Chương III Thông tư 20/2017/TT-BTTTT: Hoạt động điều phối, ứng cứu sự cố

Chapter III

INCIDENT COORDINATION AND RESPONSE

Article 8. Incident coordination and response

1. Incident coordination and response are implemented by National coordinating authority and competent authorities in order to mobilize, operate, and jointly cooperate resources, including: personnel, materials (equipment), financial (finance, budget) to prevent, monitor, collect, discover, and warning against incidents; receive, analyze, verify, and classify incidents; operate, cooperate, and organize incident response, stay ready to respond and rectify incidents in order to minimize risks and damage caused by the incidents.

2. National coordinating authority shall issue warning, coordinate nation-wide incident response efforts; mobilize and coordinate network members and relevant organizations, entities to cooperate in preventing, dealing with, and rectifying nation-wide incidents; promulgate and assume responsibility for orders/request for coordination using Form No. 6 attached hereto;

3. Activities involved in incident coordination and response:

a) Monitoring, analyzing, discovering, warning about risks, threats, holes, incidents, cyber attacks and solutions for incident prevention;

b) Developing, proposing incident response solutions and plans;

c) Organize trainings and drills regarding incident response and cyber information security assurance;

d) Operating and mobilizing resources to respond to incidents within their competence; providing technical support and taking measures to respond to and prevent cyber attack;

dd) Investigating, analyzing, identifying origin, methods, and form of attack in order to deal with, prevent, issue warnings and guidelines to prevent widespread incidents; collecting, developing incident summary reports;

e) Sharing, exchanging, providing information between relevant agencies and organizations regarding incident response, incident response and coordination, and incident resolution;

g) Conducting other activities relating to incident response according to Decision of the Ministry of Information and Communications.

4. Information exchange regarding incident coordination and response shall be implemented via: Official dispatch, electronic mail, telephone, fax, multimedia messages, advanced technical communication systems; and compliant with relevant law provisions regarding exchanging of confidential information.

Article 9. Notifying and reporting cyber information security incidents

1. Methods of notifying, reporting incidents

a) Methods of notifying incidents: Official dispatch, fax, electronic mail, multimedia messages, or technical system for reporting cyber information security incident according to guidelines of the National coordinating authority;

b) Methods of reporting incident: Physical document or electronic document (bearing signature and seal or digital signature of competent individual).

2. Reporting cyber information security incident

a) Within 5 days from the date on which incidents are discovered, entities and individuals operating information system are responsible for sending information on the incidents according to Point a Clause 3 of this Article (Incident Notification) to: Entities presiding the information system, National coordinating authority, incident response specialists, and relevant members of incident response network (if any). If incident rectification has not been completed at the time of reporting, entities and individuals operating information systems shall send update on the incident to previous recipients as soon as rectification completes;

b) If entities or individuals operating information system deem the incidents exceed their capability, they shall submit Initial incident report to entities presiding information system, relevant incident response specialists (if any), and National coordinating authority; entities or individuals operating information system shall send Final incident report to entities presiding information system and National coordinating authority within 5 days from the date on which incident response is complete. National coordinating authority shall only acknowledge completion of incident response efforts after receiving Final incident report;

c) Organizations and individuals that are not those operating information system shall, upon discovering signs of attack or cyber information security incidents, shall immediately send notification (Incident Notification) to entities and individuals operating information system, entities presiding information system, National coordinating authority, incident response specialists, and/or relevant members of incident response network.

3. Types of incident notification, report:

a) Incident notification consists of: Name, address of entities, individuals sending the notification; name or domain name, IP address of information system to which incidents occur; name, address of entities and individuals operating, presiding information system to which incidents occur (if known); description of the incident and time in which the incident is discovered; incident resolution results, propositions, recommendations, and other relevant information (if any);

b) Initial incident report shall conform to Form No. 3 under Appendix I attached hereto;

c) Situation report;

d) Specific response solution report;

dd) Assistance and cooperation request;

e) Final incident report, using Form No. 4 under Appendix I attached hereto.

