithali (izimakethe eziku-inthanethi, izinjini zokusesha, kanye nezinsizakalo zokubala amafu ezingezona amabhizinisi amancane noma amancane).

Phakathi kwezibopho ezifanele kakhulu zabahlinzeki bezinsizakalo zedijithali eziphakathi nendawo kanye nezinkulu yilezi: ukwazisa umsebenzi wabo kwigunya elifanele (uMnyango Wezinguquko Zedijithali) ezinyangeni ezintathu zokuqala, ukwamukela izinyathelo zobuchwepheshe nezokuhlela ezifanele zokuphatha izingozi zokuphepha, kanye nokwazisa izehlakalo ezibalulekile ku-CSIRT ehambisanayo (lapho kufanele khona, i-INCIBE-CERT).

Lezi zinyathelo kumele zicabangele ukuphepha kwengqalasizinda ye-IT , ukuphathwa kwezigameko, ukuqhubeka kwebhizinisi, ukuqapha kanye nokuhlola, kanye nokuhambisana nezindinganiso zomhlaba wonke. Nakuba indinganiso inganikezi uhlu oluphelele lwezilawuli, ichaza ngokucacile izindawo okumele zimbozwe ukuze kufezwe ukuphathwa kwezingozi okunengqondo nokulinganayo.

Ukuthuthukiswa komthetho kuvela ku- Royal Decree 43/2021 , echaza izibopho ezengeziwe zabasebenzisi bamanethiwekhi nezinsizakalo zokuxhumana ngogesi, okuqinisa ukuphepha nokuqina kwengqalasizinda yezokuxhumana, enye yemikhakha ebaluleke kakhulu futhi evezwe ekuhlaselweni kwe-inthanethi.

Ukuvikelwa kwedatha, izinsizakalo ezithembekile kanye nengqalasizinda ebalulekile

Ngokuphathelene nobumfihlo, uMthetho We-Organic WaseSpain Wokuvikelwa Kwedatha kanye Nesiqinisekiso Samalungelo Edijithali (i-LOPDGDD) uhambisana futhi unwebeka ku-GDPR eSpain, usungula izindlela zokuphepha ezengeziwe kanye nezibopho zokusetshenziswa kwedatha yomuntu siqu ezindaweni zedijithali. Lo mthetho udinga izinhlangano ukuthi zisebenzise izilawuli zokuphepha kwe-inthanethi eziqinile ukuvimbela ukwephulwa kwedatha nokuvuza kwayo.

Endabeni yokuhlonza nge-elekthronikhi kanye nezinsizakalo zokuthembela, uMthetho 6/2020 uvumelanisa imithetho yaseSpain neMithethonqubo ye-eIDAS, uchaza izibopho zabahlinzeki bezinsizakalo zokuthembela (isiginesha kanye nophawu lwe-elekthronikhi, ukulethwa okuqinisekisiwe, izitifiketi zokuqinisekisa, njll.) futhi usungula uhlaka olunemininingwane lokuphepha kwe-inthanethi kwalezi zinsizakalo ezibalulekile.

Ngakolunye uhlangothi, uMthetho 8/2011 mayelana nokuvikelwa kwengqalasizinda ebalulekile usungula uhlaka lwezomthetho lokuvikela izinhlelo nempahla ebalulekile emphakathini, emnothweni, kanye nokuphepha kwezwe. Nakuba imvelaphi yayo ihlobene kakhulu nokuvikelwa okungokwenyama, umthetho uyaqaphela ngokucacile ukuthi eziningi zalezi zingqalasizinda zincike kumanethiwekhi nezinhlelo ze-ICT, ngaleyo ndlela zifaka ukuphepha kwe-inthanethi njengengxenye ebalulekile yokuvikelwa okuphelele.

Okunye okungeziwe kukho konke lokhu uMthetho Wezokuxhumana Ojwayelekile ka-2022, ophoqa abaqhubi bezokuxhumana ukuthi bathathe izinyathelo zokuphepha futhi bazise iziphathimandla ngezigameko ezifanele, kanye ne- National Security Scheme (ENS) , ebuyekezwe ngo-2025, esungula izimiso zokuphepha eziphoqelekile, izidingo kanye namazinga okuphatha komphakathi kanye nabahlinzeki babo bezobuchwepheshe.

