NIS2与全球网络安全合规事件响应取证深度分析

# 取证环境初始化脚本 - 合规就绪状态检查
#!/bin/bash
echo "[+] Forensic Environment Compliance Readiness Check"
echo "=============================================="

echo "[*] Checking evidence integrity tools..."
which sha256sum >/dev/null 2>&1 && echo "[OK] sha256sum available" || echo "[FAIL] sha256sum not found"
which md5sum >/dev/null 2>&1 && echo "[OK] md5sum available" || echo "[FAIL] md5sum not found"
which python3 >/dev/null 2>&1 && echo "[OK] python3 available" || echo "[FAIL] python3 not found"

echo "[*] Checking log collection capabilities..."
for svc in auditd rsyslog syslog-ng; do
    systemctl is-active "$svc" >/dev/null 2>&1 && echo "[OK] $svc is running" || echo "[WARN] $svc is not running"
done

echo "[*] Checking forensic toolkit..."
for tool in volatility volatility3 yara log2timeline plaso; do
    which "$tool" >/dev/null 2>&1 || python3 -c "import $tool" 2>/dev/null && echo "[OK] $tool available" || echo "[INFO] $tool not installed"
done

echo "[*] Checking chain of custody templates..."
COC_DIR="/opt/forensics/templates"
if [ -d "$COC_DIR" ]; then
    TEMPLATE_COUNT=$(find "$COC_DIR" -name "*.md" -o -name "*.json" | wc -l)
    echo "[OK] $TEMPLATE_COUNT chain of custody templates found"
else
    echo "[INFO] No templates directory found at $COC_DIR"
fi

echo "[+] Compliance readiness check complete"

# NIS2最低安全措施与取证关联映射
nis2_security_measures:
  risk_analysis:
    requirement: "风险分析和信息共享"
    forensics_impact: "取证活动需要关联组织风险评估框架，证据采集优先级基于风险等级"
  incident_handling:
    requirement: "事件处理"
    forensics_impact: "建立标准化事件响应和取证流程，确保流程文档化且可审计"
  business_continuity:
    requirement: "业务连续性和危机管理"
    forensics_impact: "取证活动不能中断关键业务运行，需要在业务连续性框架内协调取证与恢复"
  supply_chain:
    requirement: "供应链安全"
    forensics_impact: "供应链攻击取证需要扩展到第三方供应商环境，涉及多法律管辖区问题"
  security_measures:
    requirement: "网络安全培训和风险意识"
    forensics_impact: "事件报告人员需要理解取证合规要求，避免证据污染或不当披露"
  encryption:
    requirement: "加密措施（包括传输加密和存储加密）"
    forensics_impact: "加密证据的获取需要合法授权，密钥托管与取证访问的平衡"
  human_resources:
    requirement: "人力资源安全管理"
    forensics_impact: "内部威胁事件取证需要结合HR流程和法律程序"
  access_control:
    requirement: "访问控制策略和管理"
    forensics_impact: "取证需要回溯访问控制日志，评估权限滥用和横向移动"

#!/usr/bin/env python3
import json
import sys
from datetime import datetime, timezone

def dora_event_classifier(event_data):
    score = 0
    classification = {}
    classification["event_id"] = event_data.get("event_id", "UNKNOWN")
    classification["detection_time"] = datetime.now(timezone.utc).isoformat()
    classification["classification_deadline"] = "4 hours from detection"

    impacted_customers = event_data.get("impacted_customers", 0)
    if impacted_customers > 100000:
        score += 3
    elif impacted_customers > 10000:
        score += 2
    elif impacted_customers > 1000:
        score += 1

    service_outage_hours = event_data.get("service_outage_hours", 0)
    if service_outage_hours > 2:
        score += 3
    elif service_outage_hours > 0.5:
        score += 2
    elif service_outage_hours > 0:
        score += 1

    data_loss_mb = event_data.get("data_loss_mb", 0)
    if data_loss_mb > 1024:
        score += 3
    elif data_loss_mb > 100:
        score += 2
    elif data_loss_mb > 0:
        score += 1

    financial_loss_eur = event_data.get("financial_loss_eur", 0)
    if financial_loss_eur > 1000000:
        score += 3
    elif financial_loss_eur > 100000:
        score += 2
    elif financial_loss_eur > 10000:
        score += 1

