The document outlines a session focused on ISO 17799 and its implications for information security and records management. Key topics include the importance of establishing security policies, managing risks, handling security breaches, and aligning records management with information security objectives. It also emphasizes compliance with various regulations and standards to protect personal and sensitive information.

1. Confluence with Information Security – ISO 17799 Ellie Myler, CRM, CBCP Senior Records Management Analyst Entium Technology Partners, LLC 303-684-0496, emyler@entium.com George Broadbent, Director, Enterprise Solutions Entium Technology Partners, LLC 610-415-7216, gbroadbent@entium.com Session #M014

2. Learning Objectives Upon completion of this session, participants will be able to: Outline ISO 17799 components, applications, and implications Review Security Breach notification requirements and e-commerce reporting issues Link information security objectives with records management (RM) components

3. How Secure Is Your Data? Zero day attacks SQL injections Bots and botnets Insider infractions Click fraud Denial of service Identity theft Lost laptops and handhelds

4. Costs Are Rising Ted Humphreys Convener of ISO 18043:2006 International Standards Organization June 30 2006 “ It is estimated that intentional attacks on information systems are costing businesses worldwide around 15 billion each year and the cost is rising.”

5. Information Security Defined Continuous interconnected environment Emerging weaknesses and vulnerabilities Attacks, incidents, and threats Multiple and diverse formats Policies, processes, procedures

6. Objective 1 – Outline ISO 17799 Components Applications Implications

7. ISO 17799 Framework 11 Security control clauses 39 Main security categories Control objective One or more controls to achieve objective

8. ISO 17799 Framework Control descriptions Control definitions Implementation guidance Other information

9. Benefits Of Using A Framework Provides consistent asset management Establishes policies & operational procedures Furnishes program documentation Prepares for business continuity Defines roles and responsibilities Demonstrates compliance

10. ISO 17799 Steps and Tasks

11. Cross-Reference For Compliance

12. Conduct Risk Assessments Types and likelihood of risks Internal External ISO 13335-3 - Risk assessment methodologies Acceptance and non-acceptance levels Risk treatment and controls Business and regulatory considerations

13. Establish A Security Policy Sets a precedent for the program Demonstrates management intent Outlines control objectives and controls

14. Establish A Security Policy Provides brief program explanations Defines responsibilities Refers to related documentation

15. Compile An Asset Inventory Assets Types (tangible and intangibles) Locations Owners Asset use rules e-mail Internet devices

16. Compile An Asset Inventory Classification of asset value Labeling and handling procedures Metadata and properties

17. Define Accountability Security roles and responsibilities Employees Contractors Third parties Pre-employment processes Condition of employment & job descriptions

18. Define Accountability Clearly communicating expectations Terminations and exit interviews Asset return Asset rights removals

19. Address Physical Security Building and office premises Perimeters, barriers, entries, access, alarms Intruder detection systems (ISO 18043)

20. Address Physical Security Environmental considerations Natural Human Political Equipment Utilities, Power, Telecommunications Contingency Plans Maintenance, Disposition

21. Document Operating Procedures Procedures System activities and processes Change management controls, duty assignments Rules for development, test, operational facilities Third-party agreements Monitoring, review, audits

22. Document Operating Procedures System use and capacity Desktops ERP (enterprise resource planning) Patch management Malicious and mobile code

23. Document Operating Procedures Back-up and restoration Remote equipment, connections Public and wireless networks Authentication and encryption controls Firewalls

24. Document Operating Procedures Back-up and restoration Intrusion detection systems Media handling and transit processes Information classification, distribution Retention, disposition Information relay etiquette

25. Document Operating Procedures eCommerce Messaging systems Cryptographics On-line transactions Electronic signatures Authentication and authorization Electronic publishing systems EDI (electronic data interchange)

26. Document Operating Procedures Monitoring controls Audit logs, contents, retention

27. Determine Access Control Rules and rights Registration Privileges Passwords Clear desk and clear screen policy

28. Determine Access Control Management of Unattended equipment Virtual private network (VPN) solutions, routing, connections Wireless networks, virtual spaces Cryptographic keys/procedures Software development, source code

29. Determine Access Control Test and production environments Change control procedures Patches Updates and Service packs

