ISO27001/2 & Cyber Essentials
ISMS Frameworks
DISCLAIMER:
- This document contains unedited notes and has not been formally proofread.
- The information provided in this document is intended to provide a basic understanding of certain technologies.
- Please exercise caution when visiting or downloading from websites mentioned in this document and verify the safety of the website and software.
- Some websites and software may be flagged as malware by antivirus programs.
- The document is not intended to be a comprehensive guide and should not be relied upon as the sole source of information.
- The document is not a substitute for professional advice or expert analysis and should not be used as such.
- The document does not constitute an endorsement or recommendation of any particular technology, product, or service.
- The reader assumes all responsibility for their use of the information contained in this document and any consequences that may arise.
- The author disclaim any liability for any damages or losses that may result from the use of this document or the information contained therein. The author reserve the right to update or change the information contained in this document at any time without prior notice.
- Any attempts to perform penetration testing or ethical hacking on systems or networks should be done with the explicit permission of the system/network owner. Unauthorized access is illegal and can result in serious legal consequences.
- It is important to fully understand the scope of the testing and to only test within that scope. Testing outside the agreed upon scope is considered unauthorized and may result in legal action.
- Any findings or vulnerabilities discovered during testing should be reported to the system/network owner immediately and kept confidential until a fix can be implemented.
- It is recommended to use a separate, dedicated testing environment rather than testing on a live production system to minimize the risk of accidentally causing damage or downtime.
- It is important to take steps to protect your own identity and prevent accidental data leaks or exposure of sensitive information during testing.
- It is also recommended to follow a standard code of ethics for ethical hacking and penetration testing.
REFERENCES:
- ISO/IEC 27001: 2013 & 27002: 2013
- ISO/IEC 27001: 2022 & 27002: 2022
- Lead implementer Professional ISO /IEC 27001:2013
- BSI training materials
- Cyber Essentials
- https://ce-knowledge-hub.iasme.co.uk/
ISO 27001 & 27002 Notes
What key insights can be gained from learning about ISO 27001:
- How to create and implement the Information System Management within the organization.
- Discuss on the Framework based on the ISO 27001
- Three pillars: Confidentiality, Integrity and Availability
Two words on Knowledge and Skill.
Learning Objectives
Knowledge
- ISM
- Benefits of ISM
- Requirements of 27001
- Conduct baseline review: we will get the skills to conduct GAP analysis
- Will have Implementation skills
- Explain the concepts of Project management
Information Security management
Three pillars: [CIA]
- Confidentiality,
- Integrity and
- Availability
- Means cannot be challenged by anybody.
- Means unaltered information. Information cannot be changed in-between end to end.
- Also need to secure the in-between facility which is processing the information.
- Business Continuity to some extent will be part of the Information Security Management system. And there will be separate Business continuity and Disaster management.
- How the information should be discarded.
- Reduce Security incidents, increase staff retention, Protection of brand and reputation, reduce costs of correction, customer retention, etc
- Framework: Sets of Principle, policy’s, rules, guidelines make a whole framework.
- Framework: Sets of Principle, policy’s, rules, guidelines make a whole framework.
- BSI started in 1901, wanted to start Tube railways and floated in tender. The big problem was getting 5 different plans which had different dimensions. This created the problem that they are not compatible within each other.
- BS7799 :1995: - British standards published in 1995
- 2005: ISO re- nomenclature and published the 27001 by getting from BS.
Difference b/w to 27001 and 27002:
- 27001: What has to be done.
- 27002: How it has to be done: - Implementation guideline:
ISO 27001
Clause 4: Context of the organization
- What are: - Internal Issue, External issue and Interested parties?
- Interested parties: Promoters or Shareholders, Employees, Government, neighbours, customers, vendors, etc.
- Internal issue: When there are internal strikes.
- External issue: Government regulatory compliance
- Here boundaries are set for the rules and boundaries.
- e.g.: in Some countries security guards will be present to collect the ID proof and registry entry is made. The same company operating in JAPAN has no security guard. Since there is no practice of security guards in JAPAN.
PDCA and ISMS:
- Plan :
- requirements: -
- Clause 4 Context of the org. /
- 5 leadership /
- 6 Planning /
- 7 Support
- DO:
- implement: -
- Clause 8 Operation
- Check:
- Audits/ gaps/ managements review: -
- Clause 9 Performance evaluation
- Act :
- Results/ improvement: -
- Clause 10 Improvement
Legal, regulatory and contractual:
- Regulatory Body: - RBI is the regulatory Body, SEBI regulatory for Stock exchanges Legal:
- Requirements from the government Contract: requirements which are passed on by working with clients which are laid upon by the regulatory body.
- Statutory and regulatory requirements: As an ISMS manager: just telling them to follow.
- Do not be a SME in Statutory field to implement ISMS.
- Show what are the list of Statutory and regulatory requirements you are adhered to.
Captive environment:
- Shall means mandatory
- May means optional
Clause 4 Context of the organization
4.1 Understanding the organization and its context4.2 Understanding the needs and expectations of interested parties
4.3 Determining the scope of the information security management system
4.4 Information security management system
Clause 5 Leadership
5.2 Policy
5.3 Organizational roles, responsibilities and authorities
- Top management should create and provide resources,
- Create security Policy, security objectives
Clause 6 Planning
6.1.1 General
6.1.2 Information security risk assessment
6.1.3 Information security risk treatment
- NOTE 1 Organizations can design controls as required, or identify them from any source.