Uhlelo Lokuphepha Kuzwelonke kanye Nokuphathwa Komphakathi

Uhlaka Lokuphepha Lukazwelonke (i-ENS), empeleni, luwuhlaka lokuphepha kwe-cyber emkhakheni womphakathi eSpain. Luchaza izimiso eziyisisekelo (ukuvimbela, ukutholwa, impendulo, ukululama, ukuthuthukiswa okuqhubekayo) futhi luchaza isethi yezinyathelo okumele zisetshenziswe ngokuya ngamazinga okuphepha (aphansi, aphakathi nendawo, aphezulu) ahlobene nohlelo ngalunye lolwazi.

Lolu hlelo ludinga abaphathi kanye nabaphakeli abasebenza nabo ukuthi bahlolwe njalo futhi balawulwe ukuphepha , balondoloze izinqubomgomo ezibuyekeziwe, baphathe kahle ubunikazi kanye nokufinyelela, basebenzise ukubethela lapho kufaneleka khona, futhi baqophe futhi bahlaziye umsebenzi ukuze bathole izehlakalo.

I-NIS2 eSpain: igagasi elilandelayo lokulawula

ISpain isivele isebenza ku- Royal Decree ezoguqula i-NIS2 futhi yandise kakhulu inani lemikhakha nezinhlangano ezingaphansi kwezibopho eziqinile zokuphepha kwe-inthanethi. Ngaphezu kwemikhakha eseyimboziwe, izindawo ezintsha zizofakwa, njengabakhiqizi abathile, izinsizakalo zeposi, ucwaningo, abahlinzeki be-ICT abathuthukile, nabanye.

Phakathi kwezinguquko ezifanele kakhulu ezilindelekile ukuncishiswa okuvamile kwemingcele yesikhathi sokwazisa iziphathimandla ngezigameko ezinkulu, okuzoncishiswa kube amahora angama-24 ezimweni eziningi, kanye nokuqiniswa kwemithwalo yemfanelo yokuphatha kanye nemigomo yokwehliswa kwezigwebo , okuhambisana nezibalo zaseYurophu (izinhlawulo ezifika kuma-euro ayizigidi eziyi-10 noma iphesenti lemali engenayo emhlabeni jikelele).

Izindinganiso zobuchwepheshe zomhlaba wonke zokuphepha kwe-cyber kanye nemigomo

Ngaphandle komthetho, izinhlangano zithembele ezindinganisweni zobuchwepheshe kanye nezinhlaka zomhlaba wonke ezichaza ukuthi yiziphi izilawuli, izinqubo, kanye nemikhuba emihle okufanele isetshenziswe. Lezi zindinganiso azisizi nje kuphela ukuqinisekisa ukuthobela imithetho kodwa futhi zibonisa ukucophelela okufanele kumakhasimende, ozakwethu, kanye neziphathimandla.

Ukuphepha kolwazi lomndeni we-ISO/IEC 27000 kanye ne-ISO

Umndeni we-ISO/IEC 27000 uyindinganiso yangempela ekuphathweni kokuphepha kolwazi . Ingqikithi yawo yi-ISO/IEC 27001, echaza izidingo zokusebenzisa i-Information Security Management System (ISMS) ngokusekelwe emjikelezweni wokuthuthukisa oqhubekayo: ukuhlaziya izingozi, ukuchaza izilawuli, ukuzisebenzisa, ukuzibuyekeza, nokuzithuthukisa.

Le nqubo isekelwe ku-ISO/IEC 27002, enikeza isiqondiso esiphelele mayelana nokulawula kwenhlangano, kwezobuchwepheshe, kanye nokwezinto ezibonakalayo (izinqubomgomo, ukulawula ukufinyelela, ukubethela, ukuphepha ngokomzimba, imisebenzi ephephile, ukuphathwa kwezigameko, njll.). Izindinganiso ezihlobene zifaka phakathi i-ISO/IEC 27005 (ukuphathwa kwengozi), i-ISO/IEC 27032 (ukuphepha kwe-inthanethi ngomqondo oqinile), kanye ne-ISO/IEC 27701 (ubumfihlo).

