How to Achieve 27001 Certification: An Example of Applied Compliance Management

348 Pages·2007·5.24 MB·English

by  Sigurjon Thor Arnason

How to Achieve
27001 Certification
AU3648_C000.indd 1 10/22/07 4:42:55 PM
OTHER INFORMATION SECURITY BOOKS FROM AUERBACH
802.1X Port-Based Authentication Information Security Cost Management
Edwin Lyle Brown Ioana V. Bazavan and Ian Lim
ISBN: 1-4200-4464-8 ISBN: 0-8493-9275-6
Audit and Trace Log Management: Information Security Fundamentals
Consolidation and Analysis Thomas R. Peltier, Justin Peltier, and John A. Blackley
Phillip Q. Maier ISBN: 0-8493-1957-9
ISBN: 0-8493-2725-3
Information Security Management Handbook,
The CISO Handbook: A Practical Guide to Sixth Edition
Securing Your Company Harold F. Tipton and Micki Krause
Michael Gentile, Ron Collette and Thomas D. August ISBN: 0-8493-7495-2
ISBN: 0-8493-1952-8
Information Security Risk Analysis,
Complete Guide to Security and Privacy Second Edition
Metrics: Measuring Regulatory Compliance, Thomas R. Peltier
Operational Resilience, and ROI ISBN: 0-8493-3346-6
Debra S. Herrmann
ISBN: 0-8493-5402-1 Investigations in the Workplace
Eugene F. Ferraro
Crisis Management Planning and Execution ISBN: 0-8493-1648-0
Edward S. Devlin
ISBN: 0-8493-2244-8 IT Security Governance Guidebook with
Security Program Metrics on CD-ROM
Computer Forensics: Evidence Collection Fred Cohen
and Management ISBN: 0-8493-8435-4
Robert C. Newman
ISBN: 0-8493-0561-6 Managing an Information Security and Privacy
Awareness and Training Program
Curing the Patch Management Headache Rebecca Herold
Felicia M Nicastro ISBN: 0-8493-2963-9
ISBN: 0-8493-2854-3
Mechanics of User Identification and
Cyber Crime Investigator's Field Guide, Authentication: Fundamentals of Identity
Second Edition Management
Bruce Middleton Dobromir Todorov
ISBN: 0-8493-2768-7 ISBN: 1-4200-5219-5
Database and Applications Security: Integrating Practical Hacking Techniques and
Information Security and Data Management Countermeasures
Bhavani Thuraisingham Mark D. Spivey
ISBN: 0-8493-2224-3 ISBN: 0-8493-7057-4
Guide to Optimal Operational Risk and BASEL II Securing Converged IP Networks
Ioannis S. Akkizidis and Vivianne Bouchereau Tyson Macaulay
ISBN: 0-8493-3813-1 ISBN: 0-8493-7580-0
How to Achieve 27001 Certification: An The Security Risk Assessment Handbook:
Example of Applied Compliance Management A Complete Guide for Performing Security
Sigurjon Thor Arnason and Keith D. Willett Risk Assessments
ISBN: 0-8493-3648-1 Douglas J. Landoll
ISBN: 0-8493-2998-1
Information Security: Design, Implementation,
Measurement, and Compliance Testing Code Security
Timothy P. Layton Maura A. van der Linden
ISBN: 0-8493-7087-6 ISBN: 0-8493-9251-9
Information Security Architecture: An Wireless Crime and Forensic Investigation
Integrated Approach to Security in the Gregory Kipper
Organization, Second Edition ISBN: 0-8493-3188-9
Jan Killmeyer
ISBN: 0-8493-1549-2
AUERBACH PUBLICATIONS
www.auerbach-publications.com
To Order Call: 1-800-272-7737 • Fax: [phone]
E-mail: [email protected]
AU3648_C000.indd 2 10/22/07 4:42:55 PM
How to Achieve
27001 Certification
An Example of Applied Compliance Management
(cid:52)(cid:74)(cid:72)(cid:86)(cid:83)(cid:75)(cid:80)(cid:79)(cid:1)(cid:53)(cid:73)(cid:80)(cid:83)(cid:1)(cid:34)(cid:83)(cid:79)(cid:66)(cid:84)(cid:80)(cid:79)(cid:1)(cid:114)(cid:1)(cid:44)(cid:70)(cid:74)(cid:85)(cid:73)(cid:1)(cid:37)(cid:15)(cid:1)(cid:56)(cid:74)(cid:77)(cid:77)(cid:70)(cid:85)(cid:85)
New York London
AU3648_C000.indd 3 10/22/07 4:42:56 PM
LOC Page
AU3648_C000.indd 4 10/22/07 4:42:56 PM
Contents
Preface.............................................................................................................xi
Introduction.................................................................................................xiii
