ISMS Implementation Guide [White Paper]

ISMS Implementation Guide

Usage note
Note: The intent of this document is to help you recognize the activities related to establishing an ISMS. This document should not be considered as professional consulting for establishing or implementing an ISMS. Use of this guide does not guarantee a successful implementation nor an implementation that is ready for certification. If you want to implement an ISMS, consider hiring a professional consultant who specializes in ISMS implementation.

Table of contents
Overview of an ISMS ............................................................................................................................. 4
1 Purchase a copy of the ISO/IEC standards .................................................................................. 5
2 Obtain management support ......................................................................................................... 5
3 Determine the scope of the ISMS .................................................................................................. 7
4 Identify applicable legislation........................................................................................................ 8
5 Define a method of risk assessment............................................................................................. 9
6 Create an inventory of information assets to protect ............................................................... 12
7 Identify risks ................................................................................................................................. 13
8 Assess the risks........................................................................................................................... 14
9 Identify applicable objectives and controls ............................................................................... 16
10 Set up policy and procedures to control risks .......................................................................... 20
11 Allocate resources and train the staff......................................................................................... 21
12 Monitor the implementation of the ISMS.................................................................................... 22
13 Prepare for certification audit...................................................................................................... 23
14 Ask for help .................................................................................................................................. 24
Appendix A Documents and Records........................................................................................... 25

Overview of an ISMS
Information security is the protection of information to ensure:
• Confidentiality: ensuring that the information is accessible only to those authorized to access it.
• Integrity: ensuring that the information is accurate and complete and that the information is not
modified without authorization.
• Availability: ensuring that the information is accessible to authorized users when required.
Information security is achieved by applying a suitable set of controls (policies, processes, procedures,
organizational structures, and software and hardware functions).
An Information Security Management System (ISMS) is way to protect and manage information based on
a systematic business risk approach, to establish, implement, operate, monitor, review, maintain, and
improve information security. It is an organizational approach to information security.
ISO/IEC publishes two standards that focus on an organization’s ISMS:
• The code of practice standard: ISO/IEC 27002 (ISO/IEC 17799). This standard can be used as a
starting point for developing an ISMS. It provides guidance for planning and implementing a program
to protect information assets. It also provides a list of controls (safeguards) that you can consider
implementing as part of your ISMS.
• The management system standard: ISO/IEC 27001. This standard is the specification for an ISMS.
It explains how to apply ISO/IEC 27002 (ISO/IEC 17799). It provides the standard against which
certification is performed, including a list of required documents. An organization that seeks
certification of its ISMS is examined against this standard.
These standards are copyright protected text and must be purchased. (For purchasing information, refer to
section 1, “Purchase ISO standards.”)
The standards set forth the following practices:
• All activities must follow a method. The method is arbitrary but must be well defined and
documented.
• A company or organization must document its own security goals. An auditor will verify whether these
requirements are fulfilled.
• All security measures used in the ISMS shall be implemented as the result of a risk analysis in order
to eliminate or reduce risks to an acceptable level.
• The standard offers a set of security controls. It is up to the organization to choose which controls to
implement based on the specific needs of their business.
• A process must ensure the continuous verification of all elements of the security system through
audits and reviews.
• A process must ensure the continuous improvement of all elements of the information and security
management system. (The ISO/IEC 27001 standard adopts the Plan-Do-Check-Act [PDCA] model as
its basis and expects the model will be followed in an ISMS implementation.)
These practices form the framework within which you

Read This White Paper

Implementing an Information Security Management System (ISMS) — LRQA Guidance

Type : White Paper
Length : 5
Format : PDF
By : LRQA

Overview Implementing an Information Security Management System (ISMS) — LRQA Guidance

- Why is ISO/IEC 27001 good for you?
- Introduction to Implementing an ISMS
The OECD (Organization for Economic Co-operation and Development) Guidelines
- Getting started
- Planning for success
- Understanding the standard
- Where next...?
- Management processes
- Define the scope
- ISMS policy
- Risk assessment and risk management
- Risk treatment
- Certification

View This White Paper

Implementation : BS7799

Part 1 mainly dealt with the structure of the standard and its relevance to the Indian IT environment. Readers need to have a clear understanding that BS7799 has been designed by Security Experts who were the forerunners in the field of Information Security and were working in live business environment. Thus the standard is business driven and has a perfect co-relation to business units. This standard has to be interpreted for individual business units and has the flexibility to accommodate every possible IT environment.

This article would discuss the interpretation of the standard and some of the key areas in its implementation.

While interpreting the standard one has to consider and evaluate the human, procedural, environmental, technical and cultural aspects of the business unit. While implementing the standard, one has to weigh its own technical strength as far as Information Security Professionals are concerned. Without, a through technical assessment the results of the Implementation would not lead to certification. Thus a word of caution to readers would be that identification and management of risk to IT systems is a specialized activity and needs to be conducted in a controlled environment using professional assistance.

Where do you begin?

Understand the Importance of Information Security:

Every organization is unique with its own set of requirements and concerns. The company IT-Assets are exposed to various threats. More than 70% of the threat comes from Internal Sources.

Other threat agents can be Hackers, Former Employees, Contractors, Suppliers, Competitors and Customers.

Management is tight lipped about incidents and push matters under the carpet due to the fear of losing credibility among investors and customers.

In competitive environment where IT systems become Business Enhancers, one cannot afford to loose data and have a break down.

Building awareness is the starting point for a stronger Information Security Culture.

Educating top management for the need of an effective Information Security Management and the possible benefits to do the same is crucial for the success of a project.

Get Yourself Trained:

While selecting appropriate products and vendors for doing a technical risk assessment one has to understand, implement, maintain and sustain the investments made on Information security.

The Internet serves as a huge repository of material for beginners to advanced users. The best method is to work in live environments with security professionals and get hands-on experience on various products and process. Those who are fortunate enough to work on live sites can use Internet resources like mail lists and websites on security, study for certifications on security or even attend training programs conducted by Security Institutes.