4. Throughout incident response process, entities and individuals operating information system shall take charge and cooperate with relevant agencies, entities in developing and maintaining incident response reports as per the law and at request of competent authority.

Article 10. Discovering, receiving, verifying, taking initial actions, and classifying cyber information security incidents

1. Entities and individuals operating information system shall have responsibility to:

a) Upon discovering incidents: Monitor, record, and gather information relating to the incidents, organizations sending incident notification or report in accordance with Article 9 hereof;

b) Upon receiving incident notification: Immediately inform organizations, individuals sending incident notification about received notification;

c) Verify incidents and take initial actions: Take charge, cooperate with entities responsible for information security (if any), relevant incident response specialists, telecommunication enterprises, internet service providers (ISP) in analyzing, verifying, and evaluating the incidents; perform initial response activities, implement response procedures according to cyber information security incident response procedures approved by competent authority or procedures under Article 11 hereof; if the incidents are possibly serious incidents, immediately report to entities presiding information system, relevant incident response specialists in order to classify the incidents as serious incidents and report to National coordinating authority.

2. Incident response specialists or members of incident response network shall have the responsibility to:

a) Upon discovering incident: Immediately inform entities, individuals operating information systems and presiding information system, and National coordinating authority about the incidents;

b) Upon receiving incident notification or reports: Acknowledge, receive as per the law, and respond to incident notification or report senders after receiving;

c) Organizing verification and incident resolution: Cooperate with entities and individuals operating information system in assessing, verifying, and dealing with the incidents within their capability and responsibility; if the incidents exceed their capability or are possibly serious incidents, report to entities presiding information system and National coordinating authority;

d) Supervise development of incident response operations, report or propose, request direction of entities presiding information system and Ministerial/Provincial steering committees if the incidents exceed the scope of their powers and responsibilities or capabilities;

dd) Consolidate and report to National coordinating committee regarding incident development when requested.

3. National coordinating authority shall have the responsibility to:

a) acknowledge, receive incident notification, report according to procedures;

 b) respond to incident notification, report senders upon receiving incident notification, report;

c) assess, identify, and classify incidents in order to issue warnings, coordinate, choose solutions, organize response, report, and request Standing authority to consider, decide on serious incidents and appropriate emergency response solutions. If an incident is classified as a serious incident, National coordinating authority shall take charge and cooperate with relevant authorities in implementing subsequent steps in serious incident response procedures under Decision No. 05/2017/QD-TTg;

d) organize cooperation with international cyber information response organizations in receiving early warnings, information on incidents, risk of cyber information security violation, and cooperation in responding to cross-border incidents, attacks;

dd) implement other responsibilities of National coordinating authority, report and propose to Standing authority regarding issues that exceed their capability.

Article 11. Cyber information security incident response procedures

Cyber information security incident response procedures according to chart under Appendix II include:

1. Receiving, analyzing, providing initial response, and notifying incident

a) Receiving and verifying incident

Presiding entities: Entities, individuals operating information system.

Cooperating entities: Incident response specialists, National coordinating authority.

Details: Monitoring, receiving, analyzing warnings, signs of incidents from internal and external sources. If the incident is verified to have occurred, acknowledging, collecting evidence, and identifying origin of the incident.

b) Implementing initial response steps

Presiding entities: Entities, individuals operating information system.

Cooperating entities: Incident response specialists, relevant network members, and National coordinating authority.

Details: Once the incident has been verified to occur, entities and individuals operating information system shall rely on the nature and signs of the incident in order to implement initial steps to deal with the incident according to incident response plan approved by competent authority or according to instructions of incident response specialists or National coordinating authority.

c) Implementing response solutions

Presiding entities: Entities, individuals operating information system.

Cooperating entities: Incident response specialists, relevant network members, and National coordinating authority.