1 Introduction.to.International.Standards.Organization.Security.
Standards.................................................................................................1
1.1 Objectives .........................................................................................1
1.2 Cornerstones of Information Security ...............................................2
1.3 T he History of ISO Information Security Standards ........................3
1.4 Information Security Standards Road Map and Numbering ............4
1.5 International Security Management Standards .................................4
1.6 Other Proposed Information Security Standards ..............................5
1.7 Introduction to the ISO/IEC 27001 Standard ..................................5
1.8 Introduction to the ISO 27002 Standard ..........................................7
1.9 Relationship between ISO 27001 and ISO 27002 ............................9
1.10 Relationship to Other Management Standards .................................9
1.11 PDCA and Security Standards Cross-Reference .............................10
1.11.1 Standards to Assist in the Plan Phase ...............................10
1.11.2 Standards to Assist in the Do Phase .................................11
1.11.3 Standards to Assist in the Check Phase ............................11
1.11.4 Standards to Assist in the Act Phase .................................12
2 Information.Security.Management.System...........................................13
2.1 Objectives .......................................................................................13
2.2 ISMS Introduction .........................................................................14
2.3 Security Management Framework Introduction .............................14
2.4 ISMS Establishment Process: To-Be or PDCA ...............................15
2.4.1 To-Be ...............................................................................16
2.4.2 As-Is .................................................................................17
2.4.3 Transition Plan .................................................................17
2.4.4 Operations and Maintenance ...........................................18

AU3648_C000toc.indd 5 10/22/07 4:43:41 PM
i  n  Contents
3 Foundational.Concepts.and.Tools.for.an.Information.Security.
Management.System..............................................................................19
3.1 Objectives .......................................................................................19
3.2 SMF Applications ...........................................................................20
3.2.1 Interpretation Guide ........................................................22
3.3 ISMS Initial Planning and Implementation ....................................67
3.4 Establishing Current Status of Organizational Security
Management (Assessment Process) .................................................68
3.4.1 Background Discovery .....................................................68
3.4.1.1 Organization Background Information ...........69
3.4.1.2 General Information Security Posture
Questionnaire ..................................................70
3.4.1.3 Security Arrangements ....................................71
3.4.1.4 Information Security Infrastructure ................75
3.4.1.5 Findings and Report ........................................75
3.4.2 Compliance Level Discovery ............................................76
3.4.2.1 Sample Interview Guide ..................................78
3.5 Analysis of Discovery Results.........................................................80
3.5.1 Reporting Templates ........................................................81
3.6 An Initial View of Developing an ISMS .........................................81
3.6.1 Establish Governance .......................................................83
3.6.2 Plan for Management ......................................................84
3.6.3 Framework for Operations ..............................................84
3.6.4 Institute a Methodology for Continual Review and
Improvement ...................................................................84
3.6.5 SMF Baseline — An ISO 27002 Foundation ...................85
3.6.6 ISMS — Policy, Standard, and Procedure
Development and Maintenance Tracking .........................93
4 Implementing.an.Information.Security.Management.System—
Plan–Do–Check–Act............................................................................97
4.1 Objectives .......................................................................................97
4.2 ISMS Definition .............................................................................98
4.3 PDCA Model .................................................................................99
4.3.1 Accountability ................................................................101
4.4 Plan Phase ....................................................................................101
4.4.1 Process and Products of the Plan Phase ..........................102
4.4.1.1 Defining the Scope ........................................103
4.4.1.2 Information Security Policy ...........................104
4.4.1.3 Organization of the Information Security
Policy .............................................................106
4.4.1.4 ISMS Policy ...................................................111
4.4.1.5 Risk Management .........................................112
AU3648_C000toc.indd 6 10/22/07 4:43:41 PM
Contents  n  ii
4.4.1.6 Prepare the Statement of Applicability ...........129
4.4.1.7 Documentation Summary of the Plan
Phase .............................................................131
4.5 Do Phase ......................................................................................131
4.5.1 Risk Treatment Plan .......................................................132
4.5.1.1 Writing Policies and Procedures ....................132
4.5.1.2 Metrics and Measurements ............................134
4.5.2 Selecting and Implementing Controls ............................145
4.5.3 Awareness, Training, and Education ..............................146
4.5.4 Managing Operation and Resources ..............................147
4.5.5 Managing Security Incident ...........................................148
4.5.5.1 Monitoring ....................................................148
4.5.5.2 Detection .......................................................148
4.5.5.3 Notification ...................................................148
4.5.5.4 Triage ............................................................149
4.5.5.5 Escalation ......................................................149
4.5.5.6 Response ........................................................149
4.5.5.7 Isolation .........................................................149
