Chương III Quyết định 05/2017/QĐ-TTg: Phương án ứng cứu

Chapter III

RESPONSE PLANS

Article 9. Classification of cyberinformation security incidents

Cyberinformation security incidents are considered as serious incidents when they meet all of the following criteria:

1. The compromised information system is the grade-4 or grade-5 information system or on the List of national important information systems and encounters one of the following problems:

a) The system is interrupted;

b) The top-secret data or the state secrets may be revealed;

c) The integrity of the important data of the information system is damaged and the recovery of such important data is impossible;

d) The right to control the information system is seized;

dd) The incident may occur on a large scale or cause a line of adverse impacts or harms to other grade-4 or grade-5 information systems.

2. The managing body of the information system is incapable of controlling or responding to the incident.

Article 10. Emergency response plans to ensure national cyberinformation security

1. A national emergency response plan to ensure cyberinformation security is a plan for response to a serious cyberinformation security incident that meets the criteria mentioned in Article 9 and the compromised information system is the grade-5 one or on the List of national important information systems.

2. Emergency response plans to ensure cyberinformation security of state agencies, political organizations or socio-political organizations are the plans for response to serious cyberinformation security incidents that meet the criteria stated in Article 9; the compromised information systems are the grade-4 ones and the managing bodies of the compromised information systems are affiliated to ministries, ministerial-level agencies, the Government's affiliates, state agencies, political organizations or socio-political organizations (hereinafter referred to as “central-level agencies”).

3. Provincial emergency response plans to ensure cyberinformation security are the plans for response to serious cyberinformation security incidents that meet the criteria stated in Article 9, in which, the compromised information systems are the grade-4 ones and the managing bodies of the compromised information systems are affiliated to People’s Committees or Provincial or City Committees of the Communist Party of provinces or central-affiliated cities (hereinafter referred to as “provincial agencies”).

4. Emergency response plans to ensure cyberinformation security of enterprises are the plans for response to serious cyberinformation security incidents that meet the criteria stated in Article 9, in which, the compromised information systems are the grade-4 ones and the managing bodies of the compromised information systems are telecommunications enterprises, state-owned enterprises managing information systems of grade 4 or higher, or any organizations or enterprises managing information systems on the List of national important information systems (hereinafter referred to as enterprises managing important information infrastructures).

Article 11. Cyberinformation security incident report

1. Reporting cyberinformation security incidents:

a) The information system operating unit shall be responsible for reporting the incident to the managing body, the specialized incident response unit of same level, and the National Coordination Center within 05 days from the detection of the incident; if the information system operating unit defines that the incident may be out of its control, it must carry out the emergency report procedures stated in Clause 2-5 of this Article immediately when the incident is detected or it determined that such incident is out of its control.

b) When detecting any signs of cyber attack or cyberinformation security incident, organizations or individuals should promptly report it to the information system operating unit, the managing bodies relevant information systems, the National Coordination Center and specialized incident response unit or relevant member(s) of the Incident Response Network.

2. Reports on the incident must be made immediately and maintained during the incident response, including: Incident initial report; incident follow-up reports; report on detailed response plan; report to ask for directions; report to ask for support or cooperation; incident final report.

3. Reports may be submitted in the form of official dispatch, by fax, email, MMS (multimedia messaging service) or via the national cyber security incident warning system; templates of reports shall follow regulations on response coordination or guidance by the National Coordination Center.

4. Contents of the incident initial report:

a) Name and address of the information system operating unit; the managing body of the information system; the compromised information system; time of detecting the incident;

b) Personnel in charge of the incident of the operating unit of the compromised information system: Name, position, phone number and email address;

c) Description of the incident: Type of incident, symptoms, preliminary assessment of the severity, spread and impacts of the incident on normal operations of the organization;

d) Provider of information technology/ telecommunications infrastructure services;

dd) List of response actions which have been taken or are being taken to handle the incident;

e) Organizations and/or enterprises supporting or cooperating in incident response, and handling results up to the reporting time;

g) Initial response results;

h) Recommendations for further incident response actions (if any).