Details: Based on incident response plans approved by competent authorities or instructions of incident response specialists or National coordinating authority, choose solutions for preventing and dealing with the incident; report and request entities presiding information system, Ministerial/Provincial steering committees to seek direction if necessary.

d) Directing incident resolution (if necessary)

Presiding entities: Ministerial/Provincial steering committees.

oCooperating entities: Entities presiding information system.

Details: Based on report and proposition of entities and individuals operating information system, Ministerial/Provincial steering committees shall cooperate with entities presiding information system and consult National coordinating authority (if necessary) in order to direct incident response specialists, summon incident response teams/units within their management to implement incident response efforts; direct and coordinate communication, information disclosure. Depending on situation development throughout response procedures, Ministerial/Provincial steering committees shall decide to expand the compositions of incident response teams/units, adjust incident response plans.

dd) Filing incident report

Presiding entities: Entities, individuals operating information system.

Cooperating entities: Relevant/responsible incident response specialists, telecommunication enterprises, ISP.

etDetails: When initial response steps have been implemented, entities operating information system shall send incident notification and report to their relevant internal and external organizations, individuals according to Article 9 hereof and internal regulations (if any).

e) Coordinating response efforts

Presiding entities: Ministerial/Provincial steering committees; National coordinating authority.

Cooperating entities: Entities and individuals operating information system, incident response specialists, relevant network members.

Details: Depending on the nature of the incident and request for assistance of entities and individuals operating information system and incident response specialists, Ministerial/Provincial steering committees and National coordinating authority shall coordinate, supervise cooperation and information sharing within their functions, powers, and tasks in order to mobilize incident response resources.

2. Implementing incident response, prevention, and handling

Presiding entities: Entities and individuals operating information system; incident response specialists.

Cooperating entities: Entities responsible for maintaining information security for the system to which the incident occurs, incident response specialists, relevant network members, and National coordinating authority.

Details:

a) Collecting evidence, analyzing, identifying scope and affected entities.

)b) Analyzing, identifying origin of the attack, responding, preventing, and minimizing impact, damage to information system.

3. Handling incident, removing, and restoring

a) Handling incident and removing

Presiding entities: Entities and individuals operating information system; incident response specialists.

Cooperating entities: Entities responsible for maintaining information security for the system to which the incident occurs, incident response specialists, relevant network members, and National coordinating authority.

Details: After preventing the incident, entities and individuals operating information system, incident response specialists, incident response teams/units shall remove eliminate and remove malware, harmful software, and rectify information security weaknesses of information system.

b) Restoring

Presiding entities: Entities, individuals operating information system;

Cooperating entities: Incident response teams/units, entities responsible for maintaining information security for the system to which the incident occurs, incident response specialists, relevant network members, and National coordinating authority.

Details: entities and individuals operating information system shall take charge and cooperate with relevant entities in restoring information system, data, and connection; configuring safe system; adding equipment, hardware, and software to ensure information security for information system.

c) Inspecting and evaluating information system

Presiding entities: Entities, individuals operating information system.

Cooperating entities: Entities responsible for maintaining information security for the system to which the incident occurs, incident response specialists, entities presiding information system, National coordinating authority.

Details: Entities and individuals operating information system and relevant entities shall inspect, evaluate operation of the entire information system after the incident has been rectified. If stable operation of the system has not been achieved, continue to collect, re-identify the causes, and take steps specified under Clause 2 and Clause 3 of this Article in order to extensively rectify and restore normal operation of information system.

4. Concluding and evaluating

Presiding entities: Entities, individuals operating information system.

Cooperating entities: Incident response specialists; incident response teams/units; entities presiding information system; Ministerial/Provincial steering committees; National coordinating authority.

Details: Entities and individuals operating information system to which the incident occurs shall cooperate with incident response specialists and incident response teams/units in consolidating information, report, analysis relating to the incident, the implementation of incident response efforts, sending to entities presiding information system, Ministerial/Provincial steering committees, and National coordinating authority; analyzing causes, learning from experience in incident response, and proposing additional solutions in order to prevent and respond to similar incidents in the future.