Understand your Business Need:

Security is always a Business led activity. The investments made on Security should reflect the need for security measures, criticality of IT Resources and processes in the day-to-day functioning of business. To implement strong security systems one has to grasp the core need of Information Security in the Business and identify the critical business factors.

For Example: If a Financial Organisation has to heavily depend on IT resources to assimilate, calculate, interpret and present data on a hourly basis then the level of security would be higher than a company using IT resources for maintaining accounts and downloading company mail. To remain competitive the company cannot afford a down time of its Systems.

Assigning Responsibility:

The security organization structure is important to help give direction and a solid foundation to the implementation of a project. A designated Security Officer with a team of technical and procedural security professionals would make it a perfect mix for implementation. If the company chooses to use an external security company for consulting, the Security team could work hand in hand with the security company professionals. This will help companies maintain the systems and procedures drafted and implemented by the security team.

Choosing a vendor:

Various security consultants in the market have their own set of methodology and approach. Some of the parameters of selecting a vendor would be, firstly, the vendor should be an expert only on Information Security. One cannot boast of having a shop for software development, hardware sales and also Information Security. The field on Information Security is vast and complex and needs to have a focused approach. Secondly, the vendor needs to have done live assignments in India. We cannot have Polices for Indian companies based on US firms. Thirdly, the vendor needs to have a Quantitative Risk Assessment approach which takes into consideration technical and procedural checklists and lastly, the vendor should be willing to work with the team and share knowledge, which is important for the team to sustain the project even after the assignment is over.

Importance of Risk Assessment:

While designing and deploying a security strategy one has to ask two very important questions. One, What to protect and second, How much to protect? In simpler words what and how much risk is the business is exposed to?

To define risk:

Business risk is the threat that an event or action, which can adversely affect an organisation's ability to successfully, achieve its business objectives and execute its strategies.

The key success factor of IT systems is a through risk assessment and effective risk management. Risk assessment prepares the base on which one would build the ISMS (Information Security Management System)

The entire exercise starts with Asset Identification:

An important step towards achieving BS 7799 Certification is to identify and classify assets. BS779 Defines Risk Assessment as - assessment of threats to information, impacts on and vulnerabilities of information and information processing facilities and the likelihood of their occurrence.

Every department would have assets, which they would consider important, without which one cannot continue work and achieve results. There could be assets, which would have higher or lesser value. Thus the most important asset would be need more protection and the lesser ones would require lower level of protection.

All assets in the company can be classified as:

People Assets: The number of professionals who are a part of the organisation.

Information Assets: Databases, data files, system documentation, user manuals, training material, operational and support procedures, intellectual property, continuity plans.

Paper Documents: Contacts, Company documentation, business results, HR records, Purchase documents invoices.

Software Assets: Application systems, development tools, and utilities.

Physical Assets: computers, servers, routers, hubs, firewalls, communication equipment, magnetic media, other equipment, cabinets, safes

Services: Computing, telecommunications, air-conditioning, water etc

Company Image and Reputation: Adverse publicity, Failure to deliver, Website defacement, Unable to provide connectivity to web server

Asset Classification:

Once the list of assets are identified the criticality of every asset has to be classified as

Unclassified: Considered publicly accessible. There are no requirements for access control or confidentiality.

Shared: Resources that are shared within groups or with people outside the organization.

Company Only: Access to be restricted to the internal employees only.

Confidential: Access to be restricted to a specific list of people.

This gets us to answer for "What to Protect"?

Now lets Understand How to Protect?

Technical Risk Assessment:

Penetration testing: After performing the Asset Identification exercise one has to move on testing specific devices which are critical to the running of the organisation. The first step towards doing testing is to find out if any external person can have access to the company information through the Internet. This is a specialized exercise, which requires a security professional abreast with the latest exploit and vulnerabilities from published and open sources. The professional needs to run various tests that would test the Internet Point of presence (i.e. Website) and security devices which protect these sites.

He would assume the role of a possible intruder and do all that he would do if he would like to break systems and cause harm.

The result of these tests would help one get an idea of the possible vulnerabilities on various servers.

Vulnerability Assessment: After performing an external test one needs to test the strength of various servers and operating systems available internally. This works as a second level of defense. Even if an intruder breaks the entry points he should be stopped at the internal points. Internal testing also facilitates the design of the Security Architecture.

A word of caution would be to allow only qualified and experienced professionals to operate these systems. All legal documents need to be signed before one has to complete the assignment.

Procedural Risk Assessment:

After conducting the technical risk assessment one needs to find out formal and informal polices and procedures followed in the company. This can be done with detailed questionnaires, which can help find out concerns of IT managers, IT users, Operations staff, Top Management, Divisional Heads and Technical Team.

A Gap Analysis Document can be created once the

Procedural Risk Assessment exercise completed.. This would help companies have a clear understanding of where they stand as far as acquiring the Certification is concerned.

Risk Management

Once the gaps in the systems are identified, one has to manage these risks and make sure that the possibility of these risks affecting the company is very low or in some cases totally eliminated. BS 7799 has been designed in such a manner that its 127 Control Clauses have addressed almost every Conceivable risk known to Information Systems.

The standard Defines Risk Management as -process of identifying, controlling and minimizing or eliminating security risks that may affect information systems, for an acceptable cost

For Example: While conducting the procedural risk assessment one finds that while disposing old computer systems one does not erase or format the hard disk which goes along with the machine. So the risk is potential leakage of information, which is stored on the Hard Disk. This risk is addressed by Domain 8 Communications and operations management 8. which states that Media shall be disposed of securely and safely when no longer required.(4.6.6.2)

Creating of Security Policies and Procedures to Manage Risks Effectively

As in every Management System Security, Management is Policy driven and has to be driven and pushed in to an organisation. One has to take utmost care to address every concern expressed during the technical and

Procedural risk management exercise and prepare the documentation of the required polices (The list is only indicative and differs from organisation to organisation)

Logical Access Controls, Password Security & Controls, Network &

Telecommunication Security, Application Software Security, Program

Change Controls, Version Controls, Disaster Recovery Plan, Electronic Mail Security, Backup & Recovery, Internet access and security, Operating Systems Security, Incident Response and Management, Third Party Security, Data Classification, Web server Security, Intranet Security, Punitive Actions, Firewall Security, Use Of Cryptography, Digital Signature Security, Database Security, Virus Protection

Implementation of a effective risk management has various benefits and some of which could be enhanced understanding of business aspects, Reductions in security breaches and/or claims, Reductions in adverse publicity, Improved insurance liability rating, Identify critical assets via the Business Risk Assessment, Provide a structure for continuous improvement, Be a Confidence factor internally as well as externally, Enhance the knowledge and importance of security-related issues at the management level, Ensure that "knowledge capital" will be "stored" and managed in a business management systems.

