ISO 27001 January Training

ISO 27001 TrainingIntroduction to Standards : 

ISO 27001 TrainingIntroduction to Standards Training #1 - January 2010 http://martindion.blogspot.com

Your Host : 

Your Host April 5, 2010 2 Copyright Martin Dion 2010 Martin Dion (CISSP/CISM) ISO:27 001/20 000 Lead Auditor & Trainer Chief Technology Officer at Above Security Located in Switzerland 15 years of information security experience Built « certified » information security management systems Management consultant specialized in compliance for international companies, private and offshore banks, lotteries and governments.

Introduction : 

Introduction April 5, 2010 Copyright Martin Dion 2010 3 First training in a series of training that will be produced over the year to come. Purpose of those training: Provide you with the necessary knowledge to build an Information Security Management System (ISMS) based on the ISO:27001 standard. Today’s training will provide: An overview of the certification process and the various standards available in the market to help you build your ISMS.

Topics for today : 

Topics for today April 5, 2010 4 Copyright Martin Dion 2010 How standards are built? The certification processes Overview of available standards ISO type of standards ISACA standards NIST standards PCI Consortium standards ASIS standards Benefits of standards Conclusion Further readings

How standards are built : 

How standards are built April 5, 2010 Copyright Martin Dion 2010 5 Standards are created to respond to business needs and normally have certification potential. Standard bodies, industry associations or regulatory bodies decides to manage that need. They assemble a group of subject matter experts who brainstorm on the content to improve the initial document baseline and to align it with market needs. An editorial committee is formed and the writing process start. Multiple iterations of the document are produced and edited to insure acceptance of relevant parties until the document is ready.

Certification Processes : 

Certification Processes Once a standard is created, market adoption occurs and enterprises start implementing it. The ISO certification process goes like this: Management sponsors the project and staff start implementing the ISMS with management support. Certification body conduct document review (Stage 1) Certification body conduct implementation review (Stage 2) Customer gets certified (certificate is valid for 3 years) Follow up audit occur on a yearly basis to maintain certification status. This process occurs over a 6 to 12-month period (timeline on next slide) April 5, 2010 Copyright Martin Dion 2010 6

Certification Processes : 

Certification Processes As per ISO:17021, certification body audit is split in two steps: Stage 1 (1/3 of audit time) & Stage 2 (2/3 of audit time) Audit duration is set by ISO:27006 and is based on the number of employees within the scope of certification: Certification Process Timeline April 5, 2010 Copyright Martin Dion 2010 7

Available Standards : 

Available Standards Information Security Management (27001) IT Service Management (20000) Governance Management (38500) Risk Management (31000, 27005, COSO) Business Continuity Management (25999) Quality Management (9001) Physical Security Management (ASIS) Technology standards (NIST) Payment card protection (PCI-DSS) Privacy Protection (EU, LPD, California, PIPEDA…) April 5, 2010 Copyright Martin Dion 2010 8

ISO Standards : 

ISO Standards The ISO:2700X series has been created to help organizations implement Information Security Management System. Built on the PDCA (Plan-Do-Check-Act) continuous improvement approach like other ISO Management System standards Composed of : ISO:27001 – The management system standard (Clause 4 to 8 + Appendix A – 133 control objectives) ISO:27002 – Code of practice to help you implement appendix A 133 control. ISO:27003 – Implementation guidance April 5, 2010 Copyright Martin Dion 2010 9

ISO Standards : 

ISO Standards Composed of : ISO:27004 – Metrics and measurement of the ISMS ISO:27005 – Risk Management ISO:27006 – Audit requirements for registration bodies All together, those documents will walk you through the various requirements and subsequent training will expose you to each of them in details over the next few months. The important thing to remember is that you get certified on how you manage the controls , in other words, the implementation of the management system (27001) not the technical controls (27002) April 5, 2010 Copyright Martin Dion 2010 10

ISO Standards : 

ISO Standards Other standards are available to help you build and govern a risk aware culture where service quality, business continuity, customer satisfaction and security are taken in consideration. Those standards are: ISO:9001 – Quality Management ISO:20000 – IT Service Management (ITIL like) BS:25999 – Business Continuity Management ISO:31000 – Risk Management System ISO:38500 – IT Governance (CoBIT like) The interesting thing is that all of them are built on the same framework, based on the PDCA. April 5, 2010 Copyright Martin Dion 2010 11

ISACA Standards : 

ISACA Standards The ISACA IT Governance Institute has built over the years an amazing suit of standards. Although not certifiable, those standards contain a wealth of information that IT professional should be aware of to better perform their duties: CoBIT – Control Objectives for Information and related Technologies Val IT - Governance of IT investments Risk IT – Management of business risk related to the use of IT The ISACA provides an outstanding version of CoBIT to its members called the CoBIT Online which contains audit program, key performance and goal indicators and maturity levels. April 5, 2010 Copyright Martin Dion 2010 12

