IT ISMS Workshop
Uploaded by
Iyad AliIT ISMS Workshop
Uploaded by
Iyad AliISO 27001:2005 - Information Security Management
System (ISMS) - Workshop
AGENDA
Need for Information Security Management
Agenda
Information Overview
Information Security Management System (ISMS)
Benefits
Implementation at Kahramaa
Need for Information Management System
Rising security
threats, incidents
Need for
Information
Explosion
Need to
demonstrate higher
assurance to key
stake holders
Rapid evolution and high level of
innovation in emerging threats
Advanced techniques using a combination
of technology, social engineering
Leads to monetary losses, loss of
reputation, loss of customer confidence
An Information
Security
Information Security Management
Management
Enterprise today manages terabytes and
system enables
peta bytes of data
an organization to
Information exists in many forms including
databases, physical documents, electronic
implement a
files
process driven
Protection is a complex task
approach towards
consistent results
& improvements
Need to demonstrate that business
process integrity is protected
Need to demonstrate that organization has
adopted global best practices
Increased accountability for security
ISO 27001. Global Adaptation
Need for Information Security Management
* As of November-2011 (http://www.iso27001certificates.com/)
What is Information?
Information is an asset which, like other important business assets, has
value to the organization and consequently needs to be suitably protected.
Information assets are not limited to computers and hard disks.
They can be in any form..
Information Overview
Information Security
is more than
IT security
Information Risk
Information Assets are susceptible to risks which can impact confidentiality, integrity and/or
availability, impacting business operations
Information Overview
Accessible upon demand by an authorized entity
Accessible only to authorized entities
Fire
Network down time
Power Failure
Hardware Failure
Overloading
Availability
Information
Printed
Electronic
Written
Spoken
Stored
Discarded
Complete and Accurate
Insecure Communication Channel
Unauthorized DB access
Malicious Software
Uncontrolled systems changes
Media Failure
Configuration error
Integrity
Confidentiality
Stealing of classified
documents
Loss of laptops
Social Engineering attacks
Phishing
Information Leak
Network Attacks
Unrestricted access
User Error
Theft
Why ISMS (ISO 27005:2005)?
Systematic Approach to manage
information risks. It is implemented using:
Information Security Management System
Organisational Structure
Policies & Guidelines
Necessary processes and resource allocations
Measurement methodology
Review processes for improvement
Approach for ISMS
Information Security Management System
ISO 27001:2005 Domains
Security Policy
Organizational Information Security
Asset Management
Information SecurityHuman
Management
System
Resource Security
Physical & Environment Security
Communication & Operation Management
Information System Acquisitions,
Development, Maintenance
Access Control
Information Security & Incident
Management
Business Continuity Management
Compliance
Domains 11
Control Objectives 39
Controls -- 133
Control Selection Process
Asset
Paper Documents
Configuration Files
(Routers, Switches etc)
Risk
Unauthorized Access
Tampering
Reason
Controls
Lack of Classification
Guidelines
Data Classification
Policy
Absence of Shredders
Install Shredders
Weak access control
Privilege based access
for resources
System Event Logging
and Monitoring
Loss of data
Environmental hazards
Information Security is Everyone's Responsibility
Implementation of
redundancy of data
storage systems.
(Backup Management)
Benefits
Implementation of systematic risk based information
security approach
Higher availability of systems
Assurance to Management
Better Customer Confidence & Satisfaction
Enhanced Security Awareness
Consistent improvements in security posture with time
ISMS Implementation at Kahramaa
Kahramaa Implementation
Scope Diagram
ISMS Implementation in Kahramaa
Phase-I
Phase-II Implementation
Phase-III
Phase-IV
Kahramaa
Project
Initiation and
System
Study
Risk
Assessment
& Risk
Treatment
Policy &
Procedure
Development
Implementation
Support &
Knowledge
Transfer
ISMS Implementation
Phase-V
Internal Audit
ISO 27001
Certification
ISMS Implementation in Kahramaa
Kahramaa Implementation
ISMS Implementation in Kahramaa
Information Security Coordinators
Designation - Section / Unit
Kahramaa Implementation
Network Administrator Client Support &
Netwroks
System Analyst System Support
System Administrator System Development
Your Role in ISMS
Phase-I & II
Kahramaa Implementation
Phase-III & IV
Phase-V
Explain Business Processes
Information Assets Identification
Information Assets Valuation
Provide required policy &
procedures for update
Implementation of identified controls
Participate in Internal Audit
Support in Gap Mitigation
Participate in External Audit
ISMS Implementation in Kahramaa
Work completed
System study
Scope finalization
Identification of SPOCs
Interviews with sections & units within scope
What is next?
Asset collection
Risk assessment methodology
Risk assessment
Security Testing (Vulnerability Assessment & Penetration Testing)
Risk treatment
SOA
&
Thank You..!!!