Emikhakheni eminingi, ukuba nesitifiketi se-ISO 27001 sekuyinto ecishe ibe yimfuneko yokungena, njengoba kunciphisa kakhulu amathuba ezigameko ezinkulu , kusiza ukuhlolwa kokuthobela imithetho (GDPR, NIS2, ENS) futhi kuthuthukisa isithombe senhlangano kumakhasimende nakubatshalizimali.

I-ISO/IEC 27032: Ukuphepha Kwe-inthanethi ku-Cyberspace

Nakuba i-ISO 27001 igxile ekuphathweni okuphelele kokuphepha kolwazi, i-ISO/IEC 27032 igxile ikakhulukazi ekuphepheni kwe-inthanethi okuqondwa njengokuvikelwa kwendawo ye-inthanethi lapho abasebenzisi, izinhlelo, amanethiwekhi kanye nokuxhumana , amanethiwekhi omphakathi, amadivayisi eselula kanye nengqalasizinda ebalulekile kuhlangana khona.

Le nqubo inikeza iziqondiso zokulwa nezinsongo ezifana ne -malware ethuthukisiwe, i-spyware, i-phishing kanye nobunjiniyela bezenhlalo , ukuqinisa ukuphepha kwamanethiwekhi nezinsizakalo eziku-inthanethi, ukukhuthaza ukubambisana phakathi kohulumeni, amabhizinisi nabasebenzisi, kanye nokusungula izinhlaka zokwabelana ngolwazi mayelana nezehlakalo kanye nobuthakathaka.

Ukusetshenziswa kwayo kuwusizo ikakhulukazi ezinhlanganweni ezithembele kumasevisi efu, amapulatifomu aku-inthanethi, kanye nezinhlelo zemvelo ezisebenzisanayo, njengoba kubanikeza umbono ohlelekile wezinsongo ezindaweni ezixhumene kanye nezilawuli ezibalulekile okudingeka bazibhekane nazo.

I-ISO/IEC 27701: Ubumfihlo kanye nokuvikelwa kwedatha

I-ISO /IEC 27701 yandisa i-ISMS ye-ISO 27001 ukuze ihlanganise ukuphathwa kobumfihlo bedatha yomuntu siqu. Ichaza izindima ezengeziwe, imithwalo yemfanelo, kanye nokulawula kokubili abalawuli bedatha kanye nabaprosesa, futhi ihambisana eduze nezidingo ze-GDPR.

Ngokusebenzisa le ndinganiso, inhlangano ingabonisa ngokucacile ukuthi ifake ubumfihlo kumodeli yayo yokuphatha , iphatha izingozi ezithile ezihlobene nedatha yomuntu siqu, futhi yenze izinqubo ezisemthethweni zokubhekana namalungelo esihloko sedatha, ukuphatha ukwephulwa kwemithetho, kanye nokunciphisa ukudluliswa kwedatha kwamanye amazwe.

I-ISO 22301: Ukuqhubeka Kwebhizinisi

Ukuphepha kwe-inthanethi akugcini nje ngokulinganiswa yikhono lokumelana nokuhlaselwa, kodwa futhi nangesivinini inhlangano engalulama ngaso futhi iqhubeke nokusebenza . Yilapho i-ISO 22301, egxile ekuphathweni kokuqhubeka kwebhizinisi, ingena khona.

Leli zinga lidinga ukuhlolwa komthelela webhizinisi (i-BIA), ukusungulwa kwamasu okuqhubeka, izinhlelo zokulungisa ezibhalwe phansi, ukuhlolwa okuvamile, kanye nokugcinwa kwezindlela zokuxhumana kanye nokuxhumanisa ngesikhathi sezinhlekelele. Isigameko sokuphepha kwe-inthanethi ngaphandle kohlelo lokuqhubeka singayikhubaza inkampani amasonto amaningi futhi sidale ukulahlekelwa yizigidi.

I-NIST Cybersecurity Framework

E-United States, uHlelo Lokuphepha Kwe-Cyber ​​​​lwe-NIST selube uphawu lokulinganisa oluye lwamukelwa nezinhlangano zaseYurophu. Luhlelwe ngemisebenzi emihlanu ebalulekile: ukuhlonza, ukuvikela, ukuthola, ukuphendula, kanye nokululama.