5. Principles for reporting and exchanging information involving in incident response:

a) The information system operating unit shall send reports to the managing body of the compromised information system, the specialized incident response unit of the same level and the National Coordination Center;

b) The specialized incident response unit shall send reports to the managing body of the compromised information system, the Steering Committee of higher level and the National Coordination Center;

c) Ministerial- or Provincial-level Steering Committees and the National Coordination Center shall send reports to the Standing Committee and the NSC.

Article 12. Receipt, detection, classification and initial response to cyberinformation security incident

1. Upon the detection or receipt of notification/ report on a cyberinformation security incident within the scope of its management, the specialized incident response unit or the member of the Incident Response Network must:

a) Record or receive the notification or report on the cyberinformation security incident according to process;

b) Promptly notify the incident-related information to the National Coordination Center, the operating unit and the managing unit of the compromised information system and relevant regulatory authorities;

c) Respond to the sender of the incident notification or the incident initial report immediately when receiving it for confirmation purpose;

d) Verify and classify the cyberinformation security incident to select an appropriate response plan or propose the response plan to the Steering Committee of higher level and the National Coordination Center in case the incident occurs out of its control;

dd) Actively give assistance to the operating unit of the compromised information system in responding or handling the incident within the scope of its capacity and responsibility;

e) Supervise the incident response actions and send reports thereof to the Steering Committee of higher level and the National Coordination Center; propose or ask for instructions in case the incident is out of the scope of its competence and responsibility or out of its control;

g) Send periodic reports to the National Coordination Center every 6 months and irregular reports as requested.

2. The National Coordination Center shall assume responsibility to:

a) Publish its phone number, fax number, email address and hotline number on its website, and arrange sufficient staff to maintain the uninterrupted operation of hotline services to receive and respond to incidents;

b) Record or receive the notification or report on the cyberinformation security incident according to process;

c) Respond to the sender of the incident notification or the incident initial report immediately when receiving it for confirmation purpose;

d) Arrange specific staff in charge of communication works in serious incident;

dd) Verify and classify the incident to provide appropriate warnings, coordinate the selection of response plan, organize response activities and prepare reports; request the Standing Committee to make decision on the serious incident and appropriate emergency response plans; report the Standing Committee and the NSC on issues beyond its competence;

e) Organize the cooperation activities with international cyberinformation incident response organizations to receive warnings or information about the cyberinformation security incidents or risks, and cooperate in responding to cross-border incidents or attacks;

g) Fulfill other duties of the National Coordination Center.

3. The information system operating unit, when detecting or receiving the notification of the incident involved in its information system, must:

a) Record or receive the notification or report on the incident and collect information concerning the incident according to process;

b) Respond to the sender of the incident notification or the incident initial report immediately when receiving it for confirmation purpose;

c) Take charge and cooperate with cyberinformation security service providers (if any) and relevant regulatory authorities in performing analysis, verification, preliminary assessment and classification of the incident, conducting incident response actions and reporting in accordance with regulations;

d) Send reports on the incident and response actions, and requests for assistance in responding to the incident or re-assessment of the severity of the incident (where necessary) to the managing body of the compromised information system, the National Coordination Center and specialized incident response unit of the same level.

Article 13. Procedures for response to normal cyberinformation security incidents

Procedures for response to normal cyberinformation security incidents shall be performed in accordance with written guidance or regulations of Ministry of Information and Communications and the National Coordination Center.

Article 14. Procedures for response to serious cyberinformation security incidents

The following procedure for emergency response to serious cyberinformation security incidents shall be applied to the four emergency response plans stated in Article 10 herein. It includes the following steps:

1. Detection of the incident or receipt of incident report

Unit in charge: The information system operating unit; the National Coordination Center.

Coordinating units: The specialized incident response unit; the managing body of the compromised information system.

Working contents: The information system operating unit shall continuously monitor and detect sources of attacks and the incident occurring on the information system under its management. The National Coordination Center shall take charge of organizing activities of monitoring and detecting incidents, and receiving notifications of cyberinformation security incidents from various sources.

2. Verification, analysis, assessment and classification of the incident

Unit in charge: The National Coordination Center.