   跨境影响 = event_data.get("cross_border_impact", False)
    if 跨境影响:
        score += 2

    physical_damage = event_data.get("physical_damage", False)
    if physical_damage:
        score += 3

    if score >= 8:
        severity = "MAJOR_INCIDENT"
    elif score >= 4:
        severity = "SIGNIFICANT_INCIDENT"
    else:
        severity = "MINOR_INCIDENT"

    classification["risk_score"] = score
    classification["severity"] = severity
    classification["requires_regulatory_notification"] = severity in ["MAJOR_INCIDENT", "SIGNIFICANT_INCIDENT"]
    classification["notification_deadline"] = "4 hours (preliminary) / 24 hours (intermediate) / 72 hours (final)"

    classification["reporting_obligations"] = {
        "competent_authority": True,
        "resolution_authority": True if severity == "MAJOR_INCIDENT" else False,
        "client_notification": True if severity == "MAJOR_INCIDENT" else False
    }

    print(json.dumps(classification, indent=2, ensure_ascii=False))
    return classification

if __name__ == "__main__":
    sample_event = {
        "event_id": "EVT-2026-08-0042",
        "impacted_customers": 250000,
        "service_outage_hours": 3.5,
        "data_loss_mb": 5120,
        "financial_loss_eur": 2500000,
        "cross_border_impact": True,
        "physical_damage": False
    }
    dora_event_classifier(sample_event)

#!/usr/bin/env python3
import json
from datetime import datetime, timezone

def sec_materiality_assessment(event):
    factors = []
    materiality_score = 0

    if event.get("revenue_impact_pct", 0) > 5:
        factors.append("Revenue impact exceeds 5% threshold")
        materiality_score += 30

    if event.get("customer_data_compromised", 0) > 50000:
        factors.append(f"Large-scale PII exposure: {event['customer_data_compromised']} records")
        materiality_score += 25

    if event.get("business_continuity_hours", 0) > 24:
        factors.append(f"Extended business disruption: {event['business_continuity_hours']} hours")
        materiality_score += 20

    if event.get("regulatory_investigation", False):
        factors.append("Active regulatory investigation triggered")
        materiality_score += 15

    if event.get("stock_price_impact_pct", 0) > 10:
        factors.append(f"Significant stock price movement: {event['stock_price_impact_pct']}%")
        materiality_score += 25

    if event.get("competitive_disadvantage", False):
        factors.append("Potential competitive disadvantage from IP theft or exposure")
        materiality_score += 15

    if event.get("insurance_claim_amount", 0) > 1000000:
        factors.append(f"Material insurance claim: ${event['insurance_claim_amount']:,}")
        materiality_score += 10

    is_material = materiality_score >= 50
    disclosure_deadline = None
    if is_material:
        detection_date = event.get("detection_date", datetime.now(timezone.utc).isoformat())
        disclosure_deadline = "4 business days from material determination"

    result = {
        "event_id": event.get("event_id"),
        "materiality_score": materiality_score,
        "is_material": is_material,
        "factors": factors,
        "disclosure_deadline": disclosure_deadline,
        "sec_report_type": "8-K Item 1.05" if is_material else "Not required",
        "assessment_timestamp": datetime.now(timezone.utc).isoformat(),
        "recommendation": "Disclose immediately via 8-K" if is_material else "Continue monitoring and reassess"
    }

    print(json.dumps(result, indent=2, ensure_ascii=False))
    return result

if __name__ == "__main__":
    sample = {
        "event_id": "SEC-2026-EVT-0019",
        "revenue_impact_pct": 8.2,
        "customer_data_compromised": 125000,
        "business_continuity_hours": 48,
        "regulatory_investigation": True,
        "stock_price_impact_pct": 12.5,
        "competitive_disadvantage": True,
        "insurance_claim_amount": 5000000,
        "detection_date": "2026-08-10T14:30:00Z"
    }
    sec_materiality_assessment(sample)

