SlideShare a Scribd company logo

Information security management system

•Download as PPTX, PDF•
•
Arani Srinivasan
Arani Srinivasan

The document discusses information security management systems (ISMS) and the ISO 27001 standard. It provides an overview of ISMS, describing their role in systematically managing information security. It then outlines the key aspects of ISO 27001, including its 11 domains that cover information security areas like policies, asset management, access control, and compliance. The document emphasizes that ISO 27001 certification provides organizations benefits like increased credibility, assurance for partners and authorities, and a competitive advantage.

Related slideshows

ISMS Awareness Training (2) (1).pptx
ISMS Awareness Training (2) (1).pptxISMS Awareness Training (2) (1).pptx
ISMS Awareness Training (2) (1).pptx
 
1. Security and Risk Management
1. Security and Risk Management1. Security and Risk Management
1. Security and Risk Management
 
Information security management
Information security managementInformation security management
Information security management
 
1 of 30
S.Arani 1
Information Security Management System - Overview The Standard – ISO27001 ISO27001 – 11 Domains Real World… S.Arani 2 Agenda
Information Security Management System Overview S.Arani 3
Information Security Management System  Physical Information e.g. paper forms / configure docs/ proposals / project progress / user guides/ blue prints/ reports …  Electronic Information e.g. financial data (accounting system) student information (registry system) payroll information (HR system) … S.Arani 4 Information Security Management System
Information Security Management System Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. -Wiki- S.Arani 5 Information Security Management System
Information Security Management Systems Information Security Management Systems (ISMS) is a systematic and structured approach to managing information so that it remains secure. S.Arani 6 Information Security Management System
The core principles of information security  “Confidentiality” is keeping sensitive information protected.  “Integrity “ is keeping information intact and valid.  “Availability” is keeping information available and accessible. S.Arani 7 Information Security Management System
S.Arani 8 Why Manage Information Security??? IT Security Incidents Statistics
 Banks  Call centers  IT companies  Government & classified organizations  Manufacturing concerns  Hospitals  Insurance companies, etc. S.Arani 9 Who Needs ISMS (ISO 27001)?
 Provide a structured way of managing information security.  Provide an independent assessment.  Provide evidence and assurance.  Enhance information security governance.  Enhance the organization’s global positioning and reputation.  Increase the level of information security in the organization. S.Arani 10 Advantages if an organization is ISMS Certified
The Standard – ISO27001 S.Arani 11
S.Arani 12 1995 1998 1999 Dec 2000 2002 2005  BS 7799 Part 1  BS 7799 Part 2  New issue of BS 7799 Part 1 & 2  ISO 17799:2000  New BS 7799-2  New ISO 17799:2005 released  ISO 27001:2005 released ISO 27001 Evolution
S.Arani 13 ISO Member Countries
 ISO 27000 – principles and vocabulary  ISO 27001 – ISMS requirements  ISO 27002 – ISO/ IEC 17799:2005- Code of practice for ISMS (from 2007 onwards)  ISO 27003 – ISMS Implementation guidelines (due 2007)  ISO 27004 – ISMS Metrics and measurement (due 2007)  ISO 27005 – ISMS Risk Management  ISO 27006 – 27010 – allocation for future use S.Arani 14 The ISO27001 Series