Source : http://www.computersecuritynow.com/7799part2.htm

ISMS Implementation Guide

By Vinod Kumar Puthuseeri
Information Security Consultant

Objective
This paper can serve as a guideline for the implementation of ISMS practices using BS7799 / ISO 27001 standards. To give an insight and help those who are implementing this for the first time and for those who will be coordinating with external consultants for ISMS implementations in their organizations.

Scope
This document will cover the requirements from an audit point of view, methods and tips on implementing ISMS practices.

Standard
BS7799 / ISO 27001
BS7799 is a British Standard that addresses Information Security in all areas including Physical Security. BS7799 was incorporated with some of the controls from ISO 9000 and the latest version is called ISO 27001.

There are 11 chapters in the ISO 27001 version.

Table of Contents

Objective
Scope
Standard
- BS7799 / ISO 27001
- The CIA triad
- PDCA Model
- Benefits
Management
- Management Commitment
- Case Study
Implementation Process
- The team
- Define the Scope
- Risk Assessment
Asset e Inventory
Asset e Value
Risk Value
Business Impact Analysis (BIA)
Probability of Occurrence
Risk Assessment Tools
Why identify the risk value
- Risk Management
Deciding Assets for Risk Mitigation
Different Methods of Handling Risks
- Statement of Applicability (SOA)
Business Continuity Plan & Disaster Recovery (BCP & DR)
- Process
- Business Impact Analysis
Audit
- Pre-Assessment Audit (Adequacy Audit)
- Document Review
- On Floor Audit
- Internal Audit
Desktop Audit
User Awareness Audit
Technical a Audit
Social a Engineering
Physical Security
Post Audit Check
User Awareness
- Train the trainer approach
- Without train the trainer approach
- Training Materials
Reference
Declaration
Disclaimer
Copyright
Contact
GNU Free Documentation License

Link : http://www.infosecwriters.com/text_resources/pdf/ISMS_VKumar.pdf

Information Security : Design, Implementation, Measurement, and Compliance

ORDER THIS BOOK

Author : Timothy P. Layton
Product Details
Hardcover : 222 pages
Publisher : AUERBACH; 1 edition (July 20, 2006)
Language : English
ISBN-10 : 0849370876
ISBN-13 : 978-0849370878

Table of Contents
EVALUATING AND MEASURING AN INFORMATION SECURITY PROGRAM
INFORMATION SECURITY RISK ASSESSMENT MODEL (ISRAM�)
. Background
. Linkage
. Risk Assessment Types
. Relationship to Other Models and Standards
. Terminology
. Risk Assessment Relationship
. Information Security Risk Assessment Model (ISRAM)
. References
GLOBAL INFORMATION SECURITY ASSESSMENT METHODOLOGY (GISAM�)
. GISAM and ISRAM Relationship
. GISAM Design Criteria
. General Assessment Types
. GISAM Components
. References
DEVELOPING AN INFORMATION SECURITY EVALUATION (ISE�) PROCESS
. The Culmination of ISRAM and GISAM
. Business Process
A SECURITY BASELINE
. KRI Security Baseline Controls
. Security Baseline
. Information Security Policy Document
. Management Commitment to Information Security
. Allocation of Information Security Responsibilities
. Independent Review of Information Security
. Identification of Risks Related to External Parties
. Inventory of Assets
. Classification Guidelines
. Screening
. Information Security Awareness, Education, and Training
. Removal of Access Rights
. Physical Security Perimeter
. Protecting Against External and Environmental Threats
. Secure Disposal or Reuse of Equipment
. Documented Operating Procedures
. Change Management
. Segregation of Duties
. System Acceptance
. Controls against Malicious Code
. Management of Removable Media
. Information Handling Procedures
. Physical Media in Transit
. Electronic Commerce
. Access Control Policy
. User Registration
. Segregation in Networks
. Teleworking
. Security Requirements Analysis and Specification
. Policy on the Use of Cryptographic Controls
. Protection of System Test Data
. Control of Technical Vulnerabilities
. Reporting Information Security Events
. Including Information Security in the Business Continuity Process
. Identification of Applicable Legislation
. Data Protection and Privacy of Personal Information
. Technical Compliance Checking
. References
BACKGROUND OF THE ISO/IEC 17799 STANDARD
. History of the Standard
. Internals of the Standard
. Guidance for Use
. High-Level Objectives
. ISO/IEC Defined
. References
ISO/IEC 17799:2005 GAP ANALYSIS
. Overview
. Guidance for Use
. General Changes
. Security Policy
. Organization of Information Security
. Asset Management
. Human Resources Security
. Physical and Environmental Security
. Communications and Operations Management
. Access Control
. Information Systems Acquisition, Development, and Maintenance
. Information Security Incident Management
. Business Continuity Management
. Compliance
. References