Le ndlela ivumela izinkampani ukuthi zihlole ukuvuthwa kwazo emsebenzini ngamunye , zibeke phambili ukutshalwa kwezimali, futhi ziklame uhlelo olulinganiselayo lokuphepha kwe-cyber. Iwusizo kakhulu ekugcwaliseni izidingo zezindinganiso ze-NIS2 noma ze-ISO, njengoba inikeza ulimi oluvamile kanye nohlaka lomqondo olucacile kakhulu.

Uhlelo Lokuphepha Lukazwelonke (i-ENS) kanye nezitifiketi eSpain

Esimweni saseSpain, i-National Security Scheme (ENS) isebenza njengokuhumusha kwendawo nokuphoqelekile kwezimiso eziningi zezindinganiso zomhlaba wonke , ikakhulukazi emkhakheni womphakathi. Izinhlangano ezihlinzeka ngezinsizakalo kuhulumeni zivame ukudingeka ukuthi zivumelane nalolu hlelo, okuyinto empeleni ezishukumisela ukuba zamukele amamodeli afana ne-ISO 27001 kanye ne-27002.

Kanye ne-National Security Scheme (ENS), ukwamukelwa kwezitifiketi ezifana ne-ISO 27001 kanye nezinhlaka ze-NIST kuye kwanda. ISpain iphakathi kwamazwe aphezulu eYurophu ngokwenani lezinhlangano eziqinisekisiwe, futhi ucwaningo lubonisa ukuthi izinkampani eziqinisekisiwe zinciphisa izehlakalo ezinkulu futhi zithuthukisa amandla azo okuphendula ekuhlaselweni.

Izibopho zokuphepha kwe-inthanethi kanye nemikhuba emihle yezinkampani

Ngaphandle komthetho, noma iyiphi inhlangano ephatha ulwazi olubucayi noma enikeza izinsizakalo zedijithali kumele iqaphele ukuphepha kwe-inthanethi njengomthwalo wemfanelo obalulekile . Ngisho noma inkampani ingaphandle komkhawulo oqinile we-NIS2 noma i-Royal Decree-Law 12/2018, iziphathimandla zincoma ukusebenzisa uhlelo oluqinile lokuphepha.

Ukuhlaziywa kwengozi kanye nokuhlolwa kokuqala

Isinyathelo sokuqala esinengqondo ukwenza ukuhlaziywa kwengozi okuhlonza izimpahla ezibalulekile (idatha, izinhlelo, izinqubo), ubuthakathaka bezobuchwepheshe kanye nenhlangano, izinsongo okungenzeka kakhulu (i-ransomware, i-phishing, i-DDoS, ukuvuza kwangaphakathi) kanye nomthelela ongaba khona wesimo ngasinye.

Ngesikhathi esifanayo, ukuhlolwa kwezokuphepha kwe-cyber kuvumela ukuhlolwa kwezinga lokuvuthwa kwamanje: izinqubomgomo ezikhona, ukuhlelwa kobuchwepheshe, amazinga okulungisa, ukuqeqeshwa kwabasebenzi, ukuncika kubantu besithathu, njll. Lokhu kubuka konke okuphelele kwenza kube nokuthuthukiswa kohlelo lokusebenza olungokoqobo, kubeka phambili izinyathelo ngenzuzo enkulu ekutshalweni kwezimali ekunciphiseni ubungozi.

Incazelo yezinqubomgomo nezinqubo zangaphakathi

Uma ingozi isiqondwa, sekuyisikhathi sokuhumusha izinqumo zibe yizinqubomgomo zangaphakathi ezicacile kanye nezinqubo zokusebenza . Lokhu kuhlanganisa ukuchaza ukuthi yiziphi izinhlelo zokusebenza ezivunyelwe, ukuthi ama-akhawunti abasebenzisi aphathwa kanjani, ukuthi yiziphi izidingo zephasiwedi ezisebenzayo, ukuthi amadivayisi omuntu siqu (BYOD) asetshenziswa kanjani, ukuthi kwenziwani ngemidiya yokugcina yangaphandle, ukuthi kwenziwa kanjani futhi kuhlolwa kanjani ama-backup, njalo njalo.

