ISO/IEC Winnie Chan BADM 559 Professor Shaw Fall 2008

Transcription

1 ISO/IEC Winnie Chan BADM 559 Professor Shaw Fall 2008

2 Table of Contents Introduction... 2 Objective... 2 History... 3 ISO/IEC Sections... 4 ISO/IEC Annexes... 5 Certification... 6 Certification Bodies... 7 Certification Process... 7 Pros of Certification... 8 Update Conclusion Exhibit A Exhibit B Bibliography

3 Introduction All businesses have top secret data that are critical to an organization s success. Those confidential data need to be properly protected to ensure that it is not leaked to unauthorized parties. Thus, information security management is very important. It attempts to protect a firm s valuable assets from potential threats or leakage. A firm s valuable assets range from digital information to its employees knowledge regarding its competitive advantage. If firms desire to remain in the market for the long-term, they should have all the necessary precautionary controls in place to minimize these types of information security risks. Certain standards are available to guide and teach firms how to implement the appropriate controls. One such standard is the ISO/IEC 27001, which is the international certification standard for information security management systems (ISMS). This standard covers all types of organizations such as government, non-profit, as well as commercial enterprises. Objective The objective of ISO is to simply provide a guide for establishing, implementing, reviewing, and maintaining a firm s ISMS using a continual improvement approach known as PDCA. PDCA stands for Plan-Do-Check-Act. The Plan phase is where a firm s security objectives are established and methods to achieve those are drafted out. The methods arise after a firm meticulously assesses its overall risks to select the relevant controls. The firm should take a risk assessment approach at this stage. It needs to first identify risks it deems significant or threatening to its information security system. Next, it should analyze and estimate the likelihood of each risk. 1 The Do phase is the stage in which the plan is implemented. The Check phase involves analyzing results and comparing actual 1 2

4 accomplishments to planned objectives. The firm should see whether the newly implemented ISMS is efficient and effective at this stage. Finally, the Act phase is where management continuously makes necessary changes until the best future result from the ISMS is obtained. This PDCA cycle was developed by Walter Shewhart in the 1930 s as a dynamic one in which one phase flows directly into the next indefinitely. 2 Refer to the diagram below to attain a better understanding of the PDCA model. ISO/IEC does not require organizations to use specific information security controls. Firms can freely choose and use the security controls that they deem most applicable and useful for their own particular situation. History This standard is the first part of the growing ISO/IEC (ISO 27K) family, a series of information security standards developed to protect the reliability, confidentiality, and accessibility of essential data that firms rely on. ISO/IEC was initially the 1999 British Standard (BS) part 2. BS7799-part 2 is the original specification standard for an ISMS that was previously used as a firm s certification basis. In December 2000, this BS 7799 standard changed its name to ISO In 2002, BS 7799-part 2 s content was 2 3

5 revised to incorporate the PDCA cycle. In October 2005, the standard was again modified and adopted by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). 3 From that point onwards, it was renamed ISO/IEC The ISO/IEC is also known as Information Security Management- Specification with Guidance for Use. 4 This international standard does not describe in detail what an ISMS is specifically composed of. Its counterpart, ISO is the standard that deals with that. ISO was simply derived from BS 7799-part 1. ISO/IEC Sections ISO/IEC has 11 control sections, 39 control objectives, and 133 controls that are in compliance with ISO This international standard contains 8 major sections: scope, normative references, terms and definitions, ISMS, management responsibility, internal ISMS audits, management review of the ISMS, and ISMS improvements. The scope section contains general ISMS information for all firm types. The normative references section basically states that the 2005 ISO/IEC is important to this international standard. Both of these standards were derived from the original BS 7799, so they cover the same topic, being an organization s ISMS. The terms and definitions section provides a brief description of information security system phrases. The ISMS part is basically the foundation of the standard where an explanation of the PDCA cycle is located. The management responsibility section describes the duties of a firm s superior authorities. One of the duties is that they are required to show full commitment to the ISMS by ensuring that adequate resources are utilized to properly implement and operate the system. The internal

6 ISMS audits part states that an organization must have periodic audit reviews of its system. The reason for periodic audits is to make sure that the ISMS has the appropriate and effective controls in place. The management review of the ISMS section stresses that management should review their firm s ISMS suitability on an annual basis to scope out any problems with the system. 6 If management discovers issues with their system, they should rapidly make the necessary changes so that the ISMS provides its organization with the utmost benefit it is capable of. Lastly, the ISMS improvements part is self-explanatory. This section basically states that a firm s management must constantly seek out opportunities to test new methods in order to further increase its information system s efficiency. ISO/IEC Annexes In addition to the above sections, ISO/IEC contains 3 main annexes: control objectives and controls, Organisation for Economic Co-Operation and Development (OECD) principles and ISO/IEC 27001, and the correspondence between ISO 9001, ISO and ISO/IEC The control objectives annex presents a numbered and detailed list of the titles of the control sections contained within this standard. The OECD principles annex describes which parts of the standard meets the requirements set in the OECD Guidelines for the security of both information system security and networks. The OECD was established in 1961 and currently has 30 participating member countries, which includes countries such as the United States, Japan, Greece, United Kingdom, Denmark, and Spain. The organization seeks to help countries maintain and enhance its security systems and networks. A few of the requirements in the OECD Guidelines include security