- NOTE 2 Annex A contains a list of possible information security controls. Users of this document are
- directed to Annex A to ensure that no necessary information security controls are overlooked.
- NOTE 3 The information security controls listed in Annex A are not exhaustive and additional information
- security controls can be included if needed.
E.g., Objective
- Zero security data breach
- 100 % compliance to infosec audit
- As per policy all the employees will change the password every 90 days
- 100% of pen-testing to happen for all the projects in every quarter.
- 98% of awareness of Infosec training has to be completed by the vendors
Clause 7 Support
- 7.1 Resources
- 7.2 Competence
- By three ways: Education arranging training and Experience
- 7.3 Awareness
- Senior management has to create awareness about Information security among the employees.
- 7.4 Communication
- 7.5 Documented information
Clause 8 Operation
Clause 8 is also the DO part from PDCA8.1 Operational planning and control
8.2 Information security risk assessment
8.3 Information security risk treatment
Clause 9 Performance evaluation
- Here Monitoring and measurement is done.
- The Objectives which are identified earlier will be monitored and measured.
- These audits internal and external are conducted
- Documentation must be maintained
- Conformance and non – conformance
- As an external auditor will look into the internal NC’s are reported and closed.
Clause 10 Improvement
PDCA: Matrix
- Understanding of context.
- Expectations of interested parties.
- Scope and ISMS.
- Management commitment.
- IS policy.
- Roles, responsibilities and authorities.
- Actions to address risk and opportunity.
- Infosec objectives.
- Resources.
- Competence.
- Awareness.
- Communication.
- Documented Information.
- Operational planning and control.
- Risk assessment.
- Risk treatment.
- Monitoring, measurement, analysis and evaluation.
- Internal audit.
- Management review.
- Nonconformity and corrective action.
- Continual improvement.
ISO 27002 : 2022
Controls are Grouped Under:
- Organizational controls
- People controls
- Physical controls
- Technological controls
5. Organizational controls
6. People controls
7. Physical controls
8. Technological controls
Annexes Contains as below:
- The matrix control of attributes is available in Annex Table "A.1", which can be filtered based on specific requirements. For instance, Table A.2 demonstrates an example of creating a view by filtering with a particular attribute value, such as #Corrective.
- Control types (#Preventive, #Detective, #Corrective)
- Information security properties (#Confidentiality, #Integrity, #Availability)
- Cybersecurity concepts (#Identify, #Protect, #Detect, #Respond, #Recover)
- Operational capabilities (#Governance, #Asset_management, #Information_protection, #Human_resource_security, #Physical_security, #System_and_network_security, #Application_security, #Secure_configuration, #Identity_and_access_management, #Threat_and_vulnerability_management, #Continuity, #Supplier_relationships_security, #Legal_and_compliance, #Information_security_event_management, #Information_security_assurance)
- Security domains (#Governance_and_Ecosystem, #Protection, #Defence, #Resilience)
- Mapping of 2022 controls are mapped with 2013 under Annex B of the document Table B.1.
- mapping of 2013 controls are mapped with 2022 under Annex B of the document Table B.2
Matrix Control Type :- Preventive, Detective; Corrective:
|
ISO/IEC
27002 control identifier |
Control
name |
Control
type |
Information
security properties |
Cybersecurity
concepts |
Operational
capabilities |
Security
domains |
|
5.1 |
Policies for
information security |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Governance |
#Governance_
and_Ecosys- tem #Resil- ience |
|
5.2 |
Information
security roles and responsi- bilities |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Governance |
#Govern-
ance_and_ Ecosystem#Protection#Resilience |
|
5.3 |
Segregation
of duties |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Governance
#Identity_and_access_man-agement |
#Governance_
and_Ecosys- tem |
|
5.4 |
Management
responsibili- ties |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Governance |
#Governance_
and_Ecosys- tem |
|
5.5 |
Contact with
authorities |
#Preventive
#Corrective |
#Confidentiality
#Integrity #Availability |
#Identify
#Protect #Respond #Recover |
#Governance |
#Defence
#Re- silience |
|
5.6 |
Contact with
special inter- est groups |
#Preventive
#Corrective |
#Confidentiality
#Integrity #Availability |
#Protect#Respond
#Recover |
#Governance |
#Defence |
|
5.7 |
Threat
intelli- gence |
#Preventive
#Detective #Corrective |
#Confidentiality
#Integrity #Availability |
#Identify
#Detect #Respond |
#Threat_and_
vulnerability_ management |
#Defence
#Re- silience |
|
5.8 |
Information
security in project man- agement |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify
#Protect |
#Governance |
#Governance_
and_Ecosys- tem #Protec- tion |
|
5.9 |
Inventory of
information and other associated assets |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Asset_man-agement |
#Governance_
and_Ecosys- tem #Protec- tion |
|
5.10 |
Acceptable
use of information and other associated assets |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Asset_man-agement#Information_protection |
#Governance_
and_Ecosys- tem #Protec- tion |
|
5.11 |
Return
ofassets |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Asset_man-agement |