Kubalulekile futhi ukusungula izinqubo zokuphatha izehlakalo (ubani owenza ini, nini ukwazisa, ubani okufanele adlulisele phambili), imithetho yokusetshenziswa kwemidiya yokuxhumana yenkampani (i-imeyili, amathuluzi okubambisana), imithetho yokufinyelela ngokomzimba ezikhungweni, kanye nemigomo yokuphepha okufanele idingeke kubahlinzeki bezinsizakalo zamafu noma abasingatha.

Amathuluzi okuzenzakalelayo kanye nobuchwepheshe

Izinqubomgomo zodwa azisho lutho ngaphandle kwamathuluzi obuchwepheshe alula ukusetshenziswa kwawo . Izingxenye ezibalulekile zifaka phakathi izinhlelo zokuthola nokuvimbela ukungena (i-IDS/IPS), izixazululo zobunikazi kanye nokuphathwa kokufinyelela (i-IAM), amapulatifomu olwazi lokuphepha kanye nokuxhumana kwemicimbi (i-SIEM), kanye nezixazululo zokubethela idatha zedatha lapho iphumula futhi isendleleni.

Ukwenza ngokuzenzakalelayo kubalulekile futhi ekuphatheni umjikelezo wokuphila kwezitifiketi zedijithali , okuphethwe kabi ukuphelelwa yisikhathi okubangela izehlakalo eziningi kunalokho okubonakala: ukuphazamiseka kwesevisi, ukwehluleka kokuqinisekisa, noma ngisho nokwephulwa kokuphepha uma izitifiketi ezisengozini zingahoxiswanga ngesikhathi.

Ukuphathwa kwesitifiketi sedijithali kanye nokusayina ikhodi

Izitifiketi zedijithali zeseva nezomsebenzisi (i-DV, i-OV, i-EV) zibalulekile ekuqinisekiseni ubuqiniso bewebhusayithi, ubumfihlo bokuxhumana, kanye nobuqotho bedatha eshintshiwe. Izinhlangano kufanele ziqinisekise ukuthi zikhetha uhlobo lwesitifiketi olufanele, zihlanganise ukuphathwa kwaso ndawonye, ​​zithole izexwayiso zokuphelelwa yisikhathi, futhi zenze ukuvuselelwa kube ngokuzenzakalela noma nini lapho kungenzeka.

Ngesikhathi esifanayo, ezinkampanini ezakha isofthiwe noma ezisabalalisa izinhlelo zokusebenza, ukusayina ikhodi yedijithali kuyindlela eyisisekelo yokulawula: kuqinisekisa ukuthi ikhodi ayikaze iphazanyiswe selokhu yakhishwa futhi kuvimbela abasebenzisi ekufakeni ama-executable ashintshwe nge-malware. Izitifiketi zokusayina ikhodi, ikakhulukazi lezo ezine-extended validation (EV), zihambisana nezindinganiso zokuthembela ezidingwa izinhlelo zokusebenza neziphequluli.

Ukuphepha kwe-imeyili kanye nokuqeqeshwa kwabasebenzi

I-imeyili isalokhu iyisivikelo esithandwayo sabahlaseli: imikhankaso yobugebengu bokweba imininingwane ebucayi kanye ne-malware esatshalaliswa nge-imeyili yizona ezibangela iningi lezigameko . Ukuze kuncishiswe le ngozi, kubalulekile ukusebenzisa amaphrothokholi afana ne-SPF, i-DKIM, kanye ne-DMARC, ukusebenzisa ukubethela kanye nokusayina kwedijithali kuma-imeyili abucayi, kanye nokusebenzisa izixazululo zokuhlunga ezithuthukisiwe kanye nokusebenzisa izandiso zesiphequluli ezivikelekile.

Kodwa-ke, ubuchwepheshe bodwa abwanele ngaphandle kokuqeqeshwa okuqhubekayo nokuqwashisa . Okuhlangenwe nakho kubonisa ukuthi ngaphezu kuka-80% wezigameko zinengxenye yomuntu: ukuchofoza okungagunyaziwe, iziqinisekiso ezabiwe, amaphasiwedi abuthakathaka, ukusetshenziswa ngokunganaki kwamadivayisi omuntu siqu, njalo njalo. Ukuhlanganisa ukuphepha kwe-inthanethi emasikweni enkampani kubaluleke njengokufaka i-firewall enhle.