 An internationally recognized structured methodology dedicated to information security.  A management process to evaluate, implement and maintain an Information Security Management System (ISMS).  A comprehensive set of controls comprised of best practices in information security.  Applicable to all industry sectors.  Emphasis on prevention  Not A technical standard  Not a Product or technology driven S.Arani 15 Overview of ISO 27001
S.Arani 16 ACT Maintain and improve framework − Implement the identified improvements − Preventive and Corrective Action − Communicate the results − Ensure the Improvements CHECK Monitor and review the ISMS − Monitoring Procedures − Regular Reviews − Internal ISMS Audit − Management Review DO Implement and operate the ISMS • Risk Treatment Plan • Operate Controls • Training & Awareness • Manage Operations PLAN Establish the ISMS • Scope • Policy • Risk Assessment (RA) • Risks • Control Objectives • Statement Of Applicability • Management Approval ISO 27001:2005 – PDCA
ISO27001 – 11 Domains S.Arani 17
S.Arani 18 Overall the standard can be put in : • Domain Areas – 11 • Control Objectives – 39 • Controls - 133 11 Domains of ISMS
 Security Policy  Security Policy document approved and communicated.  Regular review of the policy document.  Organization of Information Security  Clear direction and visible management Support.  Managed implementation of security controls.  Information security responsibilities defined. S.Arani 19 11 Domains (cont…)
 Asset Management  Information, software & physical asset inventory  Information Classification  Information handling Procedures  Human Resource Security  Employment Checks  Confidentiality/ non-disclosure agreements  Information Security training  Disciplinary process for security violation S.Arani 20 11 Domains (cont…)
 Physical and Environment Security  physical protection of premises/ facilities  protection against natural disasters  protection against communication interception  clear desk policy  Communication and Operations Management  Operating Procedures  Security requirements for contractors  Detection and prevention of malicious software  Data backup  Network, E-mail, portable media and disposal management proceduresS.Arani 21 11 Domains (cont…)
 Access Control  User registration/ deregistration process  Password controls  User access review  Remote access control  Audit Logging  Information System Acquisition, Development and maintenance  Data Validation  Message authentication  Cryptography management  Control Over testing Data  System change controls S.Arani 22 11 Domains (cont…)
 Information Security Incident Management  Incident prioritization & Classification  Channels for incident reporting  Incident escalation procedures  Contacts of regulatory bodies and law enforcement agencies  Business Continuity Management  Business Continuity framework  Established business continuity plans  Regular business continuity test S.Arani 23 11 Domains (cont…)
 Compliance  Define compliance requirements  Procedures implemented to comply with requirements(e.g. personal data/ privacy protection)  Regular Compliance checks S.Arani 24 11 Domains (cont…)
There are several reasons why an organization might seek this certification. Some of the key benefits include:  Increased credibility and trust  Improved partner, customer and stakeholder confidence  Organizational and trading partner assurance  Demonstration to competent authorities that the organization observes all applicable laws and regulations  Competitive advantage and market differentiation  Reduced regulation costs S.Arani 25 ISO 27001:2005
Without genuine support from the top – a failure Without proper implementation – a burden With full support, proper implementation and ongoing commitment – a major benefit S.Arani 26 ISO27001 can be…
Real World… S.Arani 27
S.Arani 28 Information Security Management System
S.Arani 29 Information Security Management System
Questions ??? S.Arani 30 Information Security Management System

