Chapter 12 iso 27001 awareness
- 1. Chapter 12 ISO 27001: Awareness 1 Information System Security Jupriyadi, S.Kom. M.T. jupriyadi@teknokrat.ac.id Bandarlampung, Agustus 2021
- 2. Agenda What is information? What is information security? What is risk? Introduction to the ISO standards Managing information security Your security responsibilities
- 3. Information Information is an asset which, like other important business assets, has value to an organization and consequently needs to be suitably protected
- 4. Information Types Information exists in many forms: Printed or written on paper Stored electronically Transmitted by post or electronic means Visual e.g. videos, diagrams Published on the Web Verbal/aural e.g. conversations, phone calls Intangible e.g. knowledge, experience, expertise, ideas ‘Whatever form the information takes, or means by which it is shared or stored, it should always be appropriately protected’
- 5. Information Lifecycle Created Owned (it is an asset) Stored Processed Transmitted/communicated Used (for proper or improper purposes) Modified or corrupted Shared or disclosed (whether appropriately or not) Destroyed or lost Stolen Controlled, secured and protected throughout its existence Information can be …
- 6. Key Term Information security is what keeps valuable information ‘free of danger’ (protected, safe from harm) It is not something you buy, it is something you do o It’s a process not a product It is achieved using a combination of suitable strategies and approaches: o Determining the risks to information and treating them accordingly (proactive risk management) o Protecting CIA (Confidentiality, Integrity and Availability) o Avoiding, preventing, detecting and recovering from incidents o Securing people, processes and technology … not just IT! What is information security?
- 7. Security Elements PEOPLE Staff and Management PROCESSES Business Activities TECHNOLOGY IT, Phones, USB sticks
- 8. People People who use or have an interest in our information security include: Shareholders / owners Management & staff Customers / clients, suppliers & business partners Service providers, consultants & advisors Authorities, regulators & judges Our biggest threats arise from people (social engineers, unethical competitors, hackers, fraudsters, careless workers, bugs, flaws …), yet our biggest asset is our people (e.g. security-aware employees who spot trouble early)
- 9. Processes Processes are work practices or workflows, the steps or activities needed to accomplish business objectives. • Processes are described in procedures. • Virtually all business processes involve and/or depend on information making information a critical business asset. Information security policies and procedures define how we secure information appropriately and repeatedly.
- 10. Technology Information technologies Cabling, data/voice networks and equipment Telecommunications services (PABX, VoIP, ISDN, videoconferencing) Phones, cellphones, PDAs Computer servers, desktops and associated data storage devices (disks, tapes) Operating system and application software Paperwork, files Pens, ink Security technologies Locks, barriers, card-access systems, CCTV
- 11. Value • Protects information against various threats • Ensures business continuity • Minimizes financial losses and other impacts • Optimizes return on investments • Creates opportunities to do business safely • Maintains privacy and compliance Information security is valuable because it … We all depend on information security
- 12. C I A Information security is defined as the preservation of: Confidentiality Making information accessible only to those authorized to use it Integrity Safeguarding the accuracy and completeness of information and processing methods Availability Ensuring that information is available when required
- 13. Impacts • IT downtime, business interruption • Financial losses and costs • Devaluation of intellectual property • Breaking laws and regulations, leading to prosecutions, fines and penalties • Reputation and brand damage leading to loss of customer, market, business partner or owners’ confidence and lost business • Fear, uncertainty and doubt Security Incidents Cause….
- 14. Key Term Risk is the possibility that a threat exploits a vulnerability in an information asset, leading to an adverse impact on the organization What is Risk? Threat: something that might cause harm Vulnerability: a weakness that might be exploited Impact: financial damage etc.
- 15. Threat Agent The ‘actor’ that represents, carries out or catalyzes the threat • Human • Machine • Nature
- 16. Threat Types Threat type Example Human error Typo, wrong attachment/email address, lost laptop or phone Intellectual property Piracy, industrial espionage Deliberate act Unauthorized access/trespass, data theft, extortion, blackmail, sabotage, vandalism, terrorist/activist/criminal activity Fraud Identity theft, expenses fraud System/network attack Viruses, worms, Trojans, hacks Service issue Power cuts, network outages Force of nature Fire, flood, storm, earthquake, lightning, tsunami, volcanic eruption Hardware issue Computer power supply failure, lack of capacity Software issue Bugs or design flaws, data corruption Obsolescence Windows XP Operating System?
- 17. So how do we secure our information assets?