Indima yezinhlangano zomhlaba wonke ekulawuleni ukuphepha kwe-inthanethi

Ukuphepha kwe-inthanethi, ngokwencazelo, kuyinkinga ewela imingcele, yingakho izinhlangano ezifana ne-UN, i-NATO, i-G7 noma i-G20 ziye zathatha indima ebalulekile ekuthuthukisweni kwezimiso, izincomo kanye nezinhlaka zokubambisana ezithinta ngqo umthetho waseSpain nowaseYurophu.

UMkhandlu WaseYurophu ukhuthaze iSivumelwano saseBudapest mayelana nobugebengu be-inthanethi , esisalokhu siyisivumelwano samazwe ngamazwe sokushushisa ubugebengu be-inthanethi. ISpain ivumelanise iKhodi yayo Yobugebengu kanye nezinqubo zokubambisana kwezomthetho nalesi sivumelwano, okwenza kube lula ukuphenywa nokushushiswa kobugebengu obuwela imingcele.

Ngesikhathi esifanayo, izinkundla ezifana ne-G7 kanye ne-G20 zikhiphe izibopho zezepolitiki ngokuvikelwa kwengqalasizinda ebalulekile, ukulwa nobugebengu be-inthanethi, ukuphathwa kwe-inthanethi, kanye nokuvikelwa kwedatha . Lezi ziqondiso zithonya ukubhalwa kwamasu kazwelonke okuphepha kwe-inthanethi kanye nezinguquko zomthetho eziqinisa ukuqina kohlelo lwezezimali, umkhakha wamandla, kanye nohulumeni we-e.

I-NATO, ngakolunye uhlangothi, ifake i-cyberspace njengenye indawo yokusebenza yokuzivikela okuhlangene . Ukubamba iqhaza kweSpain emisebenzini efana ne-Locked Shields kanye ne-Cyber ​​​​Coalition kunegalelo ekuthuthukiseni amakhono okuvikela i-cyber, ukulungisa umthetho kazwelonke, kanye nokuqinisa ukubambisana nabalingani uma kwenzeka ukuhlaselwa okukhulu kwe-cyber.

Okokugcina, i-UN, nge-International Telecommunication Union (ITU) kanye nezinye izinhlangano, ikhuthaza amazinga omhlaba wonke, izincomo zobuchwepheshe kanye nezinhlelo zokuqeqesha ezisiza amazwe ukuthuthukisa izinhlaka zomthetho ezihambisanayo, ukuvikela amalungelo abantu endaweni ye-inthanethi kanye nokuxhumanisa kangcono ezinsongweni ezivamile ze-inthanethi.

Lonke loluhlaka lwamazwe ngamazwe lubeka ingcindezi enkulu eSpain nakwamanye amazwe ase-EU ukuthi agcine izinhlaka zawo zomthetho zivuselelwa futhi zihambisana nezindinganiso zomhlaba wonke , kokubili ekuvimbeleni nasekuphenduleni izehlakalo.

Sekukonke, umthethonqubo wokuphepha kwe-inthanethi usube uhlobo lwesivikelo sokulawula esishintsha ngesivinini esifanayo nezinsongo: iziqondiso zaseYurophu ezifana ne-NIS2, imithethonqubo efana ne-GDPR, i-DORA noma i-eIDAS, imithetho kazwelonke, izinhlelo zokuphepha komphakathi, amazinga e-ISO kanye nezinhlaka ze-NIST zihlangana ndawonye njengezingcezu zephazili eziphoqa izinhlangano ukuthi zithathe ukuphathwa kwezingozi zedijithali ngokungathi sína, zenze izinhlelo zazo zokuphepha zibe ngochwepheshe futhi zicabange ukuthi ukuqina kwe-inthanethi akuseyona into eyengeziwe, kodwa kuyisimo esibalulekile sokuqhubeka nokuncintisana nokusebenza ngeziqinisekiso emnothweni wanamuhla.