信息技术.安全技术.存储安全

[中文适用范围]： 本国际标准为组织提供详细的指导意见，说明如何通过规划、设计、文件记录和实施数据存储安全方面采用经过验证且一致的方法来定义适当的安全缓解措施级别。存储安全适用于保护（安全性）在存储过程中以及在通信链路中传输时的信息安全。存储安全包括设备和介质的安全性、与设备和介质相关的管理活动的安全性、应用程序和服务的相关安全性，以及设备和介质在整个生命周期中的最终用户相关安全性，在设备和介质报废后也是如此。存储安全对涉及拥有、操作或使用数据存储设备、介质和网络的任何人都是相关的。这包括高级管理人员、购买存储产品和服务的人员，以及其他非技术人员管理者或用户，此外还包括负责信息安全或存储安全运行的经理和技术管理员，以及负责组织整体安全方案和安全政策制定的人员。对于参与规划、设计和实施存储网络安全架构方面的人来说，它也相关。 本国际标准概述了存储安全概念及相关定义。它包括与典型存储情景和存储技术领域相关的威胁、设计和控制方面的指导。此外，它提供了对其他国际标准和技术报告的引用，这些标准和技术报告涉及可以应用于存储安全的现有实践和技术。 [外文原描述]： ISO/IEC 27040:2015 provides detailed technical guidance on how organizations can define an appropriate level of risk mitigation by employing a well-proven and consistent approach to the planning, design, documentation, and implementation of data storage security. Storage security applies to the protection (security) of information where it is stored and to the security of the information being transferred across the communication links associated with storage. Storage security includes the security of devices and media, the security of management activities related to the devices and media, the security of applications and services, and security relevant to end-users during the lifetime of devices and media and after end of use. Storage security is relevant to anyone involved in owning, operating, or using data storage devices, media, and networks. This includes senior managers, acquirers of storage product and service, and other non-technical managers or users, in addition to managers and administrators who have specific responsibilities for information security or storage security, storage operation, or who are responsible for an organization's overall security program and security policy development. It is also relevant to anyone involved in the planning, design, and implementation of the architectural aspects of storage network security. ISO/IEC 27040:2015 provides an overview of storage security concepts and related definitions. It includes guidance on the threat, design, and control aspects associated with typical storage scenarios and storage technology areas. In addition, it provides references to other International Standards and technical reports that address existing practices and techniques that can be applied to storage security.