ANALYSIS OF ISO/IEC 17799:2005 (27002) CONTROLS
SECURITY POLICY
. Information Security Policy
. Summary
. References
ORGANIZATION OF INFORMATION SECURITY
. Internal Organization
. External Parties
. Summary
. References
ASSET MANAGEMENT
. Responsibility for Assets
. Information Classification
. Summary
. References
HUMAN RESOURCES SECURITY
. Prior to Employment
. During Employment
. Termination or Change of Employment
. Summary
. References
PHYSICAL AND ENVIRONMENTAL SECURITY
. Secure Areas
. Equipment Security
. Summary
. References
COMMUNICATIONS AND OPERATIONS MANAGEMENT
. Operational Procedures and Responsibilities
. Third-Party Service Delivery Management
. System Planning and Acceptance
. Protection against Malicious and Mobile Code
. Backup
. Network Security Management
. Media Handling
. Exchange of Information
. Electronic Commerce Services
. Monitoring
. Summary
. References
ACCESS CONTROL
. Business Requirements for Access Control
. User Access Management
. User Responsibilities
. Network Access Control
. Operating System Access Control
. Application and Information Access Control
. Mobile Computing and Teleworking
. Summary
. References
INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT, AND MAINTENANCE
. Security Requirements of Information Systems
. Correct Processing in Applications
. Cryptographic Controls
. Security of System Files
. Security in Development and Support Processes
. Technical Vulnerability Management
. Summary
. References
INFORMATION SECURITY INCIDENT MANAGEMENT
. Reporting Information Security Events and Weaknesses
. Management of Information Security Incidents and Improvements
. Summary
. References
BUSINESS CONTINUITY MANAGEMENT
. Information Security Aspects of Business Continuity Management
. Summary
. References
COMPLIANCE
. Compliance with Legal Requirements
. Compliance with Security Policies and Standards, and Technical Compliance
. Information Systems Audit Considerations
. Summary
. References
APPENDIX A: ISO STANDARDS CITED IN ISO/IEC 17799:2005 APPENDIX B: GENERAL REFERENCES INDEX

-------------------------------------------------------------

Editorial Reviews
I have had the pleasure of working with Tim on several large risk assessment projects and I have tremendous respect for his knowledge and experience as an information security practitioner. … Risk assessment is the cornerstone of an effective information security program. … striving to achieve compliance in the absence of a risk-based security strategy can only lead to failure. … Implement an effective risk assessment program and take control of the compliance monster. … This book will help you do just that. I know you will benefit from Tim's guidance on how to get the most from your risk assessment efforts. For today's information security leaders, there is not a topic more important.
-From the Foreword by Gary Geddes, CISSP, Strategic Security Advisor, Microsoft Corporation

-------------------------------------------------------------

Book Description
Organizations rely on digital information today more than ever before. Unfortunately, that information is equally sought after by criminals. New security standards and regulations are being implemented to deal with these threats, but they are very broad and organizations require focused guidance to adapt the guidelines to their specific needs. Fortunately, Information Security: Design, Implementation, Measurement, and Compliance outlines a complete roadmap to successful adaptation and implementation of a security program based on the ISO/IEC 17799:2005 (27002) Code of Practice for Information Security Management. The book first describes a risk assessment model, a detailed risk assessment methodology, and an information security evaluation process. Upon this foundation, the author presents a proposed security baseline for all organizations, an executive summary of the ISO/IEC 17799 standard, and a gap analysis exposing the differences between the recently rescinded version and the newly released version of the standard. Finally, he devotes individual chapters to each of the 11 control areas defined in the standard, covering systematically the 133 controls within the 39 control objectives. Tim Layton's Information Security is a practical tool to help you understand the ISO/IEC 17799 standard and apply its principles within your organization's unique context.

-------------------------------------------------------------

Protection of sensitive information and improving IT control by implementing Six Sigma approach

by Kaskyrbekova Aigerim

Table of contents
Abstract
Introduction (purpose of the project, problem statement, motivation, significance of the
project etc)
I Data loss results: confirmed losses of sensitive data
· Which data are most sensitive?
II Leading causes of data loss.
· The primary channels for sensitive data loss
III Strategic actions to protect sensitive data
· More monitoring and measurement
· IT controls and sensitive data losses
· Lost data: lost revenues, lost customers and additional expenses
· Benefits of protecting sensitive data
IV Implementing Six Sigma approach in IT control.
· Case Studies/Applications Motorola company
· Six Sigma Methodologies
· Six Sigma’s Role in Information Technology
Conclusion
· Reference

Introduction
It’s hard to imagine what businesses would do without technology. With most commercial interactions (and transactions) riding on multiple internal and external electronic environments—and ever-mounting mandates for demonstrating accountability—organizations have more incentive than ever to keep core business data safe and secure. What are companies doing to protect their data, and are these efforts successful? My project provides a clearer understanding of the state of data protection across many different industries, and compares the characteristics, strategic and tactical Actions for improving results. Due to the under-reported nature of the issue—no organization wants to be featured on the front-page of the business press for losing customer data—the findings and numbers are enlightening, compelling, and hopefully will act as a diagnostic framework for taking action that will help to reduce data loss, customer loss, revenue loss and hence improve results.

Nowadays, protection of information became more crucial issue than two, three decades ago. The mass circulation of information allows people to find all the necessary information through internet. Therefore, protection of sensitive information such personal, financial, customers and employee information are becoming more difficult especially for big companies where from Customer Lists, to Merger and Acquisition information, emails and electronic documents companies hold most valuable and sensitive data. In high competitive world, companies are trying be most innovative in order to be profitable and sustain which come being different by creating unique products. Nevertheless, to make it so companies should protect their internal privacy this can be attack as well by external for example hackers as internal by employees and customers. In world of information overflow, each can easily gather electronic documents of most valuable and sensitive information some are trying to be benefit from selling stolen information. According to the Privacy Rights Clearinghouse (PRC) from February 15 2005 to January 19 2007 453 separate incident of data lost was recorded where almost 100 million sensitive, personally identifiable information was unprotected and stolen or lost. Based on information of stolen or lost data which was made public, it becomes clear that different industries are faced and have experienced with sensitive data lost where some companies affected more than others due to kind of industry and size of organization. In the list of organizations, which was announced as data lose, were widely known companies where trust hood is playing a big role. Thus, protecting the sensitive electronic information is a huge challenge, which can be improved by leveraging Six Sigma program by eliminating defect in order to meet customer and employees satisfaction. This report will help understand Six Sigma theory, Six Sigma tools that are available, and the ways in which Six Sigma can be applied to IT.