30. Coordinate Business Continuity Incidents, breaches, weaknesses Timely reporting, forms, and feedback Formal procedures, contacts, user awareness ISO 18044 – incident management techniques

31. Coordinate Business Continuity Business continuity plans Define risks and possible occurrences Conduct business impact analyses Prioritize critical business functions Develop countermeasures Compile plans, identify owners Set up regular testing to evaluate effectiveness

32. Demonstrate Compliance Laws, regulations, and requirements IPR (Intellectual Property Rights) Records management

33. Demonstrate Compliance Laws, regulations, and requirements

34. Demonstrate Compliance IPR (Intellectual Property Rights) Rules and use, licenses Asset registers, copyrights Insider theft – the “Coke” incident (7-6-06)

35. Demonstrate Compliance Records management Inventory, classification, media stability Retention schedule and authorities ISO 15489– records management Transborder flow for import/export Protective controls

36. Objective 2 – Review eCommerce California S.B. 1386 precedent Reporting security & information breaches Federal mandates and other states Links to ISO 17799 clauses

37. Consequences of Stolen Data CSI/FBI Computer Crime and Security Survey 2005 “ 639 of 700 companies and governmental agencies surveyed lost $31 million worth of proprietary data and spent $43 million to clean up computer viruses.”

38. Definitions Personal information Individual’s name in combination with; Social security number Driver’s license number Account number

39. Definitions Breach of the security of the system Unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information.

40. California’s Original Precedent Disclose breaches of the security of data Sources of personal information Credit card transactions, magazine subscriptions Social security and telephone numbers Real estate records, automobile registrations Consumer surveys Warranty registrations, credit reports

41. California’s Original Precedent Notice methods Written, electronic, substitute methods (e-mail, web site posting, media) Civil actions to recover damage

42. Federal Mandates Identity theft protection act (s.1408) Security breach report and publication Consumer notification and methods Not later than 45 days after breach Security freeze $11 Million in fines for failing to meet requirements

43. Federal Mandates Data accountability & trust act (h.r. 4127) Security policy for personal information Mitigation processes for vulnerabilities

44. Other States Security freeze laws (15 states) Consumer can freeze credit any time (CA, CT, LA, ME, NJ, NC, NV, UT) To go into effect (CO, WI) Once consumers become identity theft victims (IL, TX, VT, WA) Similar freeze safeguard (SD)

45. Links to ISO 17799 Clauses Clause 10.9 - sensitive customer data eCommerce countermeasures Cryptographic controls Clause 13.1 - reporting Incident report methodology Appropriate response and behavior Disciplinary processes

46. Objective 3 – RM Components Vital records programs Intellectual property protection Retention and disposition issues Compliance and documentation

47. Vital Records (VR) Programs VR identification and locations Master list, media capture, associated systems Back-up and document restoration procedures Imaging and/or microfilm processes Off-site and third-party agreements

48. Vital Records (VR) Programs Overall information security program Update VR program and processes Clear desk and clear screen initiative Trans-border flow/encryption

49. Intellectual Property Protection Intellectual Property (IP) Registers Licenses Copyrights, trademarks, and patents

50. Intellectual Property Protection Version control issues Corporate seals Controlled distribution and access Limited publication and sharing

51. Information Lifecycle Information Flows through an Organization yet Information Security is Omnipresent

52. Retention and Disposition Issues Inventories of the content of all information Standard classifications and taxonomies Retention schedules and authorities Defined retention periods Disposition issues for all media

53. Compliance and Documentation Source registries and due diligence Audit log for evidence requirements Information security program documentation Inception and establishment Implementation Evaluation Change control procedures Compliance program/audit controls

54. The Old Adage Still Stands Any organizational initiative always needs: Senior management support Funding Resources

55. Staying Ahead Of The Curve Keeping up with newest developments, threats and possibilities can be overwhelming! However, without this knowledge you can’t beat the bad guys....... Avoid working alone in a vacuum Tap everyone’s talents and ensure a cohesive program

56. Confluence with Information Security - 17799 Session #M014 Ellie Myler, CRM, CBCP Senior Records Management Analyst Entium Technology Partners, LLC 303-684-0496, emyler@entium.com George Broadbent, Director, Enterprise Solutions Entium Technology Partners, LLC 610-415-7216, gbroadbent@entium.com Please Complete Your Session Evaluation