Overview
ISO/IEC 27039:2015 - corrected 2016 - is an ISO/IEC standard that provides guidelines for the selection, deployment and operations of intrusion detection and prevention systems (IDPS). It explains background concepts, helps organizations plan for IDPS adoption, and guides ongoing operation and integration of IDPS within an overall information security program. The standard complements ISO/IEC 27001/27002 by supporting controls for timely detection, monitoring and response to security incidents.
Key topics and technical coverage
ISO/IEC 27039 addresses practical and technical aspects of IDPS without prescribing a single implementation. Major topics include:
- IDPS types and scope
- Host-based IDPS (HIDPS) and Network-based IDPS (NIDPS) - differences, roles and selection considerations.
- Selection criteria
- Risk assessment alignment, environment compatibility, performance, scalability, cost, vendor support, verification of capabilities and update strategies.
- Deployment guidance
- Staged deployment approaches and recommended placement considerations (inside/outside firewalls, on backbone links, on critical subnets, host deployments).
- Operations and lifecycle
- Tuning, alert handling, vulnerability management, safeguarding IDPS data, and operational processes for sustained effectiveness.
- Detection and response
- Alert strategies, active vs passive response options, integration with incident response teams (ISIRT), and outsourcing considerations.
- Complementary tools
- Integration with SIEM, firewalls, file integrity checkers, honeypots, vulnerability scanners and anti-malware/content protection.
- Legal, privacy and forensics
- Considerations when monitoring and responding, including privacy constraints and evidence handling.
- Support elements
- Scalability, technical support, training needs and verification/testing of IDPS performance.
Practical applications - who should use it
ISO/IEC 27039 is intended for organizations planning to deploy or operate IDPS, and for third-party service providers and security architects. Typical audiences:
- Security architects and network engineers selecting and placing IDPS components
- Information security managers aligning detection capability with ISO/IEC 27001 controls
- Incident response teams integrating IDPS alerts into response workflows
- Managed security service providers (MSSPs) designing outsourced IDPS services
- Procurement and compliance teams evaluating vendor claims and support requirements
Benefits and SEO keywords
Using ISO/IEC 27039 helps organizations achieve consistent, risk-based IDPS selection, effective IDPS deployment, and robust IDPS operations tied to incident detection and response. Relevant keywords: ISO/IEC 27039, IDPS, intrusion detection, intrusion prevention, host-based IDPS, network-based IDPS, SIEM, incident response, security standards.
Related standards
- ISO/IEC 27001 - Information security management systems (ISMS)
- ISO/IEC 27002 - Security controls guidance
- ISO/IEC 20000 - IT service management (outsourcing/SLA considerations)
- NIST SP 800-94 (referenced background material used in development)