7 risk assessments and a timely response from management in addressing security incidents. 8 The correspondence between the ISO 9001, ISO 14001, and ISO/IEC annex describes the ISO/IEC s similarity between other management system standards like the ISO 9001 and ISO The ISO 9001 is the standard about quality management systems whereas the ISO is the standard emphasizing on environmental management systems. All three standards share similar system structures such as they all incorporate the PDCA cycle as well as require periodic system audits. Therefore, an organization that implements any one of these systems should be able to quickly adapt into the other, and vice-versa, without any problems. Certification Certification against this standard is entirely optional unless specifically mandated by an organization s stakeholders. However, it is becoming a desirable feature from suppliers and business partners by organizations that are concerned about information vulnerabilities. Thus far, at least 4000 firms worldwide have followed the ISO/IEC international standard to become certified. More than a thousand certificates have been issued to firms around the world. The number of certificates issued worldwide has been constantly on the rise since July This trend does not seem like it would stop anytime soon due to the benefits that ISO/IEC brings to firms. Refer to Exhibit A. In addition, as of November 2008, Japan possesses the most information security management system certificates. Japan has a total of 2863 certificates. The next country in line, India, only has a total of 433 certificates. 10 From this information, it is clearly evident that Japan really places a great value on ISMS certification against the ISO/IEC compared to other

8 countries. Japan has a good reason in doing so because of the increased benefits certification offers. Refer to Exhibit B. Certification Bodies The ones in charge to determine whether firms meet the requirements of this standard are known as certification bodies. Other names for a certification body exist in some countries. Those other names include a registration body, registrar, and an assessment and registration body. A certification body is simply a third party that assesses a firm s ISMS. This party must be approved by the National Accreditation Body for a specific region. This ensures consistency as well as that the certification body is a good representative that complies with both national and international standards. An example of this would be the United Kingdom Accreditation Service (UKAS) in the United Kingdom. 11 There are also multiple variations of the international ISO/IEC standard such as the JIS Q 27001, which is the Japanese domestic standard. 12 Certification from this standard is equivalent to certification against the ISO/IEC Therefore, many organizations probably have obtained certification with multiple versions of the ISO/IEC and those are all deemed equal. Certification Process The certification process involves a three-step process that includes a desktop audit as well as an on-site audit. The first step of the certification procedure is the desktop audit. This audit is where a certification body auditor examines a firm s relevant documents such as its Statement of Applicability (SoA) and Risk Treatment Plan (RTP). The SoA is created based on an organization s protection objectives and controls set in the PDCA cycle. Firms

9 then should use their completed SoA to form an informative RTP. 13 Basically, auditors would pore over these statements to ensure that they are complete. The certification body then takes action on the results obtained from that particular audit. The next step is the onsite audit. The on-site audit is the process in which the certification body sends an audit team to further perform an in-depth assessment of the firm s implementation of its information security system. The audit team performs tests to check the existence as well as the effectiveness of the ISMS. The third stage is where the firm has to agree to a surveillance schedule. This schedule is where the certification body comes in periodically every 6-9 months to check the firm s ISMS again. 14 If a firm passes these audits, it is issued a certificate. The time range for certificate issuance varies from a few weeks to a few months depending on an organization s certification body. It is essential to note that a certificate does not last for an infinite period of time. After 3 years, a firm needs to be recertified to ensure that the effective ISMS is properly maintained. In addition, the ISMS should continue to stay in compliance with ISO/IEC throughout time. Therefore, it is important for a firm to continuously monitor and improve on its ISMS on an on-going basis. Pros of Certification Many organizations have chosen to have their information systems certified because of the many advantages certification brings. A few advantages of certification against the ISO/IEC 2701 is that certified firms meet US legislative requirements like the Sarbanes Oxley Section 404, the Statement on Auditing Standards (SAS) 70 requirements and the Health Insurance Portability and Accountability Act (HIPAA) requirements. The Sarbanes

10 Oxley Section 404 required public companies to include in their annual reports details by their management on their companies control over financial reporting. This act required management to attest to their internal controls. 15 The SAS 70 is the auditing standard developed by the American Institute of Certified Public Accountants (AICPA) for service organizations. 16 The HIPAA requirement was created during the Clinton Administration and is an act developed to protect employees confidential health insurance information. 17 In addition, certified firms also have reduced regulation costs and may even get insurance premium deductions. Moreover, certification against this international standard provides an overall competitive advantage to a firm. Firms with this certificate are more appealing to potential suppliers and business partners because it helps assure them that the organization has an effective and strong ISMS. Firms with management systems in compliance with ISO/IEC mean that those ISMS also comply with privacy and security regulations. The fact that the certificate is issued after a thorough audit by an independent party also helps strengthen a firm s management system reliability in the eyes of outsiders such as shareholders. In addition, certification attracts customers to a specification organization. Consumers in fields like on-line service providers desire seeing a certified information management system because then they know that their confidential data is more secure and safeguarded than firms without ISMS certification. Other benefits associated with ISO/IEC certification are that it increases a firm s credibility, results in improved confidence from suppliers, customers, and stakeholders, and also shows that the firm is dedicated to abiding by information security regulations