Read More : http://citebm.business.uiuc.edu/TWC%20Class/Project_reports_Spring2007/Information%20Trust%20and%20Compliance/kaskyrbe/kaskyrbe.pdf

It security and Risk Management : ISO 17799 [PDF]

Madina Nurguzhina

Table of contents

1. Introduction
2. COBIT versus ISO 17799 in IT Governance
2.1. COBIT 4.0
2.2. ISO 17799
3. Implementation of ISO 17799
3.1. ISO 17799’s implementation example
3.2. Benefits of ISO17799
4. Conclusion
Reference

Introduction

In order to be compliant with current laws and regulations, to be competitive and successful a company in the big world must consider not only such things as profit, personnel, supply chain management, and so on, but also information technologies that play a very high role in aforementioned processes. Information is a very important element of every process within a company. If a company can successfully protect and manage information, it would contribute a lot into its business purposes as a whole.

In the global community there are many different types of standards and frameworks that help a company to manage and secure IT such as COSO, COBIT, ISO, ITIL and many others. In order to have a strong and sound IT governance, a company has to implement appropriate IT frameworks that would fit a company’s main processes.

COSO is a very broad group of standards that includes different financial and auditing institutions’ functions, while COBIT, ISO and ITIL are more specific and focuses more on IT security and risk management. As a part of my individual project, I want to narrow my search to COBIT and ISO standards. ISO standards are used globally more often than COBIT due to the fact that ISO fits more smoothly into different frameworks of most of the countries in terms of business processes since COBIT addresses standards only, while ISO concerns about both standards and processes (e.g. organizational security, personnel security, communications and operations management, business continuity management, and so on). I will show it in my report supporting my ideas with relevant cases and examples from certain companies.

Let us talk a little bit about COSO (the Committee of Sponsoring Organizations of the Treadway Commission) and its role in IT Governance. As was mentioned earlier COSO is a very broad set of standards (to be precise a private sector organization) that focuses not only on IT Governance control and improvement, but also and mostly focuses on financial reporting’ quality, internal control and corporate governance. This organization was formed in order to find out factors that lead to frauds in financial reporting as well as give recommendations how to prevent these factors for companies, auditors, educational institutions and so on. Among sponsoring organizations within the Committee there are “five major professional associations in the United States, the American Accounting Association, the American Institute of Certified Public Accountants, Financial Executives International, the Institute of Internal Auditors, and the National Association of Accountants (now the Institute of Management Accountants)” (1). In spite of the fact that there is a sponsorship deal, the Commission is independent from all of the sponsoring organizations, and has representatives from industry, public accounting, the New York Stock Exchange, and different investment firms.

COSO defines Internal Control as “a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives” in such categories as effectiveness and efficiency of operations, reliability of financial reporting and compliance with applicable laws and regulations. IT Governance is part of internal control within the COSO framework. Therefore, different frameworks for IT security and management (COBIT, ITIL, ISO, and so on) should comply with COSO organization’s rules and requirements. While COSO is generally accepted as the internal control framework for enterprises, COBIT, ISO and other similar frameworks are the generally accepted internal control frameworks for IT.

Read More : http://citebm.business.uiuc.edu

White Paper on Information Security Auditing / Implementation Procedures

Today, information is the lifeblood of most organizations. With the increase in global Internet access, the possibility of security risks has increased significantly. With the advent of the Gramm-Leach-Bliley Act ("GLB") in 1999, safeguarding client and consumer information has become the primary focus of many regulatory commissions like the FTC, FDIC/OCC, SEC, NCUA, and HIPPA.
Information security is an ever-evolving challenge, requiring proper attention and due
diligence to maintain. Within this white paper, we will discuss Information Technology
(IT) auditing techniques and secure network implementation methodologies.

View This White Paper : Information_Security_Auditing_White_Paper_v3
Source : www.allstatestech.com

INDEX

1. The Auditing Process Page 3
· Black Hat Method
· White Hat Method

2. Post Audit Page 5
· Costs Associated with Security
Breaches

3. Designing a Security Policy Page 6

4. Designing a Secure Architecture Page 7

5. Remediations & Migrations Page 8

6. Final Audit Page 8

7. Staying Secure Page 9

8. Credentials Page 10

IMPLEMENTING ISO 17799

It is becoming increasingly critical that information security is given the attention and level of importance it deserves. Most organizations are now totally dependent upon their information and business systems, so much so that serious disruption to those systems and the business information they contain can mean disaster or critical loss.

ISO17799 is the only internationally accepted worldwide standard/code dealing comprehensively with these issues. Purchasing this standard is a good first step, but as the standard is by necessity a comprehensive and therefore a fairly complex document, guidance is often necessary to help organizations decide where to start and what priorities should be applied to the implementation process.

The ISO17799 Toolkit was of course introduced to solve many of these issues in one step. As well as containing both parts of the standard, it also includes a full set of compliant policies ready for implementation, a road map for potential certification of the organization, an audit kit for network based systems, a business impact analysis questionnaire together with many other supportive items (eg: a disaster recovery kit, a management presentation and an IS glossary). This toolkit represents extremely good value as it can enable organizations to commence work with the introduction of vital security aids without reference to expensive external consulting resources.

However, even armed with a support kit like this, it is important to understand that the key to the standard is PROCESS... the creation and maintenance of a robust ISMS. This is occasionally overlooked, as some organizations simply adopt a tick list from the first part of the standard (ISO 17799). This is certainly a good stride forward, but is by no means the end of the journey.

When first considering the standard, therefore, it should be understood that the path forward will certainly include enhancement and improvement of security, but it will largely be driven via the creation and maintenance of information security management systems and supporting procedures.

