Information Security

Management System
(ISMS)
Pertemuan 3

Prodi Sistem Informasi - Fakultas Ilmu Komputer

 ISO 27001 - Overview

• International Standards Organization (ISO)

• Information Security Management System (“ISMS”)
• Based on British Standard 7799
• Management system – Process
• Conform not comply
• Framework for established scope
 What is ISO/IEC 27001:2013
• Leading International Standard for ISMS. Specifies the requirements
for establishing, implementing, maintaining, monitoring, reviewing
and continually improving the ISMS within the context of the
organization.
• Best Standard for complying with information security legislation.
• Not a technical standard that describes the ISMS in technical detail.
• Does not focus on information technology alone, but also other
important business assets, resources, and processes in the
organization.
ISO/IEC 27001 Evolution
 What is ISO/IEC 27001:2013

• ISO does not perform certification.

• Organizations looking to get certified to an ISO standard must
contact an independent certification body.
• Certification bodies must use the ISO’s Committee on
Conformity Assessment (CASCO) standards related to the
certification process.
 Why Implement ISO 27001
• Best framework for complying with information security legal, regulatory
and contractual requirements
• Better organizational image because of the certificate issued by a
certification body
• Proves that senior management are committed to the security of the
organization
• Focused on reducing the risks for information that is valuable for the
organization Provides a common goal
• Optimized operations within the organization because of clearly defined
responsibilities and business processes
• Builds a culture of security
 ISO 27001 Clause

• Clause 4 Context of the organization

– 4.1 Understanding the organization and its context
– 4.2 Understanding the needs and expectations of interested parties
– 4.3 Determining the scope of the information security management
system
– 4.4 Information security management system
• Clause 5 Leadership
– 5.1 Leadership and commitment
– 5.2 Policy
– 5.3 Organizational roles, responsibilities and authorities
 ISO 27001 Clause

• Clause 6 Planning
– 6.1 Actions to address risks and opportunities
– 6.2 Information security objectives and planning to achieve them
• Clause 7 Support
– 7.1 Resources
– 7.2 Competence
– 7.3 Awareness
– 7.4 Communication
– 7.5 Documented information
 ISO 27001 Clause
• Clause 8 Operation
– 8.1 Operational planning and control
– 8.2 Information security risk assessment
– 8.3 Information security risk treatment
• Clause 9 Performance Evaluation
– 9.1 Monitoring, measurement, analysis and evaluation
– 9.2 Internal audit
– 9.3 Management review
• Clause 10 Improvement
– 10.1 Nonconformity and corrective action
– 10.2 Continual improvement
ISO 27001 Clause
Lifecycle of the Information
Security
 Lifecycle of the Information
Security
• “Plan-Do-Check-Act” (“PDCA”)
• Plan - Establish the planning for policy, the ISMS objectives,
processes and procedures related to risk management and
the improvement of information security to provide results in
line with the global policies and objectives of the
organization.
• Do - Implement and exploit the ISMS policy, controls,
processes and procedures.
 Lifecycle of the Information
Security
• Check - Assess and, if applicable, measure the performances
of the processes against the policy, objectives and practical
experience and report results to management for review.
• Act - Undertake corrective and preventive actions, on the
basis of the results of the ISMS internal audit and
management review, or other relevant information to
continually improve the said system.
Lifecycle of the Information
Security
Selecting a method for Risk Assessment

• Possible damage to the business activities and tasks of an institution

due to information security incidents must be analysed and
assessed.
• A method for risk assessment is therefore an integral part of every
information security management system.
• In order to be able to identify a risk, the threats must be ascertained
and their potential for causing damage and the probability that they
will occur must be assessed.
Selecting a method for Risk Assessment

• There are various risk assessment methods that come into question
depending on the application, organizational boundary conditions,
type of industry and level of information security that is aspired to
– ISO/IEC 27005: 2011 Information technology -- Security
techniques -- Information security risk management
– COSO (Committee of Sponsoring Organizations of the Treadway
Commission)
– BSI standard 100-3 entitled "Risk analysis“
– etc
 Classifying risks and damages