#!/bin/bash
# 跨境取证数据处理合规检查清单
echo "[+] Cross-Border Forensic Data Processing Compliance Check"
echo "========================================================="

echo "[*] Step 1: Identify data classification"
echo "  - PII present in forensic data: [YES/NO]"
echo "  - EU data subjects affected: [YES/NO]"
echo "  - Classified/sensitive data: [YES/NO]"

echo "[*] Step 2: Determine legal basis for processing"
echo "  - GDPR Art. 6(1)(f) - Legitimate interest (forensic investigation)"
echo "  - GDPR Art. 6(1)(c) - Legal obligation (regulatory reporting)"
echo "  - GDPR Art. 9(2)(f) - Legal claims (establishment/exercise/defense)"

echo "[*] Step 3: Assess cross-border transfer mechanism"
echo "  - Transfer to adequacy country: [YES/NO]"
echo "  - SCCs in place: [YES/NO]"
echo "  - BCR approved: [YES/NO]"
echo "  - DPA reviewed and approved: [YES/NO]"

echo "[*] Step 4: Data minimization review"
echo "  - Only necessary data collected: [YES/NO]"
echo "  - Unnecessary PII redacted: [YES/NO]"
echo "  - Retention period defined: [YES/NO]"

echo "[*] Step 5: Documentation requirements"
echo "  - DPIA completed: [YES/NO]"
echo "  - Transfer impact assessment: [YES/NO]"
echo "  - DPO consultation: [YES/NO]"
echo "  - Supervisory authority notification: [YES/NO]"

echo "[+] Compliance check complete"

title: Automated Compliance Event Classification
id: auto-compliance-event-classification
status: experimental
description: Maps security events to multiple compliance framework obligations simultaneously
author: blue-team-forensics
date: 2026/08/12
modified: 2026/08/12
tags:
  - compliance
  - incident-response
  - nis2
  - dora
  - sec
  - circia
logsource:
  category: process_creation
  product: windows
detection:
  selection_suspicious_process:
    Image|endswith:
      - '\mimikatz.exe'
      - '\lazagne.exe'
      - '\seatbelt.exe'
      - '\procdump.exe'
      - '\psexec.exe'
  selection_lateral_movement:
    Image|endswith:
      - '\psexec.exe'
      - '\wmic.exe'
      - '\net.exe'
    CommandLine|contains|all:
      - '\\\\'
      - 'cmd'
  condition: selection_suspicious_process or selection_lateral_movement
level: high
compliance_mapping:
  nis2:
    notification_required: true
    deadline_hours: 24
    category: "Suspected malicious activity"
  dora:
    classification: "SIGNIFICANT_INCIDENT"
    notification_deadline: "4 hours"
  sec:
    materiality_assessment: "Required"
    disclosure_if_material: "4 business days"
  circia:
    reporting_threshold: "Evaluate if critical infrastructure entity"
    deadline_hours: 72
falsepositives:
  - Legitimate use of administrative tools
  - Penetration testing activities
  - Red team exercises

#!/usr/bin/env python3
import json
from datetime import datetime, timezone, timedelta

def generate_compliance_timeline(event_detection_time, incident_type="UNSPECIFIED"):
    detection = datetime.fromisoformat(event_detection_time)

    timeline = {
        "event_detection": event_detection_time,
        "incident_type": incident_type,
        "compliance_deadlines": {}
    }

    timeline["compliance_deadlines"]["nis2"] = {
        "early_warning": (detection + timedelta(hours=24)).isoformat(),
        "incident_notification": (detection + timedelta(hours=72)).isoformat(),
        "final_report": (detection + timedelta(days=30)).isoformat(),
        "authority": "National Competent Authority + CSIRT"
    }

    timeline["compliance_deadlines"]["dora"] = {
        "preliminary_classification": (detection + timedelta(hours=4)).isoformat(),
        "intermediate_report": (detection + timedelta(hours=24)).isoformat(),
        "final_report": (detection + timedelta(hours=72)).isoformat(),
        "authority": "Financial Competent Authority"
    }

    timeline["compliance_deadlines"]["circia"] = {
        "major_incident_report": (detection + timedelta(hours=72)).isoformat(),
        "ransomware_payment_report": (detection + timedelta(hours=24)).isoformat(),
        "authority": "CISA"
    }

    business_days_4 = detection
    days_added = 0
    while days_added < 4:
        business_days_4 += timedelta(days=1)
        if business_days_4.weekday()