Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 13 views

    Governance

    Uploaded by

    Mac Queen
    The document discusses information security governance and frameworks. It provides an overview of information security governance, including its importance and common frameworks such as ISO27001. It also discusses challenges to information security in Pakistan's context and provides recommendations for implementing governance through initial, intermediate and mature building blocks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Governance

    Uploaded by

    Mac Queen
    13 views16 pages
    The document discusses information security governance and frameworks. It provides an overview of information security governance, including its importance and common frameworks such as ISO27001. It also discusses challenges to information security in Pakistan's context and provides recommendations for implementing governance through initial, intermediate and mature building blocks.

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses information security governance and frameworks. It provides an overview of information security governance, including its importance and common frameworks such as ISO27001. It also discusses challenges to information security in Pakistan's context and provides recommendations for implementing governance through initial, intermediate and mature building blocks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    13 views16 pages

    Governance

    Uploaded by

    Mac Queen
    The document discusses information security governance and frameworks. It provides an overview of information security governance, including its importance and common frameworks such as ISO27001. It also discusses challenges to information security in Pakistan's context and provides recommendations for implementing governance through initial, intermediate and mature building blocks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 16

    Information Security

    Instructor:
    Syeda Mahnoor Gilani

    Department of Computer Science

    Air University - Aerospace & Aviation Campus, Kamra


    1
    Content
    • Governance
    • Information Security Governance
    • Importance of IS Governance
    • IS Governance Frameworks
    • ISO27001:2013 Framework
    • ISO27001:2013 Clauses 4to10
    • ISO27001:2013 Discretionary Controls
    • Pakistan’s Information Security Posture & Challenges
    • Typical IT Structure
    • Challenges
    • Information Security Governance Implementation
    Information Security Governance

    Security governance is the set of responsibilities and practices


    exercised by the board and executive management with the
    goal of providing strategic direction, ensuring that objectives
    are achieved, ascertaining that risks are managed
    appropriately and verifying that the enterprise’s resources are
    used responsibly.
    Information Security Governance

    IT Governance

    IT Service
    Information Business
    Management IT Project
    Security Continuity &
    & Performance Management
    Governance DR
    Management
    Information Security Governance- Frameworks
    • Multiple frameworks have been created to support the auditing of
    implemented security controls
    • These resources are valuable for assisting in the design of a security
    program, as they define the necessary controls for providing secure
    information systems

    •Following are the some frameworks:


    • Committee of Sponsoring Organizations of the Treadway
    Commission (COSO)
    • IT Infrastructure Library (ITIL)
    • Control Objectives for Information and Related Technology
    (COBIT)
    Information Security Governance- Frameworks
    • Leading Framework for Information Security Governance is
    ISO27001:2013 (ISMS)
    • Considered gold standard
    • Provides model for:
    • Establishing
    • Implementing
    • Operating
    • Monitoring
    • Reviewing
    • Maintain
    • And improving Information Security management system.
    ISO27001:2013- Clauses 4to10
    • 4: Organization & context, scope
    • 5: Leadership & commitment, policy, organizational roles &
    responsibilities
    • 6: Planning; Infosec objectives and planning to achieve them
    • 7: Support; resources, competence, awareness
    • 8: Operations; risk assessment and risk management
    • 9: Performance evaluation; monitoring, measurement & analysis;
    internal audit
    • 10: Non-conformities & corrective actions, continual improvement
    ISO27001:2013 Discretionary Controls
    Pakistan’s Information Security Posture &
    Challenges
    Typical IT Structure

    Infosec

    Audit
    IT Compliance

    Risk
    Challenges
    • IT is not aligned to perform diligent security work

    • Fundamental Security hardening of IT assets “in the trenches” is


    absent.

    • Lack of management commitments

    • Reactive to regulator/audit/compliance.

    • Silos and lack of security ownership


    Challenges

    •Pakistan is almost one entire technology generation behind


    in Information Security

    •Information Security Transformation Model is the only way


    to catch up.
    Information Security Governance Implementation
    Initial Governance Building Blocks

    Policy Responsibility

    Resource & Periodic


    Priority Review
    Information Security Governance Implementation

    Intermediate Governance Change


    Manageme
    Building Blocks nt

    Awareness Intermediate SOPs

    Monitoring
    Information Security Governance Implementation
    Mature Governance Building Blocks

    Risk Internal Incident


    Management Audit Management
    Questions?
    • How do you achieve Governance?

    • When do you know you have achieved it?

    • How you drive process and documentation in IT?

    You might also like