#Protection |
|
5.12 |
Classification
of information |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Information_protection |
#Protection#Defence |
|
5.13 |
Labelling of
information |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Information_protection |
#Defence#Protection |
|
5.14 |
Information
transfer |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Asset_man-agement#Information_protection |
#Protection |
|
5.15 |
Access
control |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Identity_and_
access_man- agement |
#Protection |
|
5.16 |
Identity
man-agement |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Identity_and_
access_man- agement |
#Protection |
|
5.17 |
Authentication
information |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Identity_and_
access_man- agement |
#Protection |
|
5.18 |
Access
rights |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Identity_and_
access_man- agement |
#Protection |
|
5.19 |
Information
security in supplier rela- tionships |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Supplier_re-
lationships_se- curity |
#Governance_
and_Ecosys- tem #Protec- tion |
|
5.20 |
Addressing
information security with- in supplier agreements |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Supplier_re-
lationships_se- curity |
#Governance_
and_Ecosys- tem #Protec- tion |
|
5.21 |
Managing
information security in the ICT supply chain |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Supplier_re-
lationships_se- curity |
#Governance_
and_Ecosys- tem #Protec- tion |
|
5.22 |
Monitor-
ing, review and change management of supplier services |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Supplier_re-
lationships_se- curity |
#Governance_
and_Ecosys- tem #Protec- tion #Defence#Information_ security_as- surance |
|
5.23 |
Information
security for use of cloud services |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Supplier_re-
lationships_se- curity |
#Governance_
and_Ecosys- tem #Protec- tion |
|
5.24 |
Information
security inci- dent manage- ment planning and prepara- tion |
#Corrective |
#Confidentiality
#Integrity #Availability |
#Respond
#Recover |
#Governance#Informa-tion_securi-ty_event_man-agement |
#Defence |
|
5.25 |
Assessment
and decision on informa- tion security events |
#Detective |
#Confidentiality
#Integrity #Availability |
#Detect
#Respond |
#Informa-
tion_securi- ty_event_man- agement |
#Defence |
|
5.26 |
Response to
information security inci- dents |
#Corrective |
#Confidentiality
#Integrity #Availability |
#Respond
#Recover |
#Informa-
tion_securi- ty_event_man- agement |
#Defence |
|
5.27 |
Learning
from information security inci- dents |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify
#Protect |
#Informa-
tion_securi- ty_event_man- agement |
#Defence |
|
5.28 |
Collection
of evidence |
#Corrective |
#Confidentiality
#Integrity #Availability |
#Detect
#Respond |
#Informa-
tion_securi- ty_event_man- agement |
#Defence |
|
5.29 |
Information
security dur- ing disruption |
#Preventive
#Corrective |
#Confidentiality
#Integrity #Availability |
#Protect
#Respond |
#Continuity |
#Protection#Resilience |
|
5.30 |
ICT
readiness for business continuity |
#Corrective |
#Availability |
#Respond |
#Continuity |
#Resilience |
|
5.31 |
Legal,
statuto- ry, regulatory and contrac- tual require- ments |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Legal_and_compliance |
#Governance_
and_Ecosys- tem #Protec- tion |
|
5.32 |
Intellectual
property rights |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Legal_and_compliance |
#Governance_
and_Ecosys- tem |
|
5.33 |
Protection
of records |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify
#Protect |
#Legal_and_compliance#Asset_man-agement#Information_protection |
#Defence |
|
5.34 |
Privacy and
protection of PII |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify
#Protect |
#Information_protection#Legal_and_compliance |
#Protection |
|
5.35 |
Independent
review of information security |
#Preventive
#Corrective |
#Confidentiality
#Integrity #Availability |
#Identify
#Protect |
#Information_
security_as- surance |
#Governance_
and_Ecosys- tem |
|
5.36 |
Compliance
with policies, rules and standards for information security |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify
#Protect |
#Legal_and_compliance#Information_security_as-surance |
#Governance_
and_Ecosys- tem |
|
5.37 |
Documented
operating procedures |
#Preventive
#Corrective |
#Confidentiality
#Integrity #Availability |
#Protect
#Recover |
#Asset_man-agement#Physi-cal_security#System_and_network_secu-rity
#Applica-tion_security#Secure_con-figuration#Identity_and_access_management#Threat_and_vulnerability_management#Continuity#Informa-tion_securi-ty_event_man-agement |
#Governance_
and_Ecosys- tem #Protec- tion #Defence |
|
6.1 |
Screening |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Human_re-
source_secu- rity |
#Governance_
and_Ecosys- tem |
|
6.2 |
Terms and
conditions of employment |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Human_re-
source_secu- rity |
#Governance_
and_Ecosys- tem |
|
6.3 |
Information
security awareness, education and training |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Human_re-
source_secu- rity |
#Governance_
and_Ecosys- tem |
|
6.4 |
Disciplinary process |
#Preventive
#Corrective |
#Confidentiality
#Integrity #Availability |
#Protect
#Respond |
#Human_re-
source_secu- rity |
#Governance_
and_Ecosys- tem |
|
6.5 |
Responsi-
