Your SlideShare is downloading. ×
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Implementing a Security Framework based on ISO/IEC 27002
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

Implementing a Security Framework based on ISO/IEC 27002

3,053

Published on

0 Comments
6 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
3,053
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
0
Comments
0
Likes
6
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. Focused on Security. Committed to Success.Implementing a Security FrameworkBased on ISO/IEC 27002Presented by: Michael Leung, CRISC, CGEIT, CISM, CISA, CISSP-ISSMPDate: February 24, 2011
  • 2. Table of Contents Implementing a Security Framework based on ISO/IEC 27002 • Sections of ISO/IEC 27002 Code of Practice • ISO 27002 Scope of Assessment • Maturity Model • Policy Framework & Governance • Benchmarking & Comparison • The Start of the Journey • The Next Steps • Information Security Job PracticeFocused on Security. Committed to Success
  • 3. ISO/IEC 27002 Code of Practice Sections of ISO/IEC 27002 Code of Practice 0 Introduction 1 Scope 2 Terms and Definitions 3 Structure of this Standard 4 Risk Assessment and Treatment 5 Security Policy 6 Organization of Information Security 7 Asset Management 8 Human Resource Security 9 Physical and Environmental Security 10 Communications and Operations Management 11 Access Control 12 Information Systems Acquisition, Development and Maintenance 13 Information Security Incident Management 14 Business Continuity Management 15 ComplianceFocused on Security. Committed to Success
  • 4. ISO 27002 Scope of Assessment Sections of ISO/IEC 27002 Code of Practice 0 Introduction 1 Scope 2 Terms and Definitions 3 Structure of this Standard 4 Risk Assessment and Treatment 5 Security Policy 6 Organization of Information Security 7 Asset Management 8 Human Resource Security 9 Physical and Environmental Security 10 Communications and Operations Management 11 Access Control 12 Information Systems Acquisition, Development and Maintenance 13 Information Security Incident Management 14 Business Continuity Management 15 ComplianceFocused on Security. Committed to Success
  • 5. Maturity Model (ref: COBIT 4.1)Focused on Security. Committed to Success
  • 6. Maturity Model (ref: COBIT 4.1 Appendix)Maturity Level ISO Maturity Level Status of the Internal Control Environment0 - Non-existent There is no recognition of the need for internal control. Control is not part of the organization’s culture or mission. There is a high risk of control deficiencies and 0-1 - Practice not yet in existence. incidents.1 - Initial/ad hoc There is some recognition of the need for internal control. The approach to risk and control requirements is ad hoc and disorganized, without communication or 1-2 - Practice does not fully achieve monitoring. Deficiencies are not identified. Employees are not aware of their ISO objectives; however, responsibilities. efforts are underway.2 - Repeatable but Controls are in place but are not documented. Their operation is dependent on Intuitive knowledge and motivation of individuals. Effectiveness is not adequately evaluated. Many control weaknesses exist and are not adequately addressed; the impact can 2-3 - Practice achieves ISO be severe. Management actions to resolve control issues are not prioritized or objectives; however, the consistent. Employees may not be aware of their responsibilities. program isn’t documented or3 - Defined universally effective or Controls are in place and are adequately documented. Operating effectiveness is understood. evaluated on a periodic basis and there is an average number of issues. However, the evaluation process is not documented. Whilst management is able to able to 3-4 - Practice achieves and deal predictably with most control issues, some control weaknesses persist and documents ISO objectives; impacts could still be severe. Employees are aware of their responsibilities for however, the program isn’t control.4 - Managed & universally effective or There is an effective internal control and risk management environment. A formal, Measureable understood. documented evaluation of controls occurs frequently. Many controls are automated and regularly reviewed. Management is likely to detect most control issues, but not 4-5 - Practice achieves ISO all issues are routinely identified. There is consistent follow-up to address identified objectives, is documented control weaknesses. A limited, tactical us of technology is applied to automate and is universally effective controls.5 - Optimized and understood. An enterprise wide risk and control program provides continuous and effective control and risk issues resolution. Internal control and risk management are integrated with enterprise practices, supported with automated real-time monitoring with full accountability for control monitoring, risk management and compliance enforcement. Control evaluation is continuous, based on self-assessments and gap Focused on Security. Committed to Success and root cause analyses. Employees are proactively involved in control improvements.