11 Update Currently, the ISO/IEC standard is undergoing another modification under the editorial leadership of both Angelika Plate and Matthieu Grall. These two individuals are renown experts in the information security area. Angelika Plate, in particular has actively been involved in editing ISO standards like the ISO/IEC and also operates German information security consulting firm. 19 Therefore, these people are great choices for creating ISO/IEC s revision. The altered version of this standard is expected to be published sometime in 2009 or The exact date is unclear because the revision depends on how much amount of work is needed to formulate and agree to any changes deemed necessary. 20 Conclusion ISO/IEC is important to an organization s overall success. Information security management is essential to firms because if information gets leaked out into the hands of the wrong parties, that will adversely impact them. In order to implement ISO 27001, a process driven approach known as PDCA is commonly adopted to perform this task. Organizations are spending substantial amounts on information security for protection of their valuable assets. Sometimes, firms are wasting their money on futile security systems because they are unaware of how to implement beneficial information security management systems. This international standard provides a great deal of informational guidelines to firms seeking ways to improve its security system s effectiveness. The first step to a better security system is that a firm s management must clearly identify its

12 significant security risks. With a better management system, the firm s money is properly invested and it would be able to use its expenses on other significant areas of its business operations. It is essential for a firm s management address any security incidents that its organization faces in a timely manner. If the necessary actions are not taken soon enough, the firm may suffer negatively because security issues are detrimental to a firm s survival in its relevant industry. Certification against the ISO/IEC provides multiple benefits to a firm that is beyond just simple compliance with an international standard concerning security systems. One significant advantage is that it increases a firm s attractiveness to customers, trading partners, as well as investors. With increased appeal due to an effective management system, firms may be able to potentially benefit from increased revenues. 11

13 Exhibit A 12

14 Exhibit B Japan 2863* Netherlands 11 Bulgaria 2 India 433 Singapore 11 Canada 2 UK 368 Philippines 10 Gibraltar 2 Taiwan 202 Saudi Arabia 10 Isle of Man 2 China 174 Pakistan 10 Morocco 2 Germany 108 Russian Federation 10 Oman 2 USA 82 France 9 Qatar 2 Hungary 74 Colombia 7 Yemen 2 Korea 71 Slovenia 7 Armenia 1 Czech Republic 66 Sweden 7 Bangladesh 1 Italy 54 Slovakia 6 Belgium 1 Hong Kong 38 Croatia 5 Egypt 1 Poland 36 Greece 5 Iran 1 Australia 28 South Africa 5 Kazakhstan 1 Austria 26 Bahrain 4 Kyrgyzstan 1 Ireland 26 Indonesia 4 Lebanon 1 Malaysia 26 Kuwait 4 Lithuania 1 Spain 26 Norway 4 Luxembourg 1 Brazil 20 Sri Lanka 4 Macedonia 1 Mexico 20 Switzerland 4 Moldova 1 Thailand 17 Chile 3 New Zealand 1 Romania 16 Macau 3 Ukraine 1 Turkey 15 Peru 3 Uruguay 1 UAE 14 Portugal 3 Relative Total 4997 Iceland 11 Vietnam 3 Absolute Total

15 Bibliography 1. An Introduction to ISO (ISO27001). 28 Nov < htm>. 2. Funai Obtains Both ISO and JIS Q Certifications. 16 Nov Nov < 3. Implementing SOX 404- An Introduction. 9 Dec < duction.html>. 4. ISMS Certification Process. 5 Dec < ISO Family of Standards. 20 Nov < 5. ISO Central. 28 Oct < 6. ISO 27001: Frequently Asked Questions. < BS-7799-faq.html#future>. 7. ISO 27001: Get the Facts. Cyber Security Industry Analysis. 2 Dec < 8. ISO/IEC 27001:2005 Information Technology Security Techniques Specification for an Information Security Management System. 28 Nov < 9. ISO IEC vs. ISO IEC Praxiom Research Group. 23 Oct Nov < 10. Number of Certificates Per Country. ISMS International User Group. 7 Dec < 11. OECD Guidelines for the Security of Information Systems and Networks: Towards A Culture of Security. 7 Dec < 12. SAS 70 Overview. 28 Nov < Security Management Standards and Certificates. 20 Nov < 14

16 14. UKAS. British Gypsum Website. 5 Dec < 15. What is HIPPA? United States Department of Health & Human Services. 5 Dec < 15