bilities after termination or change of employment |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Human_re-
source_secu- rity #Asset_ management |
#Governance_
and_Ecosys- tem |
|
6.6 |
Confidentiality
or non-disclosure agreements |
#Preventive |
#Confidenti-ality |
#Protect |
#Human_re-
source_secu- rity #Infor- mation_pro- tection#Supplier_re-lationships |
#Governance_
and_Ecosys- tem |
|
6.7 |
Remote working |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Asset_man-agement#Information_protection#Physical_se-curity
#Sys-tem_and_net-work_security |
#Protection |
|
6.8 |
Information
security event reporting |
#Detective |
#Confidentiality
#Integrity #Availability |
#Detect |
#Informa-
tion_securi- ty_event_man- agement |
#Defence |
|
7.1 |
Physical
security perimeters |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Physical_se-curity |
#Protection |
|
7.2 |
Physical
entry |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Physical_se-
curity #Iden- tity_and_Ac- cess_Manage- ment |
#Protection |
|
7.3 |
Securing
offices, rooms and facilities |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Physical_se-
curity #Asset_ management |
#Protection |
|
7.4 |
Physical
security monitoring |
#Preventive
#Detective |
#Confidentiality
#Integrity #Availability |
#Protect
#Detect |
#Physical_se-curity |
#Protection#Defence |
|
7.5 |
Protect-ing
againstphysical andenvironmentalthreats |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Physical_se-curity |
#Protection |
|
7.6 |
Working
insecure areas |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Physical_se-curity |
#Protection |
|
7.7 |
Clear desk
and clear screen |
#Preventive |
#Confidenti-ality |
#Protect |
#Physical_se-curity |
#Protection |
|
7.8 |
Equipment
siting and protection |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Physical_se-
curity #Asset_ management |
#Protection |
|
7.9 |
Security of
as- sets off-prem- ises |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Physical_se-
curity #Asset_ management |
#Protection |
|
7.10 |
Storage
media |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Physical_se-
curity #Asset_ management |
#Protection |
|
7.11 |
Supporting
utilities |
#Preventive
#Detective |
#Integrity
#Availability |
#Protect
#Detect |
#Physical_se-curity |
#Protection |
|
7.12 |
Cabling
secu-rity |
#Preventive |
#Confidentiality
#Availability |
#Protect |
#Physical_se-curity |
#Protection |
|
7.13 |
Equipment
maintenance |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Physical_se-
curity #Asset_ management |
#Protection#Resilience |
|
7.14 |
Secure
dispos- al or re-use of equipment |
#Preventive |
#Confidenti-ality |
#Protect |
#Physical_se-
curity #Asset_ management |
#Protection |
|
8.1 |
User
endpoint devices |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Asset_man-agement#Information_protection |
#Protection |
|
8.2 |
Privileged
access rights |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Identity_and_
access_man- agement |
#Protection |
|
8.3 |
Information
access restric- tion |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Identity_and_
access_man- agement |
#Protection |
|
8.4 |
Access to
source code |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Identity_
and_access_ management#Applica-tion_security#Secure_con-figuration |
#Protection |
|
8.5 |
Secure
authen-tication |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Identity_and_
access_man- agement |
#Protection |
|
8.6 |
Capacity
man-agement |
#Preventive
#Detective |
#Integrity
#Availability |
#Identify
#Protect #Detect |
#Continuity |
#Governance_
and_Ecosys- tem #Protec- tion |
|
8.7 |
Protection
against mal- ware |
#Preventive
#Detective #Corrective |
#Confidentiality
#Integrity #Availability |
#Protect
#Detect |
#System_and_
network_secu- rity #Informa- tion_protec- tion |
#Protection#Defence |
|
8.8 |
Management
of technical vulnerabilities |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify
#Protect |
#Threat_and_
vulnerability_ management |
#Governance_
and_Ecosys- tem #Protec- tion #Defence |
|
8.9 |
Configuration
management |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Secure_con-figuration |
#Protection |
|
8.10 |
Informationdeletion |
#Preventive |
#Confidenti-ality |
#Protect |
#Information_protection#Legal_and_compliance |
#Protection |
|
8.11 |
Data masking |
#Preventive |
#Confidenti-ality |
#Protect |
#Information_protection |
#Protection |
|
8.12 |
Data
leakageprevention |
#Preventive
#Detective |
#Confidenti-ality |
#Protect
#Detect |
#Information_protection |
#Protection#Defence |
|
8.13 |
Information
backup |
#Corrective |
#Integrity
#Availability |
#Recover |
#Continuity |
#Protection |
|
8.14 |
Redundancyof
informationprocessingfacilities |
#Preventive |
#Availability |
#Protect |
#Continuity#Asset_man-agement |
#Protection#Resilience |
|
8.15 |
Logging |
#Detective |
#Confidentiality
#Integrity #Availability |
#Detect |
#Informa-
tion_securi- ty_event_man- agement |
#Protection#Defence |
|
8.16 |
Monitoring
activities |
#Detective
#Corrective |
#Confidentiality
#Integrity #Availability |
#Detect
#Respond |
#Informa-
tion_securi- ty_event_man- agement |
#Defence |
|
8.17 |
Clock
synchro-nization |
#Detective |
#Integrity |
#Protect
#Detect |
#Informa-
tion_securi- ty_event_man- agement |
#Protection#Defence |
|
8.18 |
Use of
privi- leged utility programs |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#System_and_
network_secu- rity #Secure_ configuration#Application_security |