  • 7. Policy Framework & Governance Information Security Management Policy & Framework Information Security Corporate Policy Table of Contents A. Organization of Information Security B. Asset Management C. Human Resources D. Physical & Environmental Security E. Communications & Operations Management F. Access Control G. Information System Acquisition, Development & Maintenance H. Information Security Incident Management I. Business Continuity Management J. Compliance For Board ApprovalFocused on Security. Committed to Success
  • 8. Policy Framework & Governance Corporate Policies - delegation of authority Information from the Board of Directors to Management at Security Corporate the executive level. The high level statement of Policy management’s intent, expectations and direction. Corporate Policies provide the Framework Corporate Polices and Governance of Information Security Board ApprovalDirectives - support the Corporate Policies byproviding a more focused, detail of information. Operational LevelStandards - are the metrics forming a technical “polices” or standardsrequirement that must be met in order to meet theterms of the Corporate Policy Sr. Exec Committee or other approvalGuidelines - contain information that will be helpful inexecuting the procedures.Procedures – step by step instructions. Operational Level procedures or guidelines Focused on Security. Committed to Success
  • 9. Policy Framework & Governance Information Security Corporate Policy Table of Contents A. Organization of Information Security B. Asset Management C. Human Resources Security D. Physical & Environmental Security E. Communications & Operations Management F. Access Control G. Information Systems Acquisition, Development & Maintenance H. Information Security Incident Management I. Business Continuity Management J. ComplianceFocused on Security. Committed to Success
  • 10. Ratings for Benchmarking & Comparison ISO Maturity Model Ratings  Policy  People  Process   Technology Focused on Security. Committed to Success
  • 11. Ratings for Benchmarking & Comparison A. Organization of Information Security B. Asset Management C. Human Resources Security D. Physical & Environmental Security E. Communications & Operations Management F. Access Control G. Information Systems Acquisition, Development & Maintenance H. Information Security Incident Management I. Business Continuity Management J. ComplianceFocused on Security. Committed to Success
  • 12. Ratings for Benchmarking & Comparison A. Organization of Information Security – x.x B. Asset Management – x.x C. Human Resources Security - x.x D. Physical & Environmental Security – x.x nl ple E. Communications & Operations Management – x.x am y F. Access Control – x.x Ex G. Information Systems Acquisition, Development & Maintenance – x.x O H. Information Security Incident Management – x.x I. Business Continuity Management – x.x J. Compliance – x.xFocused on Security. Committed to Success
  • 13. Return on Security Posture Investment (ROSPI) Methodology Internet Security Alliance July 2002/Data from Dr. William M. HancockFocused on Security. Committed to Success
  • 14. Focused on Security. Committed to Success.The Start of the Journey• Addressing Other Audits & Assessments• Assessment of Scope – Risk Registrar• Risk Assessment & Treatment• Tracking & Reporting
  • 15. Addressing Other Audits & AssessmentsFocused on Security. Committed to Success
  • 16. Addressing Other Audits & AssessmentsFocused on Security. Committed to Success
  • 17. Assessment of Scope – Risk RegistrarFocused on Security. Committed to Success
  • 18. Assessment of Scope – Risk Registrar Risk Assessment & Treatment 4.1 Assessing Security Risks Risk assessments should identify, quantify, and prioritize risks against criteria for risk acceptance and objectives relevant to the organization. 4.2 Treating Security Risks Before considering the treatment of a risk, the organization should decide criteria for determining whether or not risks can be accepted. Risks may be accepted if, for example, it is assessed that the risk is low or that the cost of treatment is not cost-effective for the organization. Such decisions should be recorded.Focused on Security. Committed to Success