More Related Content

Information security management system

  • 2. Information Security Management System - Overview The Standard – ISO27001 ISO27001 – 11 Domains Real World… S.Arani 2 Agenda
  • 4. Information Security Management System  Physical Information e.g. paper forms / configure docs/ proposals / project progress / user guides/ blue prints/ reports …  Electronic Information e.g. financial data (accounting system) student information (registry system) payroll information (HR system) … S.Arani 4 Information Security Management System
  • 5. Information Security Management System Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. -Wiki- S.Arani 5 Information Security Management System
  • 6. Information Security Management Systems Information Security Management Systems (ISMS) is a systematic and structured approach to managing information so that it remains secure. S.Arani 6 Information Security Management System
  • 7. The core principles of information security  “Confidentiality” is keeping sensitive information protected.  “Integrity “ is keeping information intact and valid.  “Availability” is keeping information available and accessible. S.Arani 7 Information Security Management System
  • 8. S.Arani 8 Why Manage Information Security??? IT Security Incidents Statistics
  • 9.  Banks  Call centers  IT companies  Government & classified organizations  Manufacturing concerns  Hospitals  Insurance companies, etc. S.Arani 9 Who Needs ISMS (ISO 27001)?
  • 10.  Provide a structured way of managing information security.  Provide an independent assessment.  Provide evidence and assurance.  Enhance information security governance.  Enhance the organization’s global positioning and reputation.  Increase the level of information security in the organization. S.Arani 10 Advantages if an organization is ISMS Certified
  • 11. The Standard – ISO27001 S.Arani 11
  • 12. S.Arani 12 1995 1998 1999 Dec 2000 2002 2005  BS 7799 Part 1  BS 7799 Part 2  New issue of BS 7799 Part 1 & 2  ISO 17799:2000  New BS 7799-2  New ISO 17799:2005 released  ISO 27001:2005 released ISO 27001 Evolution
  • 14.  ISO 27000 – principles and vocabulary  ISO 27001 – ISMS requirements  ISO 27002 – ISO/ IEC 17799:2005- Code of practice for ISMS (from 2007 onwards)  ISO 27003 – ISMS Implementation guidelines (due 2007)  ISO 27004 – ISMS Metrics and measurement (due 2007)  ISO 27005 – ISMS Risk Management  ISO 27006 – 27010 – allocation for future use S.Arani 14 The ISO27001 Series
  • 15.  An internationally recognized structured methodology dedicated to information security.  A management process to evaluate, implement and maintain an Information Security Management System (ISMS).  A comprehensive set of controls comprised of best practices in information security.  Applicable to all industry sectors.  Emphasis on prevention  Not A technical standard  Not a Product or technology driven S.Arani 15 Overview of ISO 27001
  • 16. S.Arani 16 ACT Maintain and improve framework − Implement the identified improvements − Preventive and Corrective Action − Communicate the results − Ensure the Improvements CHECK Monitor and review the ISMS − Monitoring Procedures − Regular Reviews − Internal ISMS Audit − Management Review DO Implement and operate the ISMS • Risk Treatment Plan • Operate Controls • Training & Awareness • Manage Operations PLAN Establish the ISMS • Scope • Policy • Risk Assessment (RA) • Risks • Control Objectives • Statement Of Applicability • Management Approval ISO 27001:2005 – PDCA
  • 17. ISO27001 – 11 Domains S.Arani 17
  • 18. S.Arani 18 Overall the standard can be put in : • Domain Areas – 11 • Control Objectives – 39 • Controls - 133 11 Domains of ISMS
  • 19.  Security Policy  Security Policy document approved and communicated.  Regular review of the policy document.  Organization of Information Security  Clear direction and visible management Support.  Managed implementation of security controls.  Information security responsibilities defined. S.Arani 19 11 Domains (cont…)
  • 20.  Asset Management  Information, software & physical asset inventory  Information Classification  Information handling Procedures  Human Resource Security  Employment Checks  Confidentiality/ non-disclosure agreements  Information Security training  Disciplinary process for security violation S.Arani 20 11 Domains (cont…)
  • 21.  Physical and Environment Security  physical protection of premises/ facilities  protection against natural disasters  protection against communication interception  clear desk policy  Communication and Operations Management  Operating Procedures  Security requirements for contractors  Detection and prevention of malicious software  Data backup  Network, E-mail, portable media and disposal management proceduresS.Arani 21 11 Domains (cont…)
  • 22.  Access Control  User registration/ deregistration process  Password controls  User access review  Remote access control  Audit Logging  Information System Acquisition, Development and maintenance  Data Validation  Message authentication  Cryptography management  Control Over testing Data  System change controls S.Arani 22 11 Domains (cont…)
  • 23.  Information Security Incident Management  Incident prioritization & Classification  Channels for incident reporting  Incident escalation procedures  Contacts of regulatory bodies and law enforcement agencies  Business Continuity Management  Business Continuity framework  Established business continuity plans  Regular business continuity test S.Arani 23 11 Domains (cont…)
  • 24.  Compliance  Define compliance requirements  Procedures implemented to comply with requirements(e.g. personal data/ privacy protection)  Regular Compliance checks S.Arani 24 11 Domains (cont…)
  • 25. There are several reasons why an organization might seek this certification. Some of the key benefits include:  Increased credibility and trust  Improved partner, customer and stakeholder confidence  Organizational and trading partner assurance  Demonstration to competent authorities that the organization observes all applicable laws and regulations  Competitive advantage and market differentiation  Reduced regulation costs S.Arani 25 ISO 27001:2005
  • 26. Without genuine support from the top – a failure Without proper implementation – a burden With full support, proper implementation and ongoing commitment – a major benefit S.Arani 26 ISO27001 can be…
  • 28. S.Arani 28 Information Security Management System
  • 29. S.Arani 29 Information Security Management System
  • 30. Questions ??? S.Arani 30 Information Security Management System