- 18. ISO 27001 1990’s • Information Security Management Code of Practice produced by a UK government- sponsored working group • Based on the security policy used by Shell • Became British Standard BS7799 2000’s • Adopted by ISO/IEC • Became ISO/IEC 17799 (later renumbered ISO/IEC 27002) • ISO/IEC 27001 published & certification scheme started Now • Expanding into a suite of information security standards (known as “ISO27k”) • Updated and reissued every few years • Current standard is known as ISO 27001:2018 History of ISO27001
- 19. • Concerns the management of information security, not just IT/technical security • Formally specifies a management system • Uses Plan, Do, Check, Act (PDCA) to achieve, maintain and improve alignment of security with risks • Covers all types of organizations (e.g. commercial companies, government agencies, not-for-profit organizations) and all sizes • Thousands of organizations worldwide have been certified compliant ISO 27001
- 20. Plan Do Check Act (PDCA)
- 21. Control Clauses
- 22. Control Clauses • Information security policy - management direction • Organization of information security - management framework for implementation • Asset management – assessment, classification and protection of valuable information assets • HR security – security for joiners, movers and leavers • Physical & environmental security - prevents unauthorised access, theft, compromise, damage to information and computing facilities, power cuts
- 23. Control Clauses • Communications & operations management - ensures the correct and secure operation of IT • Access control – restrict unauthorized access to information assets • Information systems acquisition, development & maintenance – build security into systems • Information security incident management – deal sensibly with security incidents that arise • Business continuity management – maintain essential business processes and restore any that fail • Compliance - avoid breaching laws, regulations, policies and other security obligations
- 25. • Demonstrable commitment to security by the organization • Legal and regulatory compliance • Better risk management • Commercial credibility, confidence, and assurance • Reduced costs • Clear employee direction and improved awareness Benefits
- 26. Key Documents • High level corporate security policy • Supporting policies e.g. physical & environmental, email, HR, incident management, compliance etc. • Standards e.g. Windows Security Standard • SOPs • Records e.g. security logs, security review reports, corrective actions
- 27. User Responsibilities • Read and follow security policies and procedures • Display identity cards while on the premises • Challenge or report anyone without an ID card • Visit the intranet Security Zone or call IT Help/Service Desk for advice on most information security matters • Allow unauthorized visitors onto the premises • Bring weapons, hazardous/combustible materials, recording devices etc., especially in secure areas • Use personal IT devices for work purposes, unless explicitly authorized by management Do Do Not
- 28. User Responsibilities Password Guidelines Use strong passwords as suggested in the password management policy. Change your password frequently. At least once every 3 months. Each successive password must be unique. Don’t use the same password again. Use short or easily-guessed passwords Write down passwords or store them in plain text Share passwords over phone or email
- 29. User Responsibilities Internet Usage Warning: Internet usage is routinely logged and monitored. Be careful which websites you visit and what you disclose. Avoid websites that would be classed as obscene, racist, offensive or illegal – anything that would be embarrassing Do not access online auction or shopping sites, except where authorized by your manager Don’t hack! Do not download or upload commercial software or other copyrighted material without the correct license and permission from your manager Use the corporate Internet facilities only for legitimate and authorized business purposes
- 30. User Responsibilities E-mail Usage Do not use your corporate email address for personal email Do not circulate chain letters, hoaxes, inappropriate jokes, videos etc. Do not send emails outside the organization unless you are authorized to do so Be very wary of email attachments and links, especially in unsolicited emails (most are virus-infected) Use corporate email for business purposes only Follow the email storage guidelines If you receive spam email, simply delete it. If it is offensive or you receive a lot, call the IT Help.
- 31. User Responsibilities Security Incidents Report information security incidents, concerns and near-misses to IT Email … Telephone … Anonymous drop-boxes … Take their advice on what to do Do not discuss security incidents with anyone outside the organisation Do not attempt to interfere with, obstruct or prevent anyone else from reporting incidents
- 32. User Responsibilities Ensure your PC is getting antivirus updates and patches Lock your keyboard (Windows L) before leaving your PC unattended, and shutdown your PC at the end of the day Store laptops and valuable information (paperwork as well as CDs, USB sticks etc.) securely under lock and key Keep your wits about you while traveling: Keep your voice down on the cellphone Be discreet about your IT equipment Take regular information back ups Fulfill your security obligations: Comply with security and privacy laws, copyright and licenses, Comply with corporate policies and procedures Stay up to date on information security:
- 34. 34