#Protection |
|
8.19 |
Installation
of software on operational systems |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Secure_con-figuration#Application_security |
#Protection |
|
8.20 |
Networkssecurity |
#Preventive
#Detective |
#Confidentiality
#Integrity #Availability |
#Protect
#Detect |
#System_and_
network_secu- rity |
#Protection |
|
8.21 |
Security of
network ser- vices |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#System_and_
network_secu- rity |
#Protection |
|
8.22 |
Segregation
ofnetworks |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#System_and_
network_secu- rity |
#Protection |
|
8.23 |
Web
filtering |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#System_and_
network_secu- rity |
#Protection |
|
8.24 |
Use of
cryp-tography |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Secure_con-figuration |
#Protection |
|
8.25 |
Secure
devel- opment life cycle |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Applica-tion_security#System_and_network_secu-rity |
#Protection |
|
8.26 |
Application
security re- quirements |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Applica-tion_security#System_and_network_secu-rity |
#Protection#Defence |
|
8.27 |
Secure
system architecture and engineer- ing principles |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Applica-tion_security#System_and_network_secu-rity |
#Protection |
|
8.28 |
Secure
coding |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Applica-tion_security#System_and_network_secu-rity |
#Protection |
|
8.29 |
Security
testing in de- velopment and acceptance |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Identify |
#Applica-tion_security#Informa-tion_securi-ty_assurance#System_and_network_secu-rity |
#Protection |
|
8.30 |
Outsourced
development |
#Preventive
#Detective |
#Confidentiality
#Integrity #Availability |
#Identify
#Protect #Detect |
#System_and_
network_secu- rity #Applica- tion_security#Supplier_re- lationships_se-
curity |
#Governance_
and_Ecosys- tem #Protec- tion |
|
8.31 |
Separation
of develop- ment, test and production environments |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Applica-tion_security#System_and_network_secu-rity |
#Protection |
|
8.32 |
Change
man-agement |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#Applica-tion_security#System_and_network_secu-rity |
#Protection |
|
8.33 |
Test
informa- tion |
#Preventive |
#Confidentiality
#Integrity |
#Protect |
#Information_protection |
#Protection |
|
8.34 |
Protection
of informa- tion systems during audit testing |
#Preventive |
#Confidentiality
#Integrity #Availability |
#Protect |
#System_and_
network_secu- rity #Informa- tion_protec- tion |
#Governance_
and_Ecosys- tem #Protec- tion |
Matrix Group under Common Terminologies:
|
Category |
Related Controls |
Description |
|
1. Information Security Governance and Policies |
5.01, 5.02, 5.03, 5.04, 5.35, 5.36 |
Policies, roles, and responsibilities for maintaining
information security. Governance and compliance reviews. |
|
2. Information Asset Management |
5.09, 5.10, 5.11, 5.12, 5.13, 8.10, 8.11, 5.33 |
Managing information assets, asset inventory,
classification, and labelling. Asset disposal and protection
of records. |
|
3. Access Control and Identity Management |
5.15, 5.16, 5.17, 5.18, 8.02, 8.03, 8.05 |
Managing access rights, identity verification, and secure
authentication. Controlling access to sensitive
information. |
|
4. Supplier and External Party Management |
5.19, 5.20, 5.21, 5.22, 8.30 |
Ensuring information security in relationships with
suppliers and service providers. Managing risks in the
supply chain. |
|
5. Incident Management and Response |
5.24, 5.25, 5.26, 5.27, 5.28, 6.08 |
Incident response planning, handling security incidents,
learning from them, and managing evidence collection. |
|
6. Business Continuity and Resilience |
5.29, 5.30, 8.13, 8.14 |
Ensuring business continuity during disruptions. Backup and
redundancy of information processing. |
|
7. Compliance and Legal Obligations |
5.31, 5.32, 5.34 |
Compliance with legal, regulatory, and contractual
requirements. Protection of personal and intellectual
property information. |
|
8. Physical and Environmental Security |
7.01, 7.02, 7.03, 7.04, 7.05, 7.06, 7.07, 7.08, 7.09, 7.10,
7.11, 7.12, 7.13, 7.14 |
Securing the physical environment, facilities, equipment,
and utility support. Protection from physical and
environmental threats. |
|
9. User and Employment Security |
6.01, 6.02, 6.03, 6.04, 6.05, 6.06, 6.07 |
Ensuring employee-related information security, including
screening, training, and responsibilities during and after
employment. |
|
10. System and Network Security |
8.07, 8.08, 8.09, 8.06, 8.18, 8.19, 8.20, 8.21, 8.22,
8.23 |
Securing systems, networks, and applications from malware,
vulnerabilities, and other threats. Network segregation,
configuration, and software installation controls. |
|
11. Logging and Monitoring |
8.15, 8.16, 8.17 |
Monitoring and logging activities, including clock
synchronization to ensure accurate logs. |
|
12. Cryptography and Data Protection |
8.24, 8.12 |
Encryption and cryptography use, as well as protection
against data leakage. |
|
13. Secure Development and Testing |
8.04, 8.25, 8.26, 8.27, 8.28, 8.29, 8.31, 8.33 |
Security in development, testing, and coding. Separation of
environments and secure application lifecycle
management. |
|
14. Change and Audit Management |
8.32, 8.34 |
Change management and protecting systems during audits.
