Dell SecureWorks - ISO27001

Dell SecureWorksISO 27001Naveed IslamPrinciple Consultant

INFORMATIONInformation is an asset which, like other importantbusiness assets, has value to an organisation andconsequently needs to be suitably protected’ ISO 27002:20052

INFORMATION TYPES Information Assets exist in many forms: o Printed or written on paper o Stored electronically o Transmitted by post or by electronic means o Displayed/published on the internet o Verbal – spoken to conversations‘…Whatever form the information takes, or means by whichit is shared or stored, it should always be appropriatelyprotected’ • (BS ISO 27002:2005)3

INFORMATION SECURITYInformation security involves the preservation of:• Confidentiality: Preventing the disclosure of information to unauthorised individuals or systems• Integrity: Ensuring data cannot be modified without authorisation• Availability: Ensuring that information and associated assets are accessible, whenever necessary, by authorised individuals4

INFORMATION SECURITYCOMPONENT PEOPLE PROCESSES TECHNOLOGY5

THE NEEDS FOR INFORMATION SECURITYThe consequences of insufficient security o Loss of competitive advantage o Identity theft o Equipment theft o Service interruption (e.g., e-mail) o Embarrassing media coverage o Compromised customer confidence; loss of business o Legal penalties6

ISO 27001 ISO 27001:2005 Information technology — Security techniques — Information security management systems — Requirements ISO 27002:2005 Information technology — Security techniques — Code of practice for information security management7

ISO 27001 FEATURES Plan, Do, Check, Act (PDCA) Process Model Process Based Approach Stress on Continual Process Improvements Scope covers Information Security not only IT Security Covers People, Process and Technology 11 Domains, 39 Control objectives, 133 controls8

PDCA PROCESS9

ESTABLISHING AN ISMS – “PLAN”10

IMPLEMENT AND OPERATE (“DO”) Execute risk treatment plan (RTP) o Implement the risk treatment plan in order to achieve the identified control objectives. Implement training and awareness o User awareness training is conducted to increase the level of awareness in the employees. Whatever solutions have be implemented, unless the user awareness is strong, it will be biggest threat to the organisation. Put policies and procedures to practice o Implement controls selected to meet control objectives o Define how to measure the effectiveness of the selected controls Manage incidents o Implement procedures and other controls capable of enabling prompt detection of and response to security incidents11

CONTROL CLAUSES – ISO 27002 Information Security Policy Organisation Compliance of Information Security Business Asset Continuity Management Planning Human Incident Resource Management Security Availability System Development Physical & Security Maintenance Communication Access Control & Operations Management12

MONITOR AND REVIEW (“CHECK”) Perform monitoring procedures. o Promptly identify attempted and successful security breaches and incidents. o Help detect security events or security incidents by use of indicators Conduct periodic review of ISMS o Update security plans Review residual risk o Review risk assessments at planned intervals and review level of residual risk and identified acceptable risk. Internal ISMS audit. o Measure effectiveness of controls to verify that security requirements have been met. Regular management reviews o Undertake management review of ISMS on a regular basis to ensure that the scope remains adequate and improvements in ISMS process are identified.13

MAINTAIN AND IMPROVE (“ACT”) Implement improvements o Implement the identified improvement in the ISMS. Corrective actions o Take appropriate corrective and preventative actions o Take in account results of security audits, incidents, effectiveness measurements, suggestions and feedback from all concerned parties. Communication o Communicate the actions and improvement to all interested parties Meet objectives o Ensure that the improvements achieve the organisation’s intended objectives.14

COMMON ISO 27001 CHALLENGES Agreeing the Scope o Too small v.s. too large Management Support o Getting sufficient resources and having information security recognised as a priority so that a proper system of controls can be implemented. User Awareness o Getting user “buy-in” for the process15

BENEFITS At the organizational level – Commitment At the legal level – Compliance At the operating level - Risk management At the commercial level - Credibility and confidence At the financial level - Reduced costs At the human level - Improved employee awareness16

Thanks for attending the webcast ! For more information please contact Dell SecureWorks on 0131 718 0700 or email Ukenquiry@secureworks.com17

Dell SecureWorks - ISO27001

by Dell SecureWorks on Apr 23, 2012

Accessibility

Categories

Upload Details

Usage Rights

Statistics

Dell SecureWorks - ISO27001 Presentation Transcript