Copyright © 2013 BSI. All rights reserved. IOSH 2013. Rev 0 The use of standards to tackle emerging...

IOSH 2013. Rev 0

The use of standards to tackle emerging information security risks

Suzanne Fribbins EMEA Product Marketing Manager - Risk

Who is BSI? – 10 fast facts

Founded in 1901

Standards, assessment, testing,

certification, training, software

No owners/shareholders … all profit reinvested into the business

Global independent business services

organization

>2,900 staff and >50%

non-UK

#1 certification body in the

UK, USA

National Standards

Body in the UK

Trained over 73,000 people worldwide in

70,000 clients in 150

countries

65 offices located around

the world

The changing information security risk landscape

New security challenges

Key information security statistics

• Recent government research has found 93% of large organizations and 87% of small businesses suffering a breach last year (up more than 10% on the previous year)

• And we're starting to see the impact of emerging technologies on information security

• The 2013 PwC information security breaches survey found:• 14% of large organisations had a security breach relating to

social networking sites; and• 9% had a breach relating to smartphones or tablets• 4% of respondents had a security or data breach in the last

year relating to one of their cloud computing servicesSource: 2013 Information Security Breaches Survey

Increasing regulatory compliance

• Concern about security risks and their impact on citizen data has triggered a wave of regulatory compliance with progressively heavier penalties for personal data breaches

• Increased ICO activity (34 fines in just over two years) relating to:• Emailing of sensitive personal information to the wrong

recipients• Mailing sensitive information to the wrong recipient/s• Faxing of information to incorrect number/s• Personal information mistakenly published on public website/s• Loss of unencrypted laptops• Loss of unencrypted memory sticks, DVD’s• Theft of sensitive paper records from a mobile worker• Unsecure disposal of sensitive personal records• Sensitive information left on disused IT equipment

Global growth in certification

2006 2007 2008 2009 2010 2011

ertifi

Information Security Breaches Survey 2013 - PwC

• 76% of large respondents and 36% of smaller organizations have implemented ISO 27001 at least partially

• 85% of large organisations and 61% of small businesses have been asked by their customers to comply with security standards

• 45% of large organisations have specifically been asked for ISO 27001 compliance

Source: 2013 Information Security Breaches Survey

What is happening in the ISO 27000 suite to address the changing risk landscape?

“The ISO 27000s are the ones you want to be looking for” (Paul Simmonds, co-founder of the Jericho Forum, ex-CIO of AstraZeneca, 2011)

The ISO 27000 series

2011/ISO/IEC 27034 - Guidelines for application security (6 part standard)

2011ISO/IEC 27031 - Guidelines for ICT readiness for business continuity

2012ISO/IEC 27032 – Guidelines for cyber security

2012ISO/IEC 27013 – Guidelines on the integrated implementation of ISO/IEC 27001 & ISO 20000-1

2009/10/11ISO/IEC 27033 - Security Techniques, Network Security (3 part standard)

ISO/IEC 27018 – Information security in cloud computing (relevant controls in 27001 – DP/Privacy)

ISO/IEC 27017 – Information security in cloud computing (relevant controls in 27001)

ISO/IEC 27016 – Information security management – organizational economics

2012ISO/IEC 27015 – Information security management guidelines for financial services

ISO/IEC 27014 – Governance of information security

Standard Published

Under development

Standard Published

Under development

ISO/IEC 27044 – Guidelines for security information and event management (SIEM)

ISO/IEC 27043 – Investigation principles and processes

ISO/IEC 27042 – Guidelines for the analysis and interpretation of digital evidence

ISO/IEC 27041 – Guidance on assuring suitability and adequacy of investigative measures

ISO/IEC 27035 – Information security management (3 part standard)

ISO/IEC 27040 – Storage security

ISO/IEC 27039 – Selection, deployment and operations of intrusion detection andprevention systems

ISO/IEC 27038 – Specification for digital redaction

2012ISO/IEC 27037 – Guidelines for identification, collection, acquisition and presentation of digital evidence

ISO/IEC 27036 – Information security for supplier relationships (4 part standard)

Standard Published

Under development

Standard Published

Under development

Cloud security – how standards can help?

• Understand the chain of custody risk of the data• When you put it into the cloud• How the supplier maintains it and backs it up• How you can prove your data has been destroyed, if

you choose to move to a new supplier

Requirements for an information security management system

(revision due 2013, ISO 27001 will continue to be the certification standard for

Information Security)

Code of practice for information security management

(revision due 2013)

Requirements for an information security management system

Code of practice for information security

management

Security in cloud computing (due 2014, will include cloud-specific

controls, in addition to those recommended in the new ISO 27002.