Coordinating units: The managing body of the compromised information system; specialized incident response units; the information system operating unit. Working contents:

a) The National Coordination Center shall cooperate with the managing body of the compromised information system (or its authorized unit such as the specialized incident response unit or the information system operating unit) to verify the incident in terms of: The incident status; the severity of incident; the extent of incident impact; target and location of the incident.

b) After the incident is verified, the National Coordination Center shall classify the incident and perform the following works:

- If the incident is classified as a normal incident (it fails to meet the criteria mentioned in Article 9 herein), the National Coordination Center shall notify the incident classification result to relevant parties so as to develop the procedure for response to a normal cyberinformation security incident;

- If the incident is classified as a serious incident (it meets the criteria mentioned in Article 9 herein), the National Coordination Center shall notify the incident classification result to the Standing Committee with the following recommendations: Response plan; units participating in the response plan; resources necessary to respond to the incident; plan for convening the Emergency Response Operations Division and performance of works stated in the following Clause 3 of this Article.

3. The Standing Committee’s decision on selection of response plan and members of the Emergency Response Operations Division.

Unit in charge: The Standing Committee.

Working contents:

a) The Standing Committee shall make decision on selection of the emergency response plan and members of the Emergency Response Operations Division according to the report made by the National Coordination Center. Based on the actual situation, the Emergency Response Operations Division is comprised of the units prescribed in Article 8 herein in conformity with the selected response plan and particulars of the incident.

b) Principles for assigning duties of the emergency response plan to ensure national cyberinformation security:

- Managing response actions and supervising cooperation and information sharing activities: Ministry of Information and Communications, the National Response Coordinating Board;

- Collecting information and sharing, reporting: The National Coordination Center, the managing body of the compromised information system (via the information system operating unit and the specialized incident response unit);

- Analyzing information: The National Coordination Center, the information system operating unit, the specialized incident response unit and members of the Emergency Response Operations Division;

- Preventing and handling incident: The information system operating unit, the specialized incident response unit, the National Coordination Center and members of the Emergency Response Operations Division;

- Remedying, removing and restoring data and normal activities: The managing body of the information system and its authorized units;

- Handling consequences: The managing body of the information system and members of the Emergency Response Operations Division;

- Publishing and handling information crisis: The Standing Committee and the National Coordination Center.

4. Implementation of initial response plan

Unit in charge: The National Coordination Center, the managing body of the compromised information system.

Working contents: The National Coordination Center shall cooperate with the managing body of the compromised information system to immediately perform initial response actions, consisting of:

a) Determination of the scope, objects and targets requiring response actions:

- Relevant incidents occurred;

- Affected objects;

- Scope of incident impact;

- Targets prioritized in the response plan (restore operation, ensure the data confidentiality; ensure the integrity);

- Developments and methods/ strategies of attack;

- Foreseen developments that may occur.

b) Coordination of initial response actions: The Standing Committee shall direct the National Coordination Center to coordinate and share information and documents related to the incident to members of the response plan according to their assigned functions and duties.

c) Warning of the incident on the incident response network: The National Coordination Center shall give warnings of the incident to members of the Incident Response Network and relevant entities or those may face similar incidents.

d) Implementation of temporary recovery measures:

Based on prioritized targets in incident response plan, the managing body of the compromised information system shall cooperate with the National Coordination Center, relevant service providers and other regulatory authorities to recover the most necessary functions, data or connections to minimize damage to the information system, or the prestige of the managing body of the information system as well as mitigate the adverse influence on the society, if any.

The managing body of the information system must closely cooperate with and provide sufficient information to the National Coordination Center in order to supervise and monitor the recovery process and attacks or effects while the incident is still not yet handled thoroughly.

dd) First steps for dealing with consequences: The managing body of the information system should promptly emergency measures to deal with consequences or damage of cyberattacks which cause adverse impacts on the people, society, other authorities and/or organizations at the request of the Standing Committee.

e) Prevention and control of detected attack attempts: The Standing Committee shall coordinate or instruct the National Coordination Center to coordinate relevant regulatory authorities to perform actions to detect and handle sources of attacks and prevent external attacks against the compromised information system. The Standing Committee shall provide or instruct the provision of information and/or evidence relating illegal acts having constituents of a crime (if any) to regulatory authorities affiliated to the Ministry of Public Security so that they can investigate, verify and prevent crimes.