4.5.5.8 Restoration ....................................................149
4.5.5.9 Root Cause Analysis ......................................150
4.5.5.10 Organizational Feedback ...............................150
4.5.6 Documentation Summary of the Do Phase ....................150
4.6 Check Phase .................................................................................151
4.6.1 Execute Operational Plan ...............................................151
4.6.2 Review of the Effectiveness of the ISMS .........................151
4.6.3 Review the Level of Residual Risk ..................................154
4.6.4 Conduct an Internal ISMS Audit ...................................155
4.6.5 Regular Management Review of the ISMS .....................156
4.6.6 Record Action and Events That Impact the ISMS ..........157
4.6.7 Documentation Summary of Check Phase .....................157
4.7 Act Phase ......................................................................................158
4.7.1 Implement Identified Improvements ..............................158
4.7.2 Apply Lessons Learned: Empirical and Vicarious ...........158
4.7.2.1 Empirical .......................................................158
4.7.2.2 Vicarious .......................................................159
4.7.3 Communicate the Results: Organizational Outreach .....159
4.7.4 Ensure the Objective ......................................................159
4.7.5 Continue the Process ......................................................159
4.7.6 Documentation Summary of the Act Phase ...................160
4.8 Summary of Implementing the ISMS ...........................................160
AU3648_C000toc.indd 7 10/22/07 4:43:42 PM
iii  n  Contents
5 Audit.and.Certification.......................................................................163
5.1 Objectives .....................................................................................163
5.2 Certification Process Overview .....................................................164
5.3 Selecting an Accredited Certification Body ...................................165
5.4 Certification Preparation Checklist ..............................................165
5.5 The Audit Stage Process ................................................................167
5.5.1 Stage 1: Engaging the Certifier and Audit Kickoff .........167
5.5.2 Stage 2: Document Review ............................................168
5.5.3 Stage 3: On-Site Audit ...................................................169
5.5.4 Stage 4: Delivery of Findings .........................................171
6 Compliance.Management....................................................................173
6.1 Objectives .....................................................................................174
6.2 Introduction to Compliance Management ....................................174
6.3 IA CMP ........................................................................................174
6.3.1 Compliance Management Framework ............................175
6.3.2 Security Management Framework ..................................177
6.3.3 Compliance Management Requirements Engineering ....179
6.3.3.1 Requirements Traceability Example ..............186
6.3.4 Security Compliance Assessment Methodology .............186
6.3.4.1 Project Management ......................................189
6.3.4.2 Pre-Engagement ............................................191
6.3.4.3 Engagement ...................................................192
6.3.4.4 Post-Engagement ...........................................194
6.3.5 Compliance Management Tools .....................................194
6.3.5.1 Team Management ........................................195
6.3.5.2 Project Management ......................................195
6.3.5.3 Pre-Engagement ............................................196
6.3.5.4 Engagement ...................................................196
6.3.5.6 Post-Engagement ...........................................197
6.3.5.7 Delivery and Sign-Off ...................................197
6.3.6 Compliance Metrics .......................................................197
6.3.6.1 Compliance Levels.........................................198
6.3.6.2 Policy, Standard, and Procedure
Management..................................................201
6.3.6.3 Dissemination ...............................................202
6.3.6.4 Mitigation/Remediation Tracking .................202
6.3.6.5 Benefits of Metrics and Measures ..................203
6.3.7 ISO Certification: An Instance of IA CMP ...................204
6.4 Conclusion and Commentary .......................................................205
6.4.1 PDCA Overview ............................................................207
6.4.1.1 Plan ...............................................................207
6.4.1.2 Do .................................................................207
AU3648_C000toc.indd 8 10/22/07 4:43:43 PM
Contents  n  ix
6.4.1.3 Check ............................................................207
6.4.1.4 Act ................................................................208
6.4.2 Melding Compliance Management with PDCA ...........208
6.4.2.1 Identify .........................................................208
6.4.2.2 Establish .......................................................208
6.4.2.3 Plan ..............................................................209
6.4.2.4 Implement .....................................................210
6.4.2.5 Monitor .........................................................211
6.4.2.6 Maintain .......................................................211
6.4.2.7 Improve .........................................................212
6.4.3 ISO 27001 Certification: An Instance of Compliance
Management ..................................................................212
Appendix.A. ..ISMS.Assessment.Discovery.Question.Set............................213
Appendix.B. ..Sample.Statement.of.Applicability........................................257
Appendix.C. ..PDCA.Guideline.Documents—Outlines.............................269
Appendix.D. Policy,.Standard,.and.Procedure.Sample.Templates.............273
Appendix.E. ...ISMS.Policy.and.Risk.Treatment.Templates........................281
Appendix.F. ..Project.Definition.Template.................................................289
Useful.Bits.of.Knowledge.............................................................................295
Glossary.......................................................................................................301
References...................................................................................................307
Index............................................................................................................309
AU3648_C000toc.indd 9 10/22/07 4:43:43 PM