ISACA Standards : 

ISACA Standards CoBIT – Control Objectives for Information Technology Framework for governing the Information Technology structure and life cycle providing alignment with business goal & value delivery, risk management, resource management, performance measurement Covers all the aspects of IT management including security and business continuity and formalize clear roles & responsibilities. Much like the ISO PDCA in the overall approach, activities and controls are split between: Planning & Organization Acquisition & Implementation Delivery & Support Monitoring & Evaluation April 5, 2010 Copyright Martin Dion 2010 13

ISACA Standards : 

ISACA Standards Val IT – IT value management Are we doing the right thing? Are we doing it the right way? Are we getting them done well? Are we getting the benefits? Risk IT – Management of Business Risks Related to IT Focus on identifying the relation between business and risks related to IT usage and initiatives Based on CoBIT, should be considered an extension as well Work in conjunction with Val IT to determine value and ROI Reinforce the notion of Key Risk Indicators and Risk response Linked with holistic enterprise frameworks such as ISO:31000 April 5, 2010 Copyright Martin Dion 2010 14

NIST Standards : 

NIST Standards The National Institute of Standards and Technology is a US federal technology agency that develops and promotes measurement, standards, and technology The SP-800 series provides pragmatic Standard Operating Procedures and Guidelines Covers various People, Process and Technology challenges. Example of available documents: Program management Secure web services Enterprise password management IDS & IPS Log management Vulnerability Management Encryption technologies Awareness & training Hardening Incident response Business continuity April 5, 2010 Copyright Martin Dion 2010 15

PCI Council Standards : 

PCI Council Standards Originally initiated be VISA and Mastercard, the payment card industry data safeguard standard (PCI-DSS) is now managed by the PCI Security Council Certification is mandatory for merchant. The highest level of requirement is for a Level 1 merchant and requires the organization to: Run quarterly vulnerability scan against the IT perimeter using an Authorized Scanning Vendor (ASV) Run an annual independent audit against the standardized list of controls by a Qualified Security Assessor (QSA) The requirements are documented within 12 families of control, which splits into 232 specific controls (PPT) April 5, 2010 Copyright Martin Dion 2010 16

ASIS Standards : 

ASIS Standards ASIS International (previously known as the American Society for Industrial Security) is an organization with 37,000 members with chapter in dozens of country around the world They are specialized mostly in the physical aspect of security and industrial safety focusing on loss prevention by protecting workers and their employers They have published really useful stuff such has: Organizational resilience standard (continuity management) Facility physical security measures Guidelines Chief Security Officer Guidelines (roles & responsibilities) Pre-employment background screening Guidelines Information asset protection Guidelines April 5, 2010 Copyright Martin Dion 2010 17

Benefits of Standards : 

Benefits of Standards Unless you are working in R&D, your job is not to invent new management system. Since there is no need to re-invent the wheel, standards helps you focus on delivery and value creation (which is generally well rewarded) Those documents are international terms of reference developed by professional from the industry so they are reliable in the eye of top execs. They are independently certifiable If no certification scheme is available, you can still get it certified by an auditor (ie: PWC/KPMG) under a SAS70 type II audit program or by a certification body by incorporating the controls into an ISO:27001 Statement of Applicability April 5, 2010 Copyright Martin Dion 2010 18

Conclusion : 

Conclusion As you seen in my presentation, a lot is readily available to you and your organization Building or implementing such a management system is not a question or finding what to do to manage such and such issues, it is more a question of: Planning and business alignment; Sponsorship and management support; Risk management with corporate objectives; and, Soft skills such as communication and project management Over the next few months, we’ll try to balance those various aspects to help you build credibility and delivery skill set April 5, 2010 Copyright Martin Dion 2010 19

Closing remarks : 

Closing remarks I hope you enjoyed this training session If you have question, comment or suggestion, please do not hesitate to comment on the blog It is really important to me that you transmit them so I can improve the content and delivery for future video training. Remember that the only stupid question is the one we do not ask ! The current presentation will be published on the blog when the next training becomes available and the next slide titled “further reading” will be stored on the BLOG right away in case you want to dig for yourself April 5, 2010 Copyright Martin Dion 2010 20

Further Readings : 

Further Readings My company : www.abovesecurity.com My blog: martindion.blogspot.com ISO standards: www.iso.org BS25999 Business Continuity: shop.bsigroup.com/en/Browse-by-Subject/Business-Continuity/?t=r NIST SP800 series: csrc.nist.gov/publications/PubsSPs.html PCI-DSS: www.pcisecuritystandards.org CoBIT, Val IT and RIsk IT: www.isaca.org ASIS Standards: www.asisonline.org/guidelines/published.htm ISO 27001 Registration bodies (partial list): SGS, BSI, DNV, TUC, SQS, QMI/SAI Global, SRI, BRS, AFNOR. April 5, 2010 Copyright Martin Dion 2010 21