Editor's Notes

  1. “Information is an asset which, like otherimportant business assets, has value to anorganization and consequently needs to besuitably protected.” – ISO27001
  2. Information security exists to: “ensure adequate and proportionate security controls that adequately protect information assets and give confidence to customers and other interested parties. This can be transited into maintaining and improving competitive edge, cash flow, profitability, legal compliance and commercial edge.” - ISO 270001
  3. It is a Management processIt is not a technological processPart of the your company’s overall management systemBased on a business risk approachDesigned to establish, implement, operate, monitor, review, maintain and improve information securityEncompasses people, processes and IT systems
  4. Organizations and their information systems and networks are exposed withsecurity THREATS such as fraud, espionage, fire, flood and sabotage from a widerange of sources. The increasing number of security breaches has led toincreasing information security concerns among organizations worldwide.ACHIEVING INFORMATION SECURITY is a huge challenge for organization as itCANNOT BE ACHIEVED THROUGH TECHNOLOGICAL MEANS ALONE, and shouldnever be implemented in a way that is either out of line with the organization’sapproach to risk or which undermines or creates difficulties for its businessoperations.Thus there is a need to look at information security from a HOLISTIC PERSPECTIVE,and to have an information security management methodology to protectinformation systematically. This is where the need for ISMS comes in.
  5. Provide an independent assessment of an organization’s conformity to the best practices agreed by a community of experts for ISMS.Provide evidence and assurance that an organization has complied with the standards requirement.Enhance information security governance within the organization. Enhance the organization’s global positioning and reputation.Increase the level of information security in the organization.
  6. Elevation to international standard statusMore organizations are expected to adopt itClarifications and Improvements made by the International Organization for StandardizationDefinition alignment with other ISO standards(such as ISO/IEC 13335-1:2004 and ISO/IEC TR18044:2004)
  7. ISO, founded on February 23, 1947, promulgates worldwideproprietary industrial and commercial standards, hasheadquarters in Geneva, Switzerland It has 163 nationalmembers out of the 203 total countries in the worldThe international standard of ISO 27001 specifies therequirements for establishing, implementing, operating,monitoring, reviewing, maintaining and improving adocumented ISMS within an organization
  8. Information Security Policy: how an institution expressesits intent with emphasized to information security, meansby which an institution's governing body expresses itsintent to secure information, gives direction tomanagement and staff and informs the other stakeholdersof the primacy of efforts.Organization of Information Security: is a structureowned by an organization in implementing informationsecurity, consists of; management commitment toinformation security, information security co-ordination,authorization process for information processing facilities.Two major directions: internal organization, and externalparties.
  9. Asset Management: is based on the idea that it isimportant to identify, track, classify, and assign ownershipfor the most important assets to ensure they are adequatelyprotected.Human Resources Security: to ensure that all employees(including contractors and user of sensitive data) arequalified for and understand their roles and responsibilitiesof their job duties and that access is removed onceemployment is terminated.
  10. Physical and Environmental Security: to measures takento protect systems, buildings, and related supportinginfrastructure against threats associated with their physicalenvironment, buildings and rooms that house informationand information technology systems must be affordedappropriate protection to avoid damage or unauthorizedaccess to information and systems.Communications and Operations Management: definedpolicy on security in the organization, in reducing security risk and ensuring correct computing, including operationalprocedures, controls, and well-defined responsibilities.
  11. Access Control: is a system which enables an authority tocontrol access to areas and resources in a given physicalfacility or computer-based information system.Information System Acquisition, Development andMaintenance: an integrated process that definesboundaries and technical information systems, beginningwith the acquisition, and development and the last is themaintenance of information systems.
  12. Information Security Incident Management: is a programthat prepares for incidents. From a managementperspective, it involves identification of resources neededfor incident handling. Good incident management will alsohelp with the prevention of future incidents.Business Continuity Management: to ensure continuity ofoperations under abnormal conditions. Plans promote thereadiness of institutions for rapid recovery in the face ofadverse events or conditions, minimize the impact of suchcircumstances, and provide means to facilitate functioningduring and after emergencies.
  13. Compliance: these issues necessarily are divided into twoareas; the first area involves compliance with the myriadlaws, regulations or even contractual requirements whichare part of the fabric ofevery institution. The second area iscompliance with information security policies, standardsand processes.
  14. Chennai, May 26, 2009: Anantara Solutions, the pioneer of Second Generation Outsourcing (SGO), today announced that its Information Security Management System has been assessed and certified as per ISO 27001:2005 standards by TUV India Pvt Ltd, a member of TUV Nord Group, Germany.The entire corporation of KEL, which includes two affiliate companies, has undergone a screening conducted by a certification agency (Japan Management Association), and obtained the ISO/IEC 27001, an international standard for ISMS (information security management system), on June 21, 2006.TokyoThe Company has acquired ISMS (Information Security Management System) and ISO/ IEC 27001:2005 certifications as of March 7, 2012. The ISMS Certification was obtained through a conformance assessment conducted by the Japan Information Processing Development Corporation (JIPDEC), while the ISO/IEC certification was obtained through certification conducted by ANAB, a certification organization based in the United States of America. JapanMetalloinvest Management Company carried out recertification of its information security management system (ISMS) to comply with requirements of ISO/IEC 27001:2005 standard. The accredited auditor ZAO Bureau Veritas Certification Rus’ extended the term of certification of ISMS for Metalloinvest Management Company till November 2014.Rusia