  • 19. Risk Assessment & Treatment  Residual Risk Rating = Consequence x Likelihood  Low < 5  Med >=5 to <10  High >=10CONSEQUENCEThe impact on the objectives if the risk occurs.Level Descriptor Monetary Impact Operational Efficiency Impact Reputation Impact Employee Impact (incl. Regulatory & Member)5 Catastrophic Would have significant financial Would have significant and prolonged Key Stakeholders Would result in the consequences: compromising impact on operations. Processes are (Members/Vendors) loose unexpected loss of multiple quality of balance sheet and ability irreconcilable resulting in undeliverable confidence in Coast’s ability to (key) staff including to address capital adequacy customer service. deliver with low likelihood of executive. requirements. regaining trust.4 Major The consequences would threaten continued effective provision of services and require top-level management intervention.3 Moderate Would have some financial Would have some impact on Some stakeholders would lose Would result in the consequences: threatening operations. Processes would be trust in Coast and likely have unexpected loss of some budgeted net income, medium term suspended resulting in delayed delivery of some media attention. (key) staff and have an earnings and planned capital customer service. impact on morale. expenditures.2 Minor The consequences would impact the efficiency or effectiveness of some services, but could be dealt with internally.1 Insignificant Would not have material financial Would have little impact on Few stakeholders, if any, would be Would have negligible consequence: impacts/losses could operations. Processes would be slightly aware of the incident. impact on staff. be absorbed in departmental delayed although no delay in delivery of budgets. customer service LIKELIHOOD The probability that a risk event will occur, given current controls in place. Level Descriptor Description 5 Almost Certain For a pre-defined period of time (e.g. 24 months), the risk event is expected to occur >80% of the time. 4 Likely For a pre-defined period of time (e.g. 24 months), the risk event is expected to occur >60% of the time 3 Possible For a pre-defined period of time (e.g. 24 months), the risk event is expected to occur >30% and <60% of the time 2 Unlikely For a pre-defined period of time (e.g. 24 months), the risk event is expected to occur <30% of the time 1 Rare For a pre-defined period of time (e.g. 24 months), the risk event is expected to occur <10% of the time Focused on Security. Committed to Success
  • 20. Tracking & ReportingFocused on Security. Committed to Success
  • 21. Tracking & ReportingFocused on Security. Committed to Success
  • 22. Tracking & ReportingA. Organization of Information Security – x.xB. Asset Management – x.xC. Human Resources Security - x.xD. Physical & Environmental Security – x.x nl le O mpE. Communications & Operations Management – x.x yF. Access Control – x.x a ExG. Information Systems Acquisition, Development & Maintenance – x.xH. Information Security Incident Management – x.xI. Business Continuity Management – x.xJ. Compliance – x.x Focused on Security. Committed to Success
  • 23. The Next Steps…Focused on Security. Committed to Success
  • 24. ...The Next Steps “The @*%!s chess, it aint checkers!” - Alonzo Harris (Denzel Washington)Focused on Security. Committed to Success
  • 25. The Next Steps…Focused on Security. Committed to Success
  • 26. The Next Steps – Program DevelopmentFocused on Security. Committed to Success
  • 27. Information Security Job Practice Domain 1—Information Security Governance Establish and maintain a framework to provide assurance that information security strategies are aligned with business objectives and consistent with applicable laws and regulations.  Develop an information security strategy aligned with business goals and objectives.  Align information security strategy with corporate governance.  Develop business cases justifying investment in information security.  Identify current and potential legal and regulatory requirements affecting information security.  Identify drivers affecting the organization (e.g., technology, business environment, risk tolerance, geographic location) and their impact on information security.  Obtain senior management commitment to information security.  Define roles and responsibilities for information security throughout the organization.  Establish internal and external reporting and communication channels that support information security.Focused on Security. Committed to Success
  • 28. Information Security Job Practice Domain 2—Information Risk Management Identify and manage information security risks to achieve business objectives.  Establish a process for information asset classification and ownership.  Implement a systematic and structured information risk assessment process.  Ensure that business impact assessments are conducted periodically.  Ensure that threat and vulnerability evaluations are performed on an ongoing basis.  Identify and periodically evaluate information security controls and countermeasures to mitigate risk to acceptable levels.  Integrate risk, threat and vulnerability identification and management into life cycle processes (e.g., development, procurement and employment life cycles).  Report significant changes in information risk to appropriate levels of management for acceptance on both a periodic and event-driven basis.Focused on Security. Committed to Success