Source : http://www.17799central.com/news.htm

Implementing an Information Security Management System in an Internal Web Development Environment (Ebook)

Implementing an Information Security Management System in an Internal Web Development Environment

GIAC ISO-17799 Certification (G7799)
Practical Assignment –Version 1.1
SANS 2004 (Orlando, FL)

Joseph McComb
October 28th, 2004

File Type : PDF
Page : 88 Page
Source : http://www.giac.org/certified_professionals/practicals/g7799/0019.php

Table of Contents

Abstract ..................................................................................................................................................3
I. The System Defined .............................................................................................................................3
The Company .....................................................................................................................................3
The Origin of the Environment ..............................................................................................................6
The Current Environment .....................................................................................................................7
Current Web Applications and Sites in the Environment .....................................................................10
Current State of Security ....................................................................................................................12
Scope of Information Security Management System (ISMS) ...............................................................15
II. Planning the Implementation of the Information Security Management System (ISMS).......................15
Management Structure .......................................................................................................................15
The Asset Inventory ...........................................................................................................................18
Policies .............................................................................................................................................21
Risk Identification and Analysis Process.............................................................................................23
Plans for Risk Management................................................................................................................24
III. Implementation (the “Do” phase).......................................................................................................33
Correcting the Problems Identified in the Risk Management Plan .......................................................33
Statements Of Applicability.................................................................................................................43
IV. Check –System Auditing..................................................................................................................44
V. Continuous Improvement (“Act” Phase).............................................................................................51
Improving the System Through Lessons Learned from Incident Handling ...........................................51
Improving the System through Auditing ..............................................................................................51
Bibliography..........................................................................................................................................52
Appendix A –Extended Asset Classification ..........................................................................................53
Appendix B –Policies...........................................................................................................................62
Policy –System and Application Access Control (section 9.1 of the ISO 17799 standard)...................62
Policy –Business Continuity Planning (section 11.1 of the ISO 17799 standard) ................................63
Policy –Security Engineering in the Systems Development Life Cycle (section 10.1 of the ISO 17799
standard)...........................................................................................................................................64
Appendix C –Fault Tree Analysis ..........................................................................................................65
Appendix D –Flagged System Events .................................................................................................657
Appendix E –High Level Plan for Risk Management ..............................................................................81
Appendix F –Extended Audit Checklist..................................................................................................82
Table of Figures
Figure 1. Overview of the Drug Development Stages ...............................................................................5
Figure 2. Diagram of the Web Server Environment...................................................................................8
Figure 3. Overview of the Systems Development Life Cycle...................................................................10
Figure 4. Information Flow in the Data Center Environment ....................................................................11
Figure 5. Information Flow in the Development Environment ..................................................................12
Table of Tables
Table 1. Plan for Risk Management .......................................................................................................26
Table 2. Documentation of System Problems. ........................................................................................33
Table 3. Audit Checklist for User Access Management...........................................................................45

Steps for implementing the ISO 17799 standard

Initiation of the Project
Ensure the commitment of upper management;
Select and train members of the initial project team.

Definition of the ISMS
(Information Security Management System)
Identifying the scope and limits of the information security management framework is crucial to the success of the project.

Risk Assessment
Identify and evaluate threats and vulnerabilities;
Calculate the value of associated risks;
Diagnose the level of compliance with ISO 17799;
Inventory and evaluate the assets to protect.

Risk Treatment
Find out how selecting and implementing the right controls can enable an organization to reduce risk to an acceptable level.

Training and Awareness
Employees may be the weakest link in your organization’s information security.

Audit Preparation
Learn how to validate your management framework and what must be done before you bring in an external auditor for BS 7799-2 certification.

Audit
Learn more about the steps performed by external auditors and about certification agencies accredited for BS 7799-2.

Greg Tilley
Infotech Enterprises America

The Benefits of ISO 27001 Implementation

The benefits of standardization, and of implementation of one or more of the ISO 27000 series are wide and varied. Although they tend to differ from organization to organization, many are common.

The following is a list of potential benefits. As with many items on this website, this is an ongoing project. Please feel free to add further points via the comments option below.

Interoperability
This is a general benefit of standardization. The idea is that systems from diverse parties are more likely to fit together if they follow a common guideline.

Assurance
Management can be assured of the quality of a system, business unit, or other entity, if a recognized framework or approach is followed.

Due Diligence
Compliance with, or certification against, and international standard is often used by management to demonstrate due diligence.

Bench Marking
Organizations often use a standard as a measure of their status within their peer community. It can be used as a bench mark for current position and progress.

Awareness
Implementation of a standard such as ISO 27001 can often result in greater security awareness within an organization.

Alignment
Because implementation of ISO 27001 (and the other ISO 27000 standards) tends to involve both business management and technical staff, greater IT and Business alignment often results.

Implementing an Information Security Management System

There are key steps that every company implementing an Information Security Management System will need to consider:

Step1: Purchase the Standard
Before you can begin preparing for your application, you will require a copy of the standard. You should read this and make yourself familiar with it.

Step 2: Consider Training
There are training courses available to help you implement and assess your Information Security Management System.

Step 3: Assemble a team and agree your strategy
You should begin the entire implementation process by preparing your organizational strategy with top management. At this stage you should determine the Scope of your Registration - whether the system will be adopted company wide or by one or more departments.

Step 4: Review Consultancy Options
You can receive advice from independent consultants on how best to implement your information security management system.

Step 5: Undertake a Risk Assessment
During this phase you should undertake a review of all potential security breaches. This should not relate solely to IT systems, but should encompass all sensitive information within your organization.

Step 6: Develop a Policy Document
This will demonstrate management support and commitment to the Information Security Management System process.

Step 7: Develop Supporting Literature
Put together a Statement of Applicability and Procedures to support your security policy. This will cover a range of areas including asset clarification and control, personal security, physical and environmental security and business continuity management.

Step 8: Choose a registrar
The registrar is the 3rd party, like BSI, who come and assess the effectiveness of your information security management system, and issue a certificate if it meets the requirements of the standard. Choosing a registrar can be a complex issue as there are so many operating in the market. Factors to consider include industry experience, geographic coverage, price and service level offered. The key is to find the registrar who can best meet your requirements. A great place to start is by contacting us.

Step 9: Implement your Information Security Management System
The key to implementation is communication and training. During the implementation phase everyone begins operating to the procedures of the management system.

Step 10: Gain registration You should arrange your initial assessment with your registrar. At this point the registrar will review your Information Security Management System and determine whether you should be recommended for registration.

Step 11: Continual assessment
Once you have received registration and been awarded your certificate, you can begin to advertise your success and promote your business. Your ISMS will be periodically checked by your registrar to ensure that it continues to meet the requirements of the standard.

