Implementing ISO 27001 In A Cost Effective Way

Helping You Piece IT Together

Implementing ISO 27001 in a
Cost Effective Way

http://www.bhconsulting.ie info@bhconsulting.ie

1st Question I’m Asked

22nd November 2011 Copyright © BH IT Consulting Ltd www.bhconsulting.ie 2

The Challenge

Certification to ISO 27001

But Do So
Cost Effectively
Using Existing Resources


The Challenge


Get it Wrong ….


Remember

Risk Assessment & Risk Management is Key

MS Security Assessment
Tool

http://technet.microsoft.com/en-us/security/cc185712


MS Security Risk
Management Guide


Others Available

http://www.enisa.europa.eu/act/rm


ISMS Documentation


Appropriate Controls


Windows Features

Encrypting File System
Windows Firewall
Windows Backup & Restore Centre
Windows Users Access Control
User Rights & Privileges
Event Logs


Windows Server 2008

Read-only domain controller
BitLocker drive encryption
Server Core
Network Access Protection
Routing and Remote Access Service
Windows Firewall with advanced security
Active Directory Certificate Services
Active Directory Rights Management Services
Group policies


Other Free Tools

Microsoft Windows Server Update Server
Microsoft Baseline Security Analyzer
Microsoft Security Risk Management Guide
Microsoft Security Assessment Tool
Microsoft CAT.NET
Microsoft Source Code Analyzer for SQL
Injection
XSS Detect Beta Code Analysis Tool
Microsoft Windows SysIntermals


Other Resources

Windows Server 2008 Security Guide
Windows Server 2003 Security Guide
Microsoft Threats and Countermeasures Guide
Microsoft Security Guidance
Data Encryption Toolkit for Mobile PCs
Security Monitoring and Attack Detection
Planning Guide
The Microsoft Security Response Centre Blog


Open Source Tools

Truecrypt
Nessus
Nmap
ASSP (short for "Anti-Spam SMTP Proxy")
AppArmor Application Firewall
Eraser & Wipe (Secure deletion)
Untangle & NetCop (web filtering & monitoring)
Open Source Tripwire (change detection)
Wireshark


Open Source Tools
Nagios – Network Management
OpenNMS – Event Management
OTRS – Help Desk Management
RTIR – Incident Response Management
MetaSploit
Burp Suite
OSSIM: the Open Source Security Information
Manager
BackTrack – Suite of Security Tools


A.10.5 - Backup
ISO clause/control Ref Explanation Controls

You could configure
the back-up features
Regular back-ups of
within Microsoft®
essential information
Windows and
Information back-up A.10.5.1 assets and software
Windows Server®
shall be taken and
2008 to regularly back
tested regularly.
up critical system and
data files.


A.11.3 User responsibilities

All users will be required to follow good
Use Group Policies to enforce strong
Password use A.11.3.1 security practices when selecting and
passwords.
using passwords.

Use Group Policies to enforce a
password-protected screensaver after
a predetermined time of inactivity.

Configure the system to force users
off the system should their idle time
Unattended equipment will be given
exceed a preset time limit.
Unattended user equipment A.11.3.2 appropriate protection from
unauthorised access.
You can also configure the system to
only allow users to log on to the
network at certain times of the day.
Once those times expire, the system
can forcibly log the user out of the
system.

To reduce the risk of unauthorised
access, and loss of and damage to Configure the system to force users
Clear desk and clear screen policy A.11.3.3 information assets, the company should off the system should their idle time
have a clear desk and clear screen exceed a preset time limit.
policy.


A.10.10 Monitoring

Security-relevant events will be
Ensure that audit logging is turned on.
recorded in audit logs which will
Audit logging A.10.10.1 be retained for an agreed period
Use Microsoft® SPIDER to ensure that all relevant systems have
for use in future investigations
logging turned on.
and monitoring access.

The use of information processing
Monitoring system use A.10.10.2 facilities shall be monitored and Use Microsoft® to detect any critical events within the audit logs.
the results reviewed regularly.

Ensure that appropriate permissions are set on the folders that
store the log files to protect them.
Log information and logging
systems shall be protected from
Protection of log information A.10.10.3 Restrict access to the log files to those authorised to view them.
unauthorised access and
alteration.
Servers should be configured to shut down should the security
log become full.

Operational staff will maintain a
Administrator and operator
A.10.10.4 log of their activities which will be Use IIS server to log all operator and admin staff activity.
logs
regularly independently checked.
All faults will be reported and
Fault logging A.10.10.5 recorded and corrective action Use IIS server to host a help-desk-type facility to record all faults.
taken.

Configure one server on your network to be your internal time
To ensure accurate recording of server. Ensure that server is synchronising with a reputable
Clock synchronisation A.10.10.6 events, computer clocks shall be external network time server. Configure all other servers and
synchronised. critical network devices to source their time from your internal
network time server.


Security Awareness

http://www.enisa.europa.eu/act/ar


Instead of …


Become an ISO 27001


Questions

Brian.honan@bhconsulting.ie
www.bhconsulting.ie
www.twitter.com/brianhonan
www.bhconsulting.ie/securitywatch
Tel : +353 – 1 - 4404065

Implementing ISO 27001 In A Cost Effective Way

Recommended

Recommended

More Related Content

What's hot

What's hot (17)

Similar to Implementing ISO 27001 In A Cost Effective Way

Similar to Implementing ISO 27001 In A Cost Effective Way (20)

Recently uploaded

Recently uploaded (20)

Implementing ISO 27001 In A Cost Effective Way