  • 29. Information Security Job Practice Domain 3—Information Security Program Development Create and maintain a program to implement the information security strategy.  Develop and maintain plans to implement the information security strategy.  Specify the activities to be performed within the information security program.  Ensure alignment between the information security program and other assurance functions (e.g., physical, HR, quality, IT).  Identify internal and external resources (e.g., finances, people, equipment, systems) required to execute the information security program).  Ensure the development of information security architectures (e.g., people, processes, technology).  Establish, communicate and maintain information security policies that support the security strategy.  Design and develop a program for information security awareness, training and education.  Ensure the development, communication and maintenance of standards, procedures and other documentation (e.g., guidelines, baselines, codes of conduct) that support information security policies.  Integrate information security requirements into the organizations processes (e.g., change control, mergers and acquisitions) and life cycle activities (e.g., development, employment, procurement).  Develop a process to integrate information security controls into contracts (e.g., with joint ventures, outsourced providers, business partners, customers, third parties).  Establish metrics to evaluate the effectiveness of the information security program.Focused on Security. Committed to Success
  • 30. Information Security Job Practice Domain 4—Information Security Program Management Oversee and direct information security activities to execute the information security program.  Manage internal and external resources (e.g., finances, people, equipment, systems) required to execute the information security program.  Ensure that processes and procedures are performed in compliance with the organization’s information security policies and standards.  Ensure that the information security controls agreed to in contracts (e.g., with joint ventures, outsourced providers, business partners, customers, third parties) are performed.  Ensure that information security is an integral part of the systems development process.  Ensure that information security is maintained throughout the organizations processes (e.g., change control, mergers and acquisitions) and life cycle activities (e.g., development, employment, procurement).  Provide information security advice and guidance (e.g., risk analysis, control selection) to the organization.  Provide information security awareness, training and education to stakeholders (e.g., business process owners, users, information technology).  Monitor, measure, test and report on the effectiveness and efficiency of information security controls and compliance with information security policies.  Ensure that noncompliance issues and other variances are resolved in a timely manner.Focused on Security. Committed to Success
  • 31. Information Security Job Practice Domain 5—Incident Management & Response Plan, develop and manage a capability to detect, respond to and recover from information security incidents.  Develop and implement processes for detecting, identifying, analyzing and responding to information security incidents.  Establish escalation and communication processes and lines of authority.  Develop plans to respond to and document information security incidents.  Establish the capability to investigate information security incidents (e.g., forensics, evidence collection and preservation, log analysis, interviewing).  Develop a process to communicate with internal parties and external organizations (e.g., media, law enforcement, customers).  Integrate information security incident response plans with the organization’s Disaster Recovery (DR) and Business Continuity Plan (BCP).  Organize, train and equip teams to respond to information security incidents.  Periodically test and refine information security incident response plans.  Manage the response to information security incidents.  Conduct reviews to identify causes of information security incidents, develop corrective actions and reassess risk.Focused on Security. Committed to Success
  • 32. CISM: Information Security Job Practice • The CISM certification program is developed specifically for experienced information security managers and those who have information security management responsibilities. • The management-focused CISM is a unique certification for individuals who design, build and manage enterprise information security programs. The CISM certification promotes international practices and individuals earning the CISM become part of an elite peer network, attaining a one-of-a-kind credential.Focused on Security. Committed to Success
  • 33. Thank You!Michael LeungCRISC, CGEIT, CISM, CISA, CISSP-ISSMPISACA Vancouver Chapterwww.isaca-vancouver.orgFocused on Security. Committed to Success

×