From : www.bsiamericas.com

ISMS implementation

First of all as the standard says, you need to "establish, implement,
operate, monitor, review, maintain and improve a documented ISMS".

So, you need to hire ISO27001 consultants in order to do the above tasks.
They will conduct internal audits, gap analysis and so on.

When you have all the documentation required,
You can start the certification process.

You will start a "Stage 1" audit wich deal only with documentation issues.
And this is accomplished by a IRCA Auditor in order to certificate your
ISMS. This is called a third party audit.

At the final of the audit you will receive observations and non-conformity
issues (major or minor) that you need to resolve.

Then when you resolve the above, you are ready to a "in site audit" which is
called "Stage 2", here the IRCA auditor will evaluate the ISMS PDCA process,
so they will look for ISMS policy, internal audit reviews, risk acceptance
criteria, risk assessment results, management commitment, and so on.

So, you need to start hiring ISO27001 Lead Auditors.

Hope this helps.

H. Daniel Regalado Arias, CISSP

(Certified Information Systems Security Professional)

Chief Security Officer
Macula Group
www.macula-group.com

ISO 17799 IMPLEMENTATION IN YOUR ORGANIZATION

It is becoming increasingly critical that information security is given the attention and level of importance it deserves. Most organizations are now absolutelyy dependent upon their information and business systems, so much so that serious disruption can mean disaster or critical loss.

ISO17799 is the only internationally accepted worldwide standard/code dealing comprehensively with these issues. Purchasing this standard is a good first step, but as the standard is by necessity a comprehensive and therefore a reasonable complex document, guidance is often necessary to help organizations decide where to start and what priorities should be applied to the implementation process.

The ISO 17799 Toolkit was of course introduced to solve many of these issues in one step. As well as containing both parts of the standard, it also includes a full set of compliant policies ready for implementation, a road map for potential certification of the organization, an audit kit for network based systems, a business impact analysis questionnaire together with many other supportive items (eg: a disaster recovery kit, a management presentation and an IS glossary). This toolkit represents extremely good value as it can enable organizations to commence work with the introduction of vital security aids without reference to expensive external consulting resources.

However, even armed with a support kit such as this, it is important to understand that the key to the standard is PROCESS... the creation and maintenance of a robust ISMS. This is occasionally overlooked, as some organizations simply adopt a tick list from the first part of the standard (ISO17799). This is certainly a good stride forward, but is by no means the end of the journey.

When first considering the standard, therefore, it should be understood that the path forward will certainly include enhancement and improvement of security, but it will largely be driven via the creation and maintenance of information security management systems and supporting procedures.

From : 17799-news.the-hamster.com

Nine Steps to Success: an ISO 27001 Implementation Overview

Nine Steps to Success: an ISO 27001 Implementation Overview




This book is the ideal guide for anyone tackling - or about to tackle - ISO27001 for the first time. It gives a clear overview of:

• how to get management and board buy-in;
• how to get cross-organizational, cross functional buy-in;
• the gap analysis: how much do you really need to do?
• the relationship between ISO27001 and ISO17799;
• how to integrate with ISO9001 and other management systems;
• how to structure and resource your project;
• use consultants or do it youself?
• the PDCA cycle;
• the timetable and project plan;
• risk assessment methodologies and tools;
• the documentation challenges;
• how to choose a certification body;
• and much more.

Read about and learn to apply the 6 secrets for a positive certification audit - and achieve the project goal painlessly!

Completely updated to reflect all the changes to both ISO 17799 and ISO 27001, this popular book is one you can't afford to be without!

Product Details

• Paperback: 120 pages
• Author: Alan Calder
• Publisher: IT Governance Ltd (January 1, 2006)
• Language: English.
• Format: Soft Covers
• ISBN-10: 1905356129
• ISBN-13: 978-1905356126
• Product Dimensions: 8.3 x 5.5 x 0.4 inches

Alan Calder, the author of "IT Governance: a Manager's Guide to Data Protection and BS7799/ISO17799" (now in its 3rd edition and the Open University's post graduate information security text book), led one of the first successful BS7799 certification efforts in the world. He is also a member of the certification committee of a global certification body. This book contains the experience and secrets drawn from many successful BS7799 implementations.

Order This Book

ISO 17799 IMPLEMENTATION IN YOUR ORGANIZATION

It is becoming increasingly critical that information security is given the attention and level of importance it deserves. Most organizations are now absolutelyy dependent upon their information and business systems, so much so that serious disruption can mean disaster or critical loss.

ISO17799 is the only internationally accepted worldwide standard/code dealing comprehensively with these issues. Purchasing this standard is a good first step, but as the standard is by necessity a comprehensive and therefore a reasonable complex document, guidance is often necessary to help organizations decide where to start and what priorities should be applied to the implementation process.

The ISO 17799 Toolkit was of course introduced to solve many of these issues in one step. As well as containing both parts of the standard, it also includes a full set of compliant policies ready for implementation, a road map for potential certification of the organization, an audit kit for network based systems, a business impact analysis questionnaire together with many other supportive items (eg: a disaster recovery kit, a management presentation and an IS glossary). This toolkit represents extremely good value as it can enable organizations to commence work with the introduction of vital security aids without reference to expensive external consulting resources.

However, even armed with a support kit such as this, it is important to understand that the key to the standard is PROCESS... the creation and maintenance of a robust ISMS. This is occasionally overlooked, as some organizations simply adopt a tick list from the first part of the standard (ISO17799). This is certainly a good stride forward, but is by no means the end of the journey.

When first considering the standard, therefore, it should be understood that the path forward will certainly include enhancement and improvement of security, but it will largely be driven via the creation and maintenance of information security management systems and supporting procedures.

From : 17799-news.the-hamster.com

Implement security management with these six steps

by Change Tech Solutions Inc. | Oct 8, 2003

Takeaway: With security one of their highest priorities, executives are searching for effective techniques to deliver maximum security while simplifying security management. This outline explains what you'll need to focus on.

