Table Of ContentITgovern_aw.qxd:Layout 1 11/2/08 13:53 Page 1
“For companies that have identified IT governance as a key business risk, this book provides a 4th
comprehensive guide to actions that should be taken.” edition
Nigel Turnbull, Chairman, Lasmo plc, author of the Turnbull Report
Internal Guidance for Directors on the Combined Code
“Addresses how managers should comply with best practice on the security, confidentiality and
integrity of data stored on IT systems.” GOVERNANCE
The Times
IT
“Written for directors and senior managers… it’s a clear and concise working document to help
bolster information security practices.”
Business Continuity
A Manager’s Guide
“Should be read by every computer professional with responsibility for security.”
IMIS Journal
to Data Security
The development of IT governance – which recognizes the convergence between business practice
and IT management – makes it esential for managers at al levels and in organizations of al sizes to and ISO27001/ISO 27002
understand how best to deal with information security risks. In addition, the Turnbull guidance on
company risk management (together with laws and regulations throughout the OECD) provides
company directors with a legal responsibility to act on computer information and data security.
Alan Calder & Steve Watkins
This new edition of a unique handbook is fully updated with the latest regulatory and
technological developments. Containing the latest revisions to ISO 27001 and ISO 27002, it guides
business managers through the issues involved in achieving ISO certification in Information 4th edition
Security Management and covers all aspects of data security.
ALAN CALDER is a founder-director of IT Governance Ltd, which provides IT governance,
compliance, risk management and information security books, tools, consultancy and training
through its website www.itgovernance.co.uk. For seven years he was a member of the DNV
Certification Services Certification Committee, which certifies compliance with international
standards, and he consults with companies internationally on information security.
STEVE WATKINS is Head of Consultancy & Training at IT Governance Ltd. Steve has over 18 years’
experience of managing integrated management systems, including maintenance of Information
Security, Quality, Environmental and Investor in People certifications. A trained ISO27001 and ISO9000
auditor, Steve is currently Chair of the UK ISO\IEC27001 Users Group (the UK Chapter of the
international ISMS User Group) and is on the Management Committee of the British Standards Society.
ISBN: 978-0-7494-5271-1
Kogan Page Kogan Page US
120 Pentonville Road 525 South 4th Street, #241
London N1 9JN Philadelphia PA 19147
United Kingdom USA
www.koganpage.com Business and management
Alan Calder & Steve Watkins
IT GOVERNANCE
i ᔢ
GOVERNANCE
IT
ᔢ ii
THIS PAGE IS INTENTIONALLY LEFT BLANK
iii ᔢ
GOVERNANCE
IT
A Manager’s Guide
to Data Security
and ISO27001/ISO 27002
4th edition
Alan Calder & Steve Watkins
London and Philadelphia
ᔢ iv
Publisher’s note
Every possible effort has been made to ensure that the information contained in this book is accurate at
the time of going to press, and the publishers and authors cannot accept responsibility for any errors or
omissions, however caused. No responsibility for loss or damage occasioned to any person acting, or
refraining from action, as a result of the material in this publication can be accepted by the editor, the
publisher or any of the authors.
First edition published in Great Britain and the United States in 2002 by Kogan Page Limited
Second edition 2003
Third edition 2005
Fourth edition 2008
Apart from any fair dealing for the purposes of research or private study, or criticism or review, as
permitted under the Copyright, Designs and Patents Act 1988, this publication may only be reproduced,
stored or transmitted, in any form or by any means, with the prior permission in writing of the
publishers, or in the case of reprographic reproduction in accordance with the terms and licences issued
by the CLA. Enquiries concerning reproduction outside these terms should be sent to the publishers at
the undermentioned addresses:
120 Pentonville Road 525 South 4th Street, #241
London N1 9JN Philadelphia PA 19147
United Kingdom USA
www.koganpage.com
© Alan Calder and Steve Watkins, 2002, 2003, 2005, 2008
The right of Alan Calder and Steve Watkins to be identified as the authors of this work has been asserted
by them in accordance with the Copyright, Designs and Patents Act 1988.
ISBN 978 0 7494 5271 1
British Library Cataloguing-in-Publication Data
A CIP record for this book is available from the British Library.
Library of Congress Cataloging-in-Publication Data
Calder, Alan, 1957–
IT governance : a manager’s guide to data security and ISO 27001/ ISO 27002 / Alan Calder and Steve
Watkins. –– 4th ed.
p. cm.
ISBN 978–0–7494–5271–1
1. Computer security. 2. Data protection. 3. Business enterprises––Computer networks––Security
measures. I. Watkins, Steve, 1970– II. Title.
