STRATEGIES FOR DEVELOPING & IMPLEMENTING INFORMATION SECURITY POLICIES BASED ON ISO 27001: 2013

Consultancy Support Services (CS2) Limited., info@consultancyss.com
by
Abdul-Hakeem Ajijola
info@consultancyss.com
@ the International Conference Centre, Abuja, Nigeria.
05 November 2015
presented @ the
Theme:
Hosted by the:

DEFINITIONS
ISO27001
An International Standard
Information Security
Management System (ISMS)
Adopted by organizations
regardless of type or size
Published by International
Standard Organization (ISO)
http://www.iso.org/iso/home/standa
rds/management-
standards/iso27001.htm
Build from British Standard
BS7799-2
Electoral Process
A formal decision-making process
A population chooses an individual to hold public office
Must meet standards to be credible:
• Article 25 of the UN International Covenant for Civil and
Political Rights (ICCPR of 1966)
• Article 21(3) in the Universal Declaration of Human Rights
(1948)
• 1990 Copenhagen Document of the Conference on Security and
Cooperation in Europe (CSCE)
• 2002 Venice Commission’s Code of Good Practice in Electoral
Matters
• OSCE Election Observation Handbook.
• UN General Assembly resolution 63/163 (April 12, 2012)
Conventions, treaties, protocols, and guidelines:
• UN General Assembly,
• Organization for Security & Cooperation in Europe (OSCE),
• Organization of American States (OAS),
• African Union (AU),
• United Nations member states
Electoral Integrity Project
https://sites.google.com/site/electoralintegrityproject4/home
ElectionGuide is provided by the International Foundation for
Electoral Systems (IFES) http://www.electionguide.org/

PROCESS FLOW

SYSTEMS: DEMOCRATIC OR ELECTRONIC

ELECTRONIC & ELECTORAL PROCESS
Transparency Integrity
Accountability Confidentiality
TRUST

TRANSPARENCY
Open Access
to how the
system works
Visibility of
the key
process
Compliance
Certification

INTEGRITY
Preventing
unauthorized
modification of user’s
information
Strong mechanism to
prevent unauthorized
changes to data (Votes
Cast)
Including an insider

•Prevent
eavesdropping
by third parties
on
communications
•User Choices
(Casted ballots)
collected
anonymously
CONFIDENTIALITY

ACCOUNTABILITY
Providing
reliable
verified
records
effective for
process
auditing

WHY ISO 27001:2013

STRATEGIC APPROACH TO ISO27001:2013
Define the Implementation Scope
Draft ISMS Policy
Determine ISO 27001 Maturity Level
Design Risk Management Strategy
Perform Gap Analysis

Source: http://www.vanguardngr.com/2015/03/inec-website-hacked/
LEARNING FROM THE PAST: MARCH 28, 2015

ELECTORAL PROCESS
1. Legal
Framework
2. Planning &
Implementati
on
3. Training &
Education
4. Voter
Registration
5. Election
Campaign
6. Voting
Operations &
Election Day
7. Verification
of Results
8. Post-Election

LEGAL FRAMEWORK
Constitution
Legislation
• Develop & Review
Information
Security Policies
• ISO/IEC 27001
Certification
Standard, Section
5.1.1 & 5.1.2
Electoral
System &
Bodies
• Establish
Procedures &
Responsibilities
• Section 12.1
Codes of
Conduct
• Personnel Security
Management
• Logs to Records
Security Events
• Sections 7 & 12.4

ENHANCING LEGAL FRAMEWORKS
Enhance
electoral
process
roadmap
with key
performance
indicators for
all INEC
staff:
Address process issues to facilitate incremental
improvements;
Develop storyboards to
track progress:
Permanent Voters Card
tracking mechanisms
Improve
documentation of
procedures and
electronic
accountability process
Track who did/ took/
got what and when?
Articulate a
revised
technology
project
management
plan
Effective project
accountability

PLANNING & IMPLEMENTATION
• Comply with legal
security requirements
• Section 18.1
Budgeting,
Funding &
Financing
• Personnel Security
Management
• Supplier Relationship
Management
• Section 7 & 15
Recruitment
&
Procurement
• Physical & Operational
Security Management
• Section 11 & 15
Logistics and
Security

IMPLEMENTATION ISSUES
Seek ways to add value to existing systems
• Understand the finger print reader challenges & how to
overcome these issues
Decide on if to develop a new voter register database, or not:
• There have already been at least 3 voter database efforts;
• The Current administrations lack of appetite for expenditure
unless proven to be essential
• INEC must explore possible alternative/ complimentary
funding sources & lower cost alternatives
Existing voter registration databases INEC will need to decide:
• Merge the existing databases;
• Use one or more database; or
• Start afresh

