基于压电式理论的网络安全事件应急响应体系：美国的实践启示*

刘晨晖 王能民

(1. 西安交通大学管理学院 西安 710049；2. 过程控制与效率工程教育部重点实验室 西安 710049；3. 陕西省制造服务业过程挖掘工程研究中心 西安 710049)

A Cyber Security Incident Response System Based on Piezoelectric Theory—The Practice in the United States and Its Implications

Liu Chenhui1,2,3Wang Nengmin1,2,3

(1. School of Management, Xi'an Jiaotong University, Xi'an 710049;2. The Key Lab of the Ministry of Education for Process Control & Efficiency Engineering，Xi'an 710049;3. ERC for Process Mining of Manufacturing Services in Shaanxi Province, Xi'an 710049)

Abstract:[Purpose/Significance]By constructing the cyber security incident response system based on piezoelectric theory, this paper provides the theoretical foundation and practical suggestions for Chinese enterprises' incident response management. [Method/Process]Based on the text analysis of Best Practices for Victim Response and Reporting of Cyber Incidents issued by the US Department of Justice, this paper interprets the practical experience of incident response in the United States from the perspective of three stages (pre-event, in-event and post-event), and constructs cyber security incident response system from the perspective of changing events, situational awareness and critical alignment in piezoelectric theory, which is applicable to Chinese enterprises.[Result/Conclusion]Based on the practical experience of the US federal investigators, prosecutors, and US enterprises in dealing with cyber security incidents, this study puts forward a checklist of the incident response plan, in which the whole-process management and the response strategy of critical alignment provide valuable references for Chinese enterprises.

Keywords:piezoelectric theory; cyber security; incident response; critical alignment；the United States

0 引 言

随着《中华人民共和国网络安全法》和《中华人民共和国数据安全法(草案)》等一系列政策法规的公布和实行，网络安全已经成为社会各行业以及学术界关注的热点问题，同时也是国家安全与经济社会稳定运行的关键所在[1]。然而，随着企业信息系统建设的不断深入以及对信息技术依赖性的日益增强，持续增长的网络安全事件让企业的主体防护任务愈加艰巨，很多企业都存在响应计划欠缺与响应速度较慢的问题，应急响应体系的建立和完善势在必行。虽然我国已经出台了战略层面的总体性应急预案[2]——《国家网络安全事件应急预案》，但是在企业实践层面仍然存在空白。

本文参考美国司法部所发布的《网络安全事件受害者响应与报告的最佳实践》 (BestPracticesforVictimResponseandReportingofCyberIncidents)[3], 构建了一套基于压电式理论的、面向企业实践层面的网络安全事件应急响应体系。信息风险管理的压电式理论[4](Piezoelectric Theory)指出，如果企业的网络安全实践体系可以赋予其面对变化的风险事件不断调整的能力，那么来自风险事件的负面影响就能被企业的调整举措所消除。换言之，网络安全事件的影响与企业的响应能力以及准备工作呈负相关。基于压电式理论的理念，本文为我国企业构建高效的应急响应体系和提升响应速度提供了理论支持；……