QA76.9.A25C342 2008
005.8––dc22
2007048933
Typeset by Saxon Graphics Ltd
Printed and bound in India by Replika Press Pvt Ltd
v ᔢ
Contents
Acknowledgements xi
Introduction 1
1. Why is information security necessary? 9
The nature of information security threats 10
The prevalence of information security threats 12
Impacts of information security threats 13
Cybercrime 15
Cyberwar 17
Future risks 17
Legislation 21
Benefits of an information security management system 21
2. The Combined Code, the Turnbull Report and Sarbanes–Oxley 23
The Combined Code 23
The Turnbull Report 24
The Revised Combined Code 25
Sarbanes–Oxley 28
IT governance 31
ᔢ vi CONTENTS
3. ISO27001 33
Benefits of certification 33
The history of ISO27001 and ISO27002 35
The ISO/IEC 27000 series of standards 36
Use of the standard 37
ISO/IEC 27002 37
The Plan–Do–Check–Act and process approach 39
Structured approach to implementation 40
Quality system integration 42
Documentation 43
Continual improvement and metrics 47
4. Organizing information security 49
Internal organization 50
Management review 51
Information security manager 52
The cross-functional management forum 53
The ISO27001 project group 55
Approval process for information processing facilities 60
Product selection and the Common Criteria 61
Specialist information security advice 62
Contact with authorities and special interest groups 67
Independent review of information security 67
Summary 68
5. Information security policy and scope 69
Information security policy 69
A policy statement 76
Costs and the monitoring of progress 77
6. The risk assessment and statement of applicability 79
Establishing security requirements 79
Risks, impacts and risk management 79
Selection of controls and statement of applicability 93
Gap analysis 97
Risk assessment tools 97
Risk treatment plan 98
Measures of effectiveness 99
7. External parties 101
Identification of risks related to external parties 101
Types of access 103
CONTENTS vii ᔢ
Reasons for access 104
Outsourcing 105
On-site contractors 107
Addressing security when dealing with customers 108
Addressing security in third-party agreements 110
8. Asset management 114
Asset owners 114
Inventory 115
Acceptable use of assets 118
Information classification 118
Unified classification markings 121
Information labelling and handling 123
Non-disclosure agreements and trusted partners 128
9. Human resources security 129
Job descriptions and competency requirements 130
Screening 131
Terms and conditions of employment 134
During employment 136
Disciplinary process 142
Termination or change of employment 142
10. Physical and environmental security 145
Secure areas 145
Public access, delivery and loading areas 154
11. Equipment security 156
Equipment siting and protection 156
Supporting utilities 159
Cabling security 161
Equipment maintenance 162
Security of equipment off-premises 163
Secure disposal or reuse of equipment 164
Removal of property 164
12. Communications and operations management 167
Documented operating procedures 167
Change management 169
Segregation of duties 170
Separation of development, test and operational facilities 171
Third-party service delivery management 172
Monitoring and review of third-party services 173
ᔢ viii CONTENTS
Managing changes to third-party services 174
System planning and acceptance 175
13. Controls against malicious software (malware) and back-ups 180
Viruses, worms and Trojans 181
Spyware 182
Anti-malware software 182
Hoax messages 183
Anti-malware controls 184
Airborne viruses 187
Controls against mobile code 188
Back-up 189
14. Network security management and media handling 193
Network management 193
Media handling 196
15. Exchanges of information 199
Information exchange policies and procedures 199
Exchange agreements 202
Physical media in transit 203
Business information systems 204
16. Electronic commerce services 207
E-commerce issues 207
Security technologies 210
Server security 213
Online transactions 214
Publicly available information 215
17. E-mail and internet use 218
Security risks in e-mail 219
Spam 221
Misuse of the internet 221
Internet acceptable use policy 223
18. Access control 226
Hackers 226
Hacker techniques 227
System configuration 230
Access control policy 231
User access management 233
Clear desk and clear screen policy 242
CONTENTS ix ᔢ
19. Network access control 244
Networks 244
Network security 248
20. Operating system access control 257
Secure log-on procedures 257
User identification and authentication 259
Password management system 259
Use of system utilities 260
Session time-out 260
Limitation of connection time 261
21. Application access control and teleworking 262
Application and information access control 262
Mobile computing and teleworking 264
22. Systems acquisition, development and maintenance 270
Security requirements analysis and specification 271
Correct processing in applications 271
23. Cryptographic controls 275
Encryption 276
Public key infrastructure 277
Digital signatures 278
Non-repudiation services 279
Key management 280
24. Security in development and support processes 282
System files 282
Access control to program source code 284
Development and support processes 284
Vulnerability management 288
25. Monitoring and information security incident management 290
Monitoring 290
Information security events 295
Management of information security incidents and improvements 300
Legal admissibility 305
26. Business continuity management 306
BS25999 307
The business continuity management process 307
Business continuity and risk assessment 308
Developing and implementing continuity plans 309
