13 January 2016

Title/definition ISO/IEC 27000: Information security

The basics:

ISO / IEC 27000 is a series of information security standards developed and published by ISO and IEC; these standards provide a globally recognized framework for best practice in information security management.

Summary:

ISO/IEC 27000 is owned by the International Standards Organization (ISO) and the International Electrotechnical Commission (IEC). ISO 27001 is a specification that sets out specific requirements, all of which must be followed, and against which an organization’s Information Security Management System (ISMS) can be audited and certified. All the other Standards in the ISO27000 family are Codes of Practice; these provide non-mandatory best practice guidelines which organisations may follow, in whole or in part, at their own discretion.

Key concepts that govern the standards are:

• Organisations are encouraged to assess their own information security risks
• Organisations should implement appropriate information security controls according to their needs
• Guidance should be taken from the relevant standards
• Implement continuous feedback and use of the Plan, Do, Check, Act model
• Continually assess changes in threat and risk to information security issues.

The standards family

ISO/IEC 27000 provides an overview of information security management systems, which form the subject of the information security management system (ISMS) family of standards, and defines related terms.

ISO/IEC 27001 — Information technology – Security Techniques – Information security management systems (ISMS) — Requirements, does not rely Plan-Do-Check-Act cycle, but has been updated in other ways to reflect changes in technologies and in how organizations manage information.

ISO/IEC 27002 — Code of practice for information security controls, this contains the good practice information security control objectives and controls.

ISO/IEC 27003 — Information security management system implementation guidance for the ISO/IEC 27001.

ISO/IEC 27004 — Information security management — Measurement

ISO/IEC 27005 — Information security risk management, aligned to ISO/IEC 31000

ISO/IEC 27006 — The accreditation Standard with guidance for bodies providing audit and certification of information security management systems.

ISO/IEC 27007 — Guidelines for information security management systems auditing (focused on the management system)

ISO/IEC TR 27008 — Technical Report on guidance for auditors on ISMS controls (focused on the (technical) information security controls)

ISO/IEC 27010 — Information security management for inter-sector and inter-organizational communications

ISO/IEC 27011 — Information security management guidelines for telecommunications organizations based on ISO/IEC 27002

ISO/IEC 27013 — Guideline on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1 (IT service management/ITIL)

ISO/IEC 27014 — Information security governance,offers guidance on the governance of information security

ISO/IEC TR 27015 — Technical Reference, Information security management guidelines for financial services

ISO/IEC TR 27016 —  covers the economics of information security management

ISO/IEC 27017 —  covers the information security controls for cloud computing, based on the ISO/IEC  27002.

ISO/IEC 27018 — Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors

ISO/IEC TR 27019 — provides guiding principles based on ISO/IEC 27002 for information security management applied to process control systems as used in the energy utility industry

ISO/IEC TR 27023 — Information technology — Security techniques — Mapping the revised editions of ISO/IEC 27001 and ISO/IEC 27002

ISO/IEC 27031 — Guidelines for information and communication technology readiness for business continuity

ISO/IEC 27032 — Guideline for cybersecurity

ISO/IEC 27033-1 — Network security – Part 1: Overview and concepts

ISO/IEC 27033-2 — Network security – Part 2: Guidelines for the design and implementation of network security

ISO/IEC 27033-3 — Network security – Part 3: Reference networking scenarios – Threats, design techniques and control issues

ISO/IEC 27033-5 — Network security – Part 5: Securing communications across networks using Virtual Private Networks (VPNs)

ISO/IEC 27034-1 — Application security – Part 1: Guideline for application security

ISO/IEC 27035 — Information security incident management

ISO/IEC 27036-1 — Information security for supplier relationships – Part 1: Overview and concepts

ISO/IEC 27036-2 — Information security for supplier relationships – Part 2: Requirements

ISO/IEC 27036-3 — Information security for supplier relationships – Part 3: Guidelines for information and communication technology supply chain security

ISO/IEC 27037 — Guidelines for identification, collection, acquisition and preservation of digital evidence

ISO/IEC 27038 — Information technology — Security techniques — Specification for digital redaction

ISO/IEC 27039 — Information technology — Security techniques — Selection, deployment and operations of intrusion detection systems (IDPS)

ISO/IEC 27040 —  Information technology — Security techniques — Storage security

ISO/IEC 27041 — guidance on assurance for digital evidence investigation methods.

ISO/IEC 27042 — guidance on analysis and interpretation of digital evidence.

ISO/IEC 27043 — guidance on incident investigation.

ISO 31000 —  Risk management — Principles and guidelines

Target group(s):

All roles responsible for IT security management in an organization; IT security management professionals; auditors

Scope:

The family of ISO/IEC 27000 standards is broad in scope: they are applicable to any type of organization, in any sector, of any size.

Strengths and pitfalls:

Strengths

By aligning itself with an ISO / IEC Standard, an organisation can:

• Secure its own critical assets
• Manage levels of risks
• Improve and ensure customer confidence
• Avoid loss of brand damage, loss of earnings or potential fines
• Evolve their information security alongside technological developments

Pitfalls

• Few organizations formally state the scope of their ISMS or document their risk

assessment method and risk acceptance criteria in accordance with the standard.

• Many organizations lack formal procedures for reporting security events, and

mechanisms to quantify and monitor incidents.

• Business continuity plans are often either absent or outdated, while continuit

exercises are irregular and unrealistic

• Few organizations identify all the information security-relevant laws and regulations, and established mechanisms to stay up-to-date on changes.

Title: Foundations of Information Security Based on ISO27001 and ISO27002
ISBN: 9789401800129
Authors: Jule Hintzbergen & Kees Hintzbergen & André Smulders & Hans Baars
Price: € 29,95 (VAT

Titel: Basiskennis informatiebeveiliging op basis van ISO27001 en ISO27002 – 2de herziene druk (dutch version)
ISBN: 9789401800136
Auteurs: Jule Hintzbergen & Kees Hintzbergen & André Smulders & Hans Baars
Prijs: € 29,95 (VAT)