• Depending on the selected method for risk assessment, the

information security management must ascertain how threats, the
potential for causing damage, occurrence probabilities and the
resulting risks should be classified and assessed.
– Occurrence probability: rarely, frequently, very frequently
– Potential extent of damages: moderate, high, very high
 Determine response to the risks
• Risks can be reduced by implementing appropriate security
measures
• Risks can be avoided, for instance, by restructuring or abandoning
business processes or tasks
• Risks can be transferred, for instance, through outsourcing or
insurances
• Risks can be accepted
 Selecting Information Security Safeguard

• Organisation (including specifying responsibilities, assigning duties

and separating functions/ SoD, regulating how information is
handled, applications and IT components, hardware and software
management, change management, etc.)
• Personnel (e.g. briefing new staff members, making deputisation
arrangements, etc)
• Training and increasing people's awareness on information security
• Data protection (for all information, applications and IT components)
 Selecting Information Security Safeguard

• Computer virus protection

• Protection of information during processing, transmission and
storage (e.g. through the use of cryptography)
• - Hardware and software development
• - Conduct during IT security incidents (incident handling)
• - Contingency planning and maintenance of business activities in an
emergency (business continuity)
Development of an implementation plan for security concept

An implementation plan must include the following issues:

• Specification of priorities (implementation sequence)
• Specification of responsibilities for initiation
• Provision of resources by the management
• Implementation planning for individual measures (specifying
deadlines and costs and the specification of the persons responsible
for the implementation and specification of deadlines as well as the
persons responsible for checking the implementation and the
effectiveness of measures).
 Implementation of information security safeguards

• The planned information security safeguards must be

implemented in accordance with the implementation
plan.
• In the process, information security must be integrated
in the organisation-wide procedures and processes.
• If difficulties arise during implementation, they should be
communicated immediately so that solutions can be
devised to overcome them.
 Supervising and checking the implementation

• Regular checks must be performed to ensure that the set

objectives are complied with.
• If objectives cannot be complied with, the member of
the management level responsible for information
security must be informed so that problems can be
responded to in time.
Reaction to changes during routine operation

• In the case of changes to routine operation (e.g. the

introduction of new business processes, modifications to
the organisation or introduction of new IT systems)
• the security concept and the associated documents (as
well as a list of the spheres of responsibility or a list of
the IT systems) must be updated.
Detection of information security incidents during routine operation

• Mistakes that are critical to security and information

security incidents to be avoided as far as possible, to be
limited in their impact or at least noticed early on.
– tools for monitoring systems,
– integrity checks,
– keeping a log of access,
– actions or errors,
– controlling the access to buildings
 Checking that the requirements are being complied

• Regular checks must be performed to see whether all the

IT security measures are being applied and implemented
as planned in the security concept.
• This must involve checking that the technical security
measures (e.g. as regards the configuration) and the
organisational regulations (e.g. processes, procedures
and operations) are complied
Checking the suitability and effectiveness of information security safeguards

• Regular checks must be performed to determine

whether the information security safeguards are
appropriate for achieving the information security
objectives that have been set.
• Their suitability can be assessed, for instance, by:
– evaluating past information security incidents,
– interviewing staff members
– performing penetration tests.
 Management appraisals

• The management level must be kept informed about the

results of the checks at regular intervals and in an
adequate manner by the information security
management.
• The problems, successes and opportunities for
improvements should be pointed out.
 Summary

• Adoption of an ISMS should be a strategic decision for an

organization.
• ISMS is a holistic approach to managing information
security – confidentiality, integrity, and availability of
information and data.
• Laws and regulations are continuing to evolve to address
information security risk and privacy. ISO/IEC 27001:2013
is the best framework for complying with information
security legislation.
 Summary

• ISO/IEC 27001:2013 is not a technical standard for IT

only.
• Increasing trend in adopting a holistic approach (using
ISO/IEC 27001:2013) in managing information security
risks.
• Organizations need to conduct an information security
awareness.
Any Question?