Ensuring smooth transitions and minimal risk during
audits. |
|
15. Threat Intelligence and External Relations |
5.07, 5.05, 5.06 |
Monitoring and addressing external threats, including
contacts with authorities and interest groups. |
|
16. Cloud Security |
5.23 |
Managing security related to the use of cloud services. |
Cyber Essentials
The Five Controls
- Firewalls
- Secure Configuration
- Security Update Management
- User Access Control
- Malware Protection
Firewalls
- using strong passwords
- enabling your firewall
- securing your router
Secure Configuration
- Remove or disable unused software
- Device locking
- Disable auto-play and autorun
- Correctly configure open ports
- Remote Desktop Protocol-port 3389
Security Update Management
- All software must be supported with regular security updates
- Operating System (OS)
- Firmware (in firewalls and routers)
- Web browser and extensions
- All applications
- Antivirus
- Hypervisors
- Unsupported / legacy/ end of life software
- Vulnerability fixes
- Described as 'critical' or 'high risk'
- All critical and high risk updates or updates with no details provided must be installed within 14 days of release by the vendor
User Access Control
- Separate accounts for each user with no shared accounts
- An administrator
- A regular user
- Delete accounts that are not used
- Account creation and tracking processes
- Strong unique passwords
- One password for one account
- Password policy
- Turn on multi-factor authentication
Malware Protection
- Malware is continually evolving so make sure your malware protection software is set up and configured in line with the vendors best practice.
- Malware signature detection
- Heuristic detection
- Protect mobile devices
Lead Implementer Training ISO 27001
DAY 01:
Training will be 4 days and what will take away from this Training.
- How to create and implement the Information System Management within the organization.
- Discuss on the Framework based on the ISO 27001
- Three pillars: Confidentiality, Integrity and Availability
Two words on Knowledge and Skill.
Learning Objectives
Information Security management
What is Information Security management?
- Three pillars: Confidentiality, Integrity and Availability [CIA]
Non- Repudiation:
- Means cannot be challenged by anybody.
Integrity: of information:
Means unaltered information. Information cannot be changed in-between end to end.
Information processing facility:
- Also need to secure the in-between facility which is processing the information.
Business Continuity:
- Business Continuity to some extent will be part of the,
- Information Security Management system And there will be separate Business continuity and Disaster management.
Life cycle of information:
- How the information should be discarded.
Other Benefits Information Security Management [ISM]
- Reduce Security incidents, increase staff retention, Protection of brand and reputation, reduce costs of correction, customer retention, etc
Activity 2
Why is Information security management important within the organization?
- To protect user’s data
- To comply with Government Norms
- To have control over the data management
Some information Security facts
- Stats:
- 83% of org see damages to the org reputation as the biggest concern
- 93% - had staff related breaches.
- 51.6% - reduced security incidents from certified org
- 49% - lack of budget to improve Info security
- 15% - of small business detected breach
Activity 3
- What Needs to be managed in a Information Security Management system?
- Data, Physical assets, People Assets, etc
Background of ISO 27001 / ISO 27002
- Framework: Sets of Principle, policy’s, rules, guidelines make a whole framework.
Who was Involved in its development?
- ISO International Organization for Standardization
- IEC International Electrotechnical Commission
History of ISO 27001 and ISO 27002
- BSI started in 1901, wanted to start Tube railways and floated in tender. The big problem was getting 5 different plans which had different dimensions. This created the problem that they are not compatible within each other.
- BS7799 :1995: - British standards published in 1995
- 2005: ISO re- nomenclature and published the 27001 by getting from BS.
Difference b/w to 27001 and 27002:
- 27001: What has to be done.
- 27002: How it has to be done: - Implementation guideline:
ISO 27001: 2013
4: Context of the organization
- What are: - Internal Issue, External issue and Interested parties?
- Interested parties: Promoters or Shareholders, Employees, Government, neighbours, customers, vendors, etc.
- Internal issue: When there are internal strikes.
- External issue: Government regulatory compliance
- Here boundaries are set for the rules and boundaries.
- e.g.: in India security guards will be present to collect the ID proof and registry entry is made. The same company operating in JAPAN has no security guard. Since there is no practice of security guards in JAPAN.
PDCA and ISMS:
- Plan : requirements: - Clause 4 Context of the org. / 5 leadership / 6 Planning / 7 Support
- DO : implement: - Clause 8 Operation
- Check : Audits/ gaps/ managements review: - Clause 9 Performance evaluation
- Act : Results/ improvement: - Clause 10 Improvement
Requirements for Implementation of ISMS:
- comes from the interested parties, this will like defining the Scope and limits & boundaries.
Activity 5
Terms and Definitions
Legal, regulatory and contractual:
- Regulatory Body: - RBI is the regulatory Body, SEBI regulatory for Stock exchanges
- Legal: Requirements from the government
- Contract: requirements which are passed on by working with clients which are laid upon by the regulatory body.
Statutory and regulatory requirements:
- As an ISMS manager: just telling them to follow. Do not be a SME in Statutory field to implement ISMS. Show what are the list of Statutory and regulatory requirements you are adhered to.
- Captive environment:
- working under other organization: - Policies, regulation, contractual terms will be passed on to the vendor organization also.
4 Context of the organization
- 4.1 Understanding the organization and its context
- 4.2 Understanding the needs and expectations of interested parties
- 4.3 Determining the scope of the information security management system
- 4.4 Information security management system
Shall means mandatory
May means optional
5 Leadership
- Leadership and commitment
- Policy
- Organizational roles, responsibilities and authorities
Top management should create and provide resources,
Create security Policy, security objectives
Activity 7
Directions:
As directed by your tutor, consider clause 5 and in particular sub-clause 5.1 and identify
which leadership/commitment behaviours and competencies, with respect to information
security management, you would expect from the organization provided
****************************************************************
DAY 02:
6 Planning
- 6.1 Actions to address risks and opportunities
- 6.1.1 General
- 6.1.2 Information security risk assessment
- 6.1.3 Information security risk treatment
- 6.2 Information security objectives and planning to achieve them
Notes:
Step 1: Try to identify Information asset
- Terms:
- Vulnerability, probability, Risk Assessment, Risk Treatment Plan, Risk Rating, Security Control, Statement of applicability.