Standard is supported by the Cloud Security Alliance)

Other standards initiatives

PAS 555

• The focus of PAS 555 is cyber security• Looks at cyber security at the organizational level• Outcomes based - provides a framework that

enables understanding of the broad scope of capabilities required

• Other standards and guidelines to tackle cyber security risk tend to define good practice as to how effective cyber security might be achieved

• PAS 555 does not specify such processes or actions

PAS 555

• The focus of PAS 555 is cyber security• Looks at cyber security at the organizational level• Outcomes based - provides a framework that

enables understanding of the broad scope of capabilities required

• Other standards and guidelines to tackle cyber security risk tend to define good practice as to how effective cyber security might be achieved

• PAS 555 does not specify such processes or actions

Cloud Security STAR certification

• ISO 27001 is widely recognised and respected• “Users should look for the providers to be 27001 certified”

(John Pecatore, Gartner Cloud Analyst, 2011)• Perception = insufficient focus on detail in certain

areas of security for particular sectors• ISO 27001 is written with expectation that additional

controls could be added• Developed by CSA, the Cloud Controls Matrix (CCM)

bridges this gap, providing focus on critical controls for cloud security

• In addition, it is felt a pass/fail approach does not allow cloud service purchasers to make informed decisions

How was the CCM developed?

• Joint agreement signed between CSA and BSI in August 2012

• CCM initially developed by CSA• Working group assembled to further develop CCM

using a consensus based model• Expertise in maturity modelling provided by BSI

ISO 27001 + CCM + Maturity Model = STAR

STARCertification

Cloud controls – what are they about?

Audience, key drivers, benefits

• Scheme available to any organization providing cloud services, that has, or is in the process of, certifying to ISO 27001

• The scope of the ISO 27001 certification must not be less than the scope of the STAR certification

• STAR certification ensures that:• Specific issues critical to cloud services have been addressed• That this has been independently checked and verified by a

third-party• Encourages CSP’s to move beyond compliance to continued

improvement• Management capability model gives management visibility of

effectiveness of controls, and allows performance to be benchmarked and improvements tracked year on year

General Management

System

Cloud Specific Controls

Well MANAGED and FOCUSED system

STAR Certification

STAR Assessor

Approving assessors

Revision of ISO 27001

ISO 27001 is “increasingly becoming the lingua franca for information security”Source - Information Security Breaches Survey 2010 - PwC

ISO 27001 revision: status report

• ISO 27001:2005 has been undergoing revision.• Draft International Standard (DIS) released to the

National Standards Bodies on 16 January 2013.• Consultation closed 23 March 2013.• Draft International Standard (DIS) passed its DIS

ballot at the meeting of the ISO Committee in April.• A Final Draft International Standard (FDIS) will

follow.• Publication is expected toward the end of 2013.

What can you expect from the new ISO 27001?

• Standard has been written in accordance with Annex SL• Definitions in 2005 version have been removed and relocated

to ISO 27000 • There have been changes to the terminology used• Requirements for Management Commitments have been

revised and are presented in the Leadership Clause• Preventive action has been replaced with “actions to address,

risks and opportunities” • The risk assessment requirements are more general • SOA requirements are similar but with more clarity on the

determination of controls by the risk treatment process • The new standard puts greater emphasis on setting the

objectives, monitoring performance and metrics

ISO 27001 structure

Controls

Questions?

Contact us

Copyright © 2013 BSI. All rights reserved. IOSH 2013. Rev 0 The use of standards to tackle emerging...

Documents

Nestle Presentation - IOSH

IOSH MANAGING SAFELY - istcollege.com.mt€¦ · The project is marked using the IOSH criteria and has a maximum of 38 marks. IOSH MANAGING SAFELY ISTC / IOSH MS / CCS / 00 / 02012018

IOSH LEADING SAFELY - KB Associates Europe … IOSH...IOSH LEADING SAFELY Course Overview IOSH Leading Safely course is designed by IOSH in partnership with business leaders, it provides

IOSH Courses Online

Fire safety iosh

IOSH MANAGING SAFELY - 5 DAY - TSQCTC 46. IOSH MS... · IOSH MANAGING SAFELY - 5 DAY ... (IOSH) - UK. COURSE CERTIFICATE Module 1: Introducing Managing Safely •Why is it important

IOSH Text Book

ISO 22301: Overview, certification and what to expect from ...shop.bsigroup.com/upload/BCM Conference/Suzanne Fribbins - ISO... · Copyright ©2012 BSI. All rights reserved. 2

Electricity - IOSH

IOSH Returning safely – IoD and IOSH guide to returning

Dances, Elegies & Epitaphs The Music of Peter Fribbins€¦ · · 2017-07-01Dances, Elegies & Epitaphs The Music of Peter Fribbins ... came across an old copy of Henry Purcell’s

IOSH MSQP Electricity

Communication - IOSH

IOSH MSQP Machinery

IOSH Blank Project

IOSH Leading Safely… · IOSH LEADING SAFELY Course Overview IOSH Leading Safely course is designed by IOSH in partnership with business leaders, it provides relevant and practical

Project iosh 3.1

Module 1 iosh

International Accreditations and Courses · • NEBOSH HSE Certificate in Process Safety Management IOSH • IOSH Managing Safely • IOSH Working Safely • IOSH Fire Safety for

NEBOSH Courses IOSH membership CITB Courses SAFEQUAL · IOSH Courses IOSH Managing Safely IOSH Managing Safely in Construction IOSH Safety for Senior Executives IOSH Working Safely