5. Implementing the emergency response plan

a) Directing incident response actions

Unit in charge: The Standing Committee, the Ministerial- or Provincial-level Steering Committees on emergency response to cyberinformation security incidents.

Working contents: Based on the selected response plan, the Standing Committee shall direct the managing body of the compromised information system, the National Coordination Center and the Emergency Response Operations Division to perform duties of the response plan. During the implementation of the response plan, the Standing Committee may, depending on the actual developments of the incident, make decisions on selection of additional members to the Emergency Response Operations Division.

b) Coordinating response actions

Unit in charge: The National Response Coordinating Board, the National Coordination Center.

Working contents: Based on the selected response plan, the National Response Coordinating Board or the National Coordination Center shall coordinate response actions within the ambit of assigned functions and duties and supervise the cooperation and information sharing activities.

c) Statements and information disclosure

The Standing Committee shall assume responsibility to appoint spokespersons to declare statements and provide related information; make decision on location, contents and time of declaring statements and providing related information to mass media agencies, individuals and organizations involved in the incident.

d) Information collection

Unit in charge: The National Coordination Center, the managing body of the information system. Working contents: Based on requests for information submitted by members of the Emergency Response Operations Division, the National Coordination Center shall cooperate with the managing body of the information system to collect, gather and provide information as requested.

dd) Analysis and supervision of incident-related issues

The National Coordination Center shall take charge and cooperate with the managing body of the information system to conduct continuous supervision of incident developments and send notices thereof to the members of the Emergency Response Operations Division.

Members of the Emergency Response Operations Division shall base on obtained information, resources and facilities and adopt operational procedures to analyze the incident. Results of the analysis of incident shall be reported to the Standing Committee and the National Coordination Center, and shared among members of the Emergency Response Operations Division so as to effectively handle the incident.

e) Handling of incident and malware removal

Unit in charge: The managing body of the information system

Coordinating units: The National Coordination Center, other members of the Emergency Response Operations Division. Working contents:

- Back up the system prior to and after implementing actions to handle the incident;

- Delete malcode or malware;

- Restore the system, data and connections;

- Configure security systems;

- Test the entire system after completing incident response actions;

- Handle information security vulnerabilities;

- Supplement or replace equipment, hardware and software to ensure information security of the system;

- Monitor, supervise and prevent the incident or similar incidents from occurring in the future.

g) Prevention and handling of impacts

The managing body of the information system is responsible for handling the negative impacts of the incident on the people, and other authorities and organizations.

Based on results of analysis of the incident, members of the Emergency Response Operations Division shall use their available resources, facilities and operational techniques to prevent acts that may cause security incidents and assist in handling impacts of the incident.

h) Finding out and verifying the causes of incident

After completing the analysis of incident or consulting results of analysis of incident provided by other units, members of the Emergency Response Operations Division shall take advantage of available information and implement their operational procedures to find out the root causes of the incident, and send report thereof to the Standing Committee/ the National Coordination Center so as to verify and send consolidated report thereof to the NSC with the following contents:

- Targets of security attacks;

- Attack methods/ strategies (processes, techniques, malcode or malware);

- Time of attack;

- Damage suffered;

- Attackers;

- Predicted similar attack activities and potential damage.

6. Assessing results of the emergency response plan to ensure national cyberinformation security

Unit in charge: The National Steering Committee (NSC)

Working contents: The Standing Committee shall consolidate reports on analytical activities relating the emergency response plan to ensure national cyberinformation security so as to report to the NSC and organize a meeting for analyzing the causes of the incident and learning experience in incident response and propose appropriate measures for dealing with similar incidents.

7. Finalization of response actions

Unit in charge: The National Coordination Center

Coordinating units: The managing body of the information system, and members of the Emergency Response Operations Division. Working contents: The National Coordination Center shall base on the assessment results of the NSC to fulfill the following duties and finalize the emergency response actions:

- Store relevant documents and records;

- Prepare teachings of experience;

- Propose recommendations on techniques and/or policies to minimize damage caused by similar attack activities;

- Send reports to the authorities of higher level, organize press conferences or provide information to mass media agencies, where necessary.