- Information assert: Try to identify Information assert
- Try to quantify the asset, which are high value and low value.
- Quantify based on CIA
- E.g., Rate the asset based on the scale 1, 2 & 3 to create asset value.
- E.g., Formula for asset value; like: C + I + A = asset value
- E.g., Confidentiality: when assert is public scale is 1
Step 2: Risk identification/ analysis
- Risk rating associated with the assert value
- Probability with risk rating
- How the Vulnerability is the probability increases.
- For every risk there can be any opportunity.
Step 3: Risk Treatment Plan [RTP]
- Risk Avoid or termination, Risk Accept, Risk Share or transfer
- Risk Transfer:
- E.g., Cell phone tower: where there will be backup generators -the diesel will be stolen or wastage. They transferred to vendors to look into the DC backups.
- Risk Treatment:
- Lowering the risk / means reducing the Vulnerability
- Threat and Vulnerability
- Threat: earthquakes are threat; hackers are threat
- Vulnerability are gaps in the system, through which problem can arise.
- Residual risk:
- Left over risk and risk owner must be identified for residual risk
- ISMS Manager: Risk treatment
- When Mitigation plan is implemented and lowering the risk probability
- Risk owner is equal to asset owner
- RTP: have to lower the risk from higher risk
How Risk Treatment Plan is done using the Controls found in the Annexe A
A.5 Information security policiesA.6 Organization of information security
A.7 Human resource security
A.8 Asset management
A.9 Access control
A.10 Cryptography
A.11 Physical and environmental security
A.12 Operations security
A.13 Communications security
A.14 System acquisition, development and maintenance
A.15 Supplier relationships
A.16 Information security incident management
A.17 Information security aspects of business continuity management
A.18 Compliance
Annex A 2013 has: -
35 security categories
114 controls
6.2 Information security objectives and planning to achieve
them
Objective means: to achieve the target or
goals
Objective should be Measurable or quantitative and
Monitored year on year basis
E.g., Objective
- Zero security data breach
- 100 % compliance to infosec audit
- As per policy all the employees will change the
- password every 90 days
- 100% of pen-testing to happen for all the projects in
- every quarter.
- 98% of awareness of Infosec training has to be completed by the vendors
Clause 7 Support
Top management will provide the support.
7.2 Competence By three ways: Education arranging training and Experience
7.3 Awareness
Senior management has to create awareness about Information security among the employees.
7.4 Communication
7.5 Documented information
Clause 8 Operation
Clause 8 is also the DO part from PDCA
8.1 Operational planning and control
8.2 Information security risk assessment
8.3 Information security risk treatment
Activity 6
Problem Statement:
Internal Issues:
Directions, Part 1:
Points Discussed:
Interested parties:
Customer
Top management
Employees
Internal Issues: -
Down time of the service should not exceed less than 1HR.
RISK:
Customer satisfaction going down
Financial loss
Appropriate access control to be provided for intended parties
Confidentiality of the data not maintained.
Awareness of ISMS policy should not reduce less 95%.
RISK:
Not meeting the STD requirement of ISO 27001
Reducing in Bandwidth of internet will impact services.
RISK:
Availability of hosted services is impacted
External Issues: -
Zero security breaches in the Cloud Framework.
Adherence to Government norms for protecting data.
Clause 9 Performance evaluation
9.1 Monitoring, measurement, analysis and evaluation
9.2 Internal audit
9.3 Management review
Here Monitoring and measurement is done.
The Objectives which are identified earlier will be monitored and measured.
These audits internal and external are conducted
Documentation must be maintained
Internal Audit
Conformance and non – conformance
As an external auditor will look into the internal NC’s are reported and closed.
Clause 10 Improvement
10.1 Nonconformity and corrective action
10.2 Continual improvement
Read the standards 27001 and 27002
Remaining activities to be completed
Annexure A has to be read.
A.5 Information security policies
A.5.1 Management direction for information security
A.5.1.1 Policies for information security
A.5.1.2 Review of the policies for information security
A.6 Organization of information security
A.6.1 Internal organization
A.6.1.1 Information security roles and responsibilities
A.6.1.2 Segregation of duties
A.6.1.3 Contact with authorities
A.6.1.4 Contact with special interest groups
A.6.1.5 Information security in project management
A.6.2 Mobile devices and teleworking
A.6.2.1 Mobile device policy
A.6.2.2 Teleworking
A.7 Human resource security
A.7.1 Prior to employment
A.7.1.1 Screening
A.7.1.2 Terms and conditions of employment
A.7.2 During employment
A.7.2.1 Management responsibilities
A.7.2.2 Information security awareness, education and training
A.7.2.3 Disciplinary process
A.7.3 Termination and change of employment
A.7.3.1 Termination or change of employment responsibilities
A.8 Asset management
A.8.1 Responsibility for assets
A.8.1.1 Inventory of assets
A.8.1.2 Ownership of assets
A.8.1.3 Acceptable use of assets
A.8.1.4 Return of assets
A.8.2 Information classification
A.8.2.1 Classification of information
*******************************************************************************
Day 03:
Activity 14:
Implementing a Management System:
Stage 1: Where we are
Gap analysis:
Top management interest
Understanding requirements. Legal and guidance.