TRAINING & EDUCATION
Operational
Training for
Election Officials
• Deliver
information
security
awareness
programs
• Section 7.2.2
Civic & Voter
Education
• Deliver
information
security
awareness
programs
• Section 7.2.2

CAPACITY BUILDING
Facilitate multi-stakeholder Electoral ecosystem
eLearning and e-Library platforms for continuous
capacity building of permanent and adhoc staff
e-courses & Apps on Electoral Process for Public
Awareness
Online crowdsourcing allows reporting of voting
irregularities
Information can even be plotted onto an interactive
map online with dashboards

VOTER REGISTRATION
Voter
Registration
• Information Access
Management
• Cryptography Policy
Management
• Physical Security
Management
• Operational Security
Management
• Protect information
transfers
• Section 9, 10, 11,
12, & 13.2
Observers
Accreditation
• Establish
Procedures &
Responsibilities
• Section 12.1

VOTER REGISTRATION MATTERS ARISING
• Fibre Optic between Headquarters,
Regional Data Centres & State Offices
• Wireless Connectivity between local
Accreditation and Collation Equipment
Ensure INEC has
requisite connectivity
for online access and
backup
• Chairman Gubadia registration database
with basic text
• Chairman Iwu database added voter
pictures
• Chairman Jega database added fingerprint
biometrics
The 3 voter registration
database efforts include:
• Merging structurally different databases is
inherently problematic
• Database clean-up process is challenging
Disparate Voter
databases

ELECTION CAMPAIGN
•Manage all user
access rights
Media
Access
•Personnel
Security
Management
Code of
Conduct

VERIFICATION OF VOTERS DURING ELECTIONS
Explore alternate ways to mitigate the challenges of voter
accreditation/ authentication so as to compare biometric
databases as part of the INEC data clean-up process
• National Identity Management Commission
• Immigration
• Population Commission
• Central Bank of Nigeria (Bank Verification Number)
• Federal Road Safety Corps (Drivers Licence)
• Nigeria Communications Commission (SIM Card Registration)
Fully activate INEC regional Data and Card reader production &
Data Backup centres
• Umahia
• Dutse
• Abeokuta

VOTING OPERATIONS & ELECTION DAY
Special
&
External
Voting
Voting
Voting
Count
• Protect user
authentication
• Control access to
systems
• Cryptography Policy
Management
• Physical Security
Management
• Establish procedures and
responsibilities
• Control your operational
software
• Address your technical
vulnerabilities
• Network Security
Management
• Security Incident &
Continuity Management
• Comply with security
requirements
• Section 9.3, 9.4, 10, 11,
12.1, 12.5, 12.6, 13, 16,
17, & 18.1

“Card
Reader”
“Read
Card”
“Capture
finger-prints”
Verify/
Authorise
“Upload same
to server?”
CARD READING PROCESS
Many INEC applications are not online including voter
registration
Adhoc staff & none-core databases could be managed using
cloud apps with regular backups to the various INEC data
centres as a cost cutting option
Cloud processing options while cost effective have risks
with limitations and can only be used for selective activities

VERIFICATION OF RESULTS
Tabulation
of results
• Comply with legal
requirements
• Section 18.1
Official
result
• Information Access,
Cryptography Policy,
Physical Security, &
Operational Security
Management
• Protect information
transfers
• Security Compliance
Management
• Section 9, 10, 11, 12,
13.2, & 18

crypto-
currency?
ElectronicCardsCashGoldCowries
 Any method of verifying that someone is who they
claim to be
AUTHENTICATION

POST-ELECTION
• Use logs to record
events
• Identify & respond
to incidents
• Section 12.4 & 16.1
Audits &
Evaluations
• Security Policy
Management
• Section 5
Legal
Reform
• Information Access
Management
• Section 9
Archiving &
research

ISO27001:2013 MATTERS ARISING
Compliance Increases Probability but Does NOT Guarantee
Absolute Security
Signifies Managing Security in-line with
Standards
Weaknesses Not following established processes
Organizational Commitment
Lack of Expertise
Requirements Management’s commitment
Individual ownership & responsibility for
Information Security
Effective Information Security education &
awareness