Security management deals with how system integrity is maintained amid man-made threats and risks, intentional or unintentional. Intentional man-made threats include espionage, hacks, and computer viruses. Unintentional threats include those due to accidents or user ignorance of the effects of their actions. Security management ranges from identification of risks to determination of security measures and controls, detection of violations, and analysis of security violations. I'll describe the steps involved in security management and discuss factors critical to the success of security management.

Step 1: Determine and evaluate IT assets
Step 2: Analyze risk
Step 3: Define security practices
Step 4: Implement security practices
Step 5: Monitor for violations and take corresponding actions
Step 6: Reevaluate IT assets and risks

Key Strategies for Implementing ISO 27001 (4)

PUBLISHED BY THE INSTITUTE OF INTERNAL AUDITORS

Analyze Return on Investment
Based on the groundwork done so far, companies should be able to arrive at approximate time and cost estimates to implement the standard for each of the scope options. Organizations need to keep in mind that the longer it takes to get certified, the greater the consulting costs or internal staff effort. For example, implementation costs become even more critical when implementation is driven by market or customer requirements. Therefore, the longer compliance takes, the longer the organization will have to wait to reach the market with a successful certification.

MOVING FORWARD

Implementing ISO 27001 requires careful thought, planning, and coordination to ensure a smooth control adoption. The decision of when and how to implement the standard may be influenced by a number of factors, including different business objectives, existing levels of IT maturity and compliance efforts, user acceptability and awareness, customer requirements or contractual obligations, and the ability of the organization to adapt to change and adhere to internal processes.

To learn more about the standard, BSI has prepared a guidance document available on its Web site, http://asia.bsi-global.com/InformationSecurity/ISO27001+Guidance/download.xalter. In addition, the Standards Direct Web site, www.standardsdirect.org/iso27001.htm, covers the latest version of the standard.

Key Strategies for Implementing ISO 27001 (1)
Key Strategies for Implementing ISO 27001 (2)
Key Strategies for Implementing ISO 27001 (3)
Key Strategies for Implementing ISO 27001 (4)

Key Strategies for Implementing ISO 27001 (3)

PUBLISHED BY THE INSTITUTE OF INTERNAL AUDITORS

Determine ISO 27001 Maturity Levels
When assessing the organization’s compliance maturity level, auditors should determine whether or not the implementation team is able to answer the following questions:

• Does a document exist that specifies the scope of compliance?
  According to ISO 27001, a scope document is required when planning the standard's implementation. The document must list all the business processes, facilities, and technologies available within the organization, along with the types of information within the ISMS. When identifying the scope of compliance, companies must clearly define the dependencies and interfaces between the organization and external entities.
• Are business processes and information flows clearly defined and documented?
  Answering this question helps to determine the information assets within the scope of compliance and their importance, as well as to design a proper set of controls to protect information as it is stored, processed, and transmitted across various departments and business units.
• Does a list of information assets exist? Is it current?
  All assets that may affect the organization's security should be included in an information asset list. Information assets typically include software, hardware, documents, reports, databases, applications, and application owners. A structured list must be maintained that includes individual assets or asset groups available within the company, their location, use, and owner. The list should be updated regularly to ensure accurate information is reviewed during the compliance certification process.
• How are information assets classified?
  Information assets must be classified based on their importance to the organization and level of impact, and whether their confidentiality, availability, and integrity could be compromised.
• Is a high-level security policy in place?
  Critical to implementing an information security standard is a detailed security policy. The policy must clearly convey management's commitment to protecting information and establish the business' overall security framework and sense of direction. It should also identify all security risks, how they will be managed, and the criteria needed to evaluate risks.
• Has the organization implemented a risk assessment process?
  A thorough risk assessment exercise must be conducted that takes into account the value and vulnerabilities of corporate IT assets, the internal processes and external threats that could exploit these vulnerabilities, and the probability of each threat. If a risk assessment methodology is in place, the standard recommends that organizations continue using this methodology.
• Is a controls' list available?
  Necessary controls should be identified based on risk assessment information and the organization's overall approach for mitigating risk. Selected controls should then be mapped to Annex A of the standard — which identifies 133 controls divided in 11 domains — to complete a statement of applicability (SOA) form. A full review of Annex A acts as a monitoring mechanism to identify whether any control areas have been missed in the compliance planning process.
• Are security procedures documented and implemented?
  Steps must be taken to maintain a structured set of documents detailing all IT security procedures, which must be documented and monitored to ensure they are implemented according to established security policies.
• Is there a business continuity (BC) management process in place?
  A management process must be in place that defines the company's overall BC framework. A detailed business impact analysis based on the BC plan should be drafted and tested and updated periodically.
• Has the company implemented a security awareness program?
  Planning and documentation efforts should be accompanied by a proper IT security awareness program so that all employees receive training on information security requirements.
• Was an internal audit conducted?
  An internal audit must be conducted to ensure compliance with the standard and adherence to the organization’s security policies and procedures.
• Was a gap analysis conducted?
  Another important parameter to determine is the organization's level of compliance with the 133 controls in the standard. A gap analysis helps organizations link appropriate controls with the relevant business unit and can take place during any stage of the compliance process. Many organizations conduct the gap analysis at the beginning of the compliance process to determine the company's maturity level.
• Were corrective and preventive actions identified and implemented?
  The standard adheres to the Plan-Do-Check-Act" (PDCA) cycle (PDF, 62KB) to help the organization know how far and how well it has progressed along this cycle. This directly influences the time and cost estimates to achieve compliance. To complete the PDCA cycle, the gaps identified in the internal audit must be addressed by identifying the corrective and preventive controls needed and the company's compliance based on the gap analysis.
• Are there mechanisms in place to measure control effectiveness?
  Measuring control effectiveness is one of the latest changes to the standard. According to ISO 27001, organizations must institute metrics to measure the effectiveness of the controls and produce comparable and reproducible results.
• Is there a management review of the risk assessment and risk treatment plans?
  Risk assessments and risk treatment plans must be reviewed at planned intervals at least annually as part of the organization's ISMS management review.

Key Strategies for Implementing ISO 27001 (1)
Key Strategies for Implementing ISO 27001 (2)
Key Strategies for Implementing ISO 27001 (3)
Key Strategies for Implementing ISO 27001 (4)