Baseline review, Gantt chart & resource requirements
Approve & communicate implement plan
information related to Information Security management has to be made aware by making them take exams.
Baseline for competence:
Baseline is 30% must be implementer and rest 70% should be aware of ISMS
It is a Microsoft Project Plan and WBS.
E.g., for a bank one ISMS Manager would be recruited.
Stage 2: Implement & Operate
Fill in the gaps:
Implement and operate the plan
Any Improvement from filling the gap
Refer to the page 73 from the file [02 slide*.PDF]
Baseline creation / Review:
Identify the minimum document requirements
Baseline Gap analysis
Process: is the key for the organization to last for centuries
Activity 16: Holistic Implementation process
Plan : requirements: - Clause 4 Context of the org. / 5 leadership / 6 Planning / 7 Support
DO : implement: - Clause 8 Operation
Check : Audits/ gaps/ managements review: - Clause 9 Performance evaluation
Act : Results/ improvement: - Clause 10 Improvement
Documented Information
Required documented information
Control of documentation information
Activity 17:
Exercises Activity 18: home work
Activity 19: Create Gantt Chart
Create a Excel and do the Gantt chart
Define the scope: Decide of the organization
Call Centre: 50 to 100 people will be working, for Airtel, dealing with customers of the Airtel
Telecom Company: SIM CARD
Department:
It Network Department, HR Department, Telecom regulatory, Physical Scope, Centre situated, Staff,
Core Business activities:
In bound: answering the question from the custom
Call centre 24/7
Scope:
Type of activities: InboundLocations: Pune, Chennai
Departments: It Network Department, HR Department, Telecom regulatory, Physical Scope, Centre situated, Staff,
Services: voice calls, SIM card delivery
Requirement from Leadership and Commitment
Infosec Policy and objectives
Integration of Infosec
Resources needed
Direction and supporting
Continual improvements.
Investment
Resources
Infrastructure
Defining and roles the responsibilities
Policy:
Will show the intention of the organization and will be the driving force.
Leadership
Roles, Responsibility and authorities: for an ISMS Manager
Matrix
Information Security – Risk Assessment Process
CIA on information assets
Risk criteria 🡪 Risk acceptance Criteria/ Criteria for performing
Risk Identification
Asset Register
Cause
Sources
Risk Assessment Tools
Controls:
Statement of applicability
Activity 26 / 27 / 28 / 29: home work
****************************************************************
Day 04:
Clause 07: Support
Awareness
Communications: Posters, Emails
Documented information
Documentation must be revisited every year, why?
Activity 30: Communication Process
What is the process? Certain input, to get desired output based on the certain steps
Who to communicate, when to, who shall, on what to…?
Process should have:
Input:
Steps:
Output:
Clause 08: Operation
Risk treatment Plan:
Clause 09: Performance Evaluation
Security Incidents
Internal Audits
Consistency results
Monitoring
Measuring
Effectiveness of ISMS
Evaluation
Internal Audit
External Audit
Activity 31: Monitoring and measurement
Weekly check on Latest Windows Security patches whether installed in all the machines?
DRBC Plan is conducted every 6 months
Performance Evaluation
Internal AuditManagement Review
Audit Process:
Gap Analysis is also a type of Audit
Inputs 🡪 Audit activity 🡪Outputs
Three Things about Audit
Intent: means expectation
Implementation
Effectiveness
Positive Findings means Conformance.
Negative Findings means Non-Conformance.
As an Auditor you are not there to give any suggestions or do consulting
Activity 33: Creating checklist
Also called as Aide Memory
Has Security been employed?
Scope: Physical Security
Activity 34: Conducting an audit
Leadership = guidance’s [leadership are Born]
Management = controls [Mangers are created]
Change management
Kotter’s 8 Steps to successful change.
Example:
Controls are required to reduce the RISK.
****************************************************************
Day 05:
Revision
Why ISMS?
Improved security for the organization and its clientsIncrease in the quality of information security processes and procedures
PDCA: Matrix
Clause 4: Context of Org
Clause 6: Planning
A risk assessment process should then be defined that identifies risks associated with the
loss of confidentiality, integrity and availability for information within the scope of the ISMS,
analyses the risks and then evaluates them
Clause 7: Support
Leadership will provide the support
Clause 8: Operation
Info sec Risk Assessment
Info sec Risk Treatment
Statement of Applicability: 114 Controls are present. When the controls are not applied, then the reason will be provided.
Clause 9: Performance evaluation
Internal Audits
Management Review
Clause 10: Improvement
Non-Conformity and corrective action
Continual Improvement
Implementation: of ISMS -
Determine the Need for Documentation
Baseline Gap Analysis
Project Plan: Gannt Chart
Scope of ISMS
Leadership Commitments and Roles, responsibility & Authorities.
PDCA Diagram
Risk Identification:
Reduce/ Treat
Avoid/ Terminate
Accept/ Tolerate
Transfer/ share
Audit:
Intent
implement
Effectiveness
Non conformity reports
Management Review
Change Management
Comments
Post a Comment