ISO/IEC 27042-ed.1.0

Detail information

Designation: ISO/IEC 27042-ed.1.0

Publication date: 19/06/2015

Pages: 14

Country: International technical standard

Where to buy?

You can buy at www.mystandards.biz

Anotation

ISO/IEC 27042:2015 provides guidance on the analysis and interpretation of digital evidence in a manner which addresses issues of continuity, validity, reproducibility, and repeatability. It encapsulates best practice for selection, design, and implementation of analytical processes and recording sufficient information to allow such processes to be subjected to independent scrutiny when required. It provides guidance on appropriate mechanisms for demonstrating proficiency and competence of the investigative team. Analysis and interpretation of digital evidence can be a complex process. In some circumstances, there can be several methods which could be applied and members of the investigative team will be required to justify their selection of a particular process and show how it is equivalent to another process used by other investigators. In other circumstances, investigators may have to devise new methods for examining digital evidence which has not previously been considered and should be able to show that the method produced is "fit for purpose". Application of a particular method can influence the interpretation of digital evidence processed by that method. The available digital evidence can influence the selection of methods for further analysis of digital evidence which has already been acquired. ISO/IEC 27042:2015 provides a common framework, for the analytical and interpretational elements of information systems security incident handling, which can be used to assist in the implementation of new methods and provide a minimum common standard for digital evidence produced from such activities. LISO/IEC 27042:2015 fournit des preconisations concernant lanalyse et linterpretation des preuves numeriques dune facon qui traite les problemes de continuite, de validite, de reproductibilite et de repetabilite. Elle englobe les pratiques dexcellence sur la selection, la conception et la mise en ?uvre des processus analytiques et de consignation des informations suffisantes pour permettre la soumission de tels processus a un examen approfondi independant, si necessaire. Elle fournit des preconisations concernant des mecanismes adequats de demonstration de laptitude et de la competence de lequipe dinvestigation. Lanalyse et linterpretation des preuves numeriques peuvent etre un processus complexe. Dans certains cas, il peut exister plusieurs methodes qui pourraient etre appliquees et les membres de lequipe dinvestigation devront justifier leur selection dun processus donne et demontrer son equivalence par rapport a un autre processus utilise par dautres investigateurs. Dans dautres cas, les investigateurs peuvent etre obliges de concevoir de nouvelles methodes dexamen des preuves numeriques qui nont pas ete envisagees auparavant et il convient quils soient capables de demontrer que la methode produite est «en adequation avec lapplication visee». Lapplication dune methode specifique peut influer sur linterpretation des preuves numeriques traitees avec cette methode. Les preuves numeriques disponibles peuvent influer sur la selection des methodes pour lanalyse ulterieure des preuves numeriques qui ont deja ete acquises. LISO/IEC 27042:2015 fournit un cadre commun, pour les elements danalyse et dinterpretation de la gestion des incidents de securite des systemes dinformation qui peut etre utilise pour faciliter la mise en ?uvre de nouvelles methodes et fournir une norme commune minimale pour les preuves numeriques produites a partir de telles activites.