Types of
e-Voting
systems
• Punch-card: Holes punched into the Ballot Card next to the voters
choice
• Optical scan: Optical scanner reads and counts marked ballot papers
• Direct-recording electronic (DRE): Voter pushes a button or touch
screen next to their choice. DRE machine tabulates voting data stored
in a removable memory component/ printed copy/ transmits
• Internet: Use of Internet to cast/ transmit vote. Remote Internet is
uncontrolled; using Polling Site Voting, Kiosk Voting controlled
Considerations
when selecting
• Auditing
• Building Trust
• Design and Usability Aspects
• International Standards & Handbooks on E-Voting
• National Legislative Framework
• Open Source vs. Proprietary Software
• Secrecy of the Vote
• Verifiability
• Voter Authentication
Current
Realities:
• Voter-verified paper audit trail (VVPAT): Voting systems must have an
auditable paper trail
• Mechanisms must be in place for detecting changes to votes
• Voting systems must not be subject to wide-scale service disruptions
• Infrastructure & Human Capacity Limitations in Nigeria
NEW VOTING TECHNOLOGY/ E-VOTING

EVOTING & INTERNET VOTING?
Section 52 of the Electoral Act, 2010
• “The use of electronic voting machine
for the time being is prohibited.”
•Source: Electoral Act 2010, Section 52 Para 2
Estonia
• World's First National
Internet Election
• Internet voting 7 times
Internet voting is vulnerable
• Cyber-Attack & Fraud
• Inherent Weakness in Hardware & Software
• Manner in which the Internet is Organized
Research found it possible to:
• Change votes,
• Compromise a secret ballot,
• Disrupt voting, or
• Cast doubt on the legitimacy of the
election process
Unlikely that these Vulnerabilities
will be Eliminated in the near Future
Source:
http://www.heritage.org/research/reports/2015/07/the-
dangers-of-internet-voting

INTERNET VOTING FAILURES
California USA - California Internet
Voting Task Force report:
•“additional technical innovations
are necessary before remote
Internet voting can be widely
implemented….”
USA National Science Foundation -
2001 report
•“remote Internet voting systems
pose significant risk to the
integrity of the voting process,
and should not be fielded for use
in public elections until
substantial technical and social
science issues are addressed.”
USA Pentagon Internet Voting
Project report:
•“these vulnerabilities are
fundamental in the architecture of
the Internet and of the PC
hardware and software that is
ubiquitous today.”
Washington, D.C. USA 2010,
•A computer science professor and
his students broke into the
system, changed the results of
the mock election, and “gained
near-complete control” of the
election server
France. 2013,
•Reporters from “the news site
Metronews proved that it was
easy to breach the allegedly strict
security of the election and vote
several times using different
names.”
Norway Municipal elections in 2011
and 2013 but cancelled the project
in 2014,
•citing security concerns and the
government’s conclusion that,
contrary to expectations, the new
system had not improved turnout.
Canada. In 2014,
•“…voting over the Internet has a
set of unique challenges that
inevitably introduce a number of
additional risks.”
Australia 2015
•“…. uncovered severe
vulnerabilities that could be
leveraged to manipulate votes,
violate ballot privacy, and subvert
the verification mechanism.”
Spain, held a referendum in
Barcelona in 2010 using the
Internet.
•“encountered problems in relation
to voter identification and identity
theft…”
Without major technological changes, there is almost no possibility that a secure Internet voting system can be
designed for the foreseeable future. When combined with other less technical questions like equal access by voters
to the Internet, Internet voting is definitely a technology whose time has not come—and may never come.
Source: Hans A. von Spakovsky http://www.heritage.org/research/reports/2015/07/the-dangers-of-internet-voting

Adopt
ISO
27001:
2013
Patronize
Indigenous
Solution
Providers
Sanitize Data
(Biometric)
Clear
Procedures
Implement
IPV6
Robust
Connectivity
Caution on
eVoting
Research
Estonia, Australia,
USA, France,
Norway, Canada
CONCLUSION

for
your
attention
O ṣeun,
fun
akiyesi rẹ
Na gode,
don
kulawa
Imela na
igere anyi
nti
info@consultancyss.com

STRATEGIES FOR DEVELOPING & IMPLEMENTING INFORMATION SECURITY POLICIES BASED ON ISO 27001: 2013

Recommended

Recommended

More Related Content

What's hot

What's hot (16)

Similar to STRATEGIES FOR DEVELOPING & IMPLEMENTING INFORMATION SECURITY POLICIES BASED ON ISO 27001: 2013

Similar to STRATEGIES FOR DEVELOPING & IMPLEMENTING INFORMATION SECURITY POLICIES BASED ON ISO 27001: 2013 (20)

Recently uploaded

Recently uploaded (20)

STRATEGIES FOR DEVELOPING & IMPLEMENTING INFORMATION SECURITY POLICIES BASED ON ISO 27001: 2013

Editor's Notes