IT Governance: A Manager's Guide to Data Security and BS 7799 ISO 17799

Half Title Page......Page 2
this page intentionally left blank......Page 3
ITGOVERNANCE 3RD EDITION......Page 4
Publisher’s note......Page 5
Contents......Page 6
Foreword......Page 12
How to use this book......Page 14
Acknowledgements......Page 16
this page intentionally left blank......Page 17
Introduction......Page 18
The information economy......Page 19
What is IT governance?......Page 20
Information security......Page 21
Why is information security necessary?......Page 26
Nature of information security threats......Page 27
Prevalence of information security threats......Page 28
Impacts of information security threats......Page 30
Cybercrime......Page 32
Cyberwar......Page 34
Future risks......Page 35
Legislation......Page 38
Benefits of an information security management system......Page 39
The Combined Code......Page 40
The Turnbull Report......Page 41
Revised Combined Code......Page 42
Internal controls and audit......Page 45
IT governance......Page 47
this page intentionally left blank......Page 49
Benefits of certification......Page 50
History of BS 7799 and ISO/IEC 17799......Page 52
ISO/IEC 17799......Page 53
PDCA and process approach......Page 55
Structured approach to implementation......Page 56
Quality system integration......Page 58
Documentation......Page 59
Leadership......Page 60
Change management......Page 61
Communication......Page 62
Continual improvement and metrics......Page 63
this page intentionally left blank......Page 65
Organizing information security......Page 66
Internal organization......Page 67
Information security manager......Page 68
The cross-functional management forum......Page 70
Members......Page 71
Records......Page 73
Allocation of information security responsibilities......Page 74
Approval process for information processing facilities......Page 76
Product selection and the Common Criteria......Page 77
Specialist information security advice......Page 78
Contact with authorities and special interest groups......Page 83
Independent review of information security......Page 84
Summary......Page 85
Information security policy......Page 86
Who?......Page 88
Where? (Scope of the policy)......Page 89
What?......Page 90
A policy statement......Page 92
Costs and monitoring progress......Page 94
Establishing security requirements......Page 96
Risks, impacts and risk management......Page 97
Who conducts the risk assessment?......Page 99
Qualitative risk analysis......Page 101
Risk assessment (4.2.1.e)......Page 102
Controls (4.2.1.f)......Page 103
Identify the assets......Page 104
Identify relationships between assets and objectives......Page 105
Identify impacts and their probabilities......Page 107
Selection of controls and statement of applicability......Page 110
Risk assessment tools......Page 113
Risk treatment plan......Page 114
Identification of risks related to external parties......Page 116
Types of access......Page 118
Reasons for access......Page 119
Outsourcing......Page 120
On-site contractors......Page 122
Addressing security when dealing with customers......Page 123
Addressing security in third party agreements......Page 124
Asset owners......Page 128
Inventory......Page 129
Information classification......Page 132
Unified classification markings......Page 135
SEC1......Page 137
Legal disclaimer......Page 138
SEC2......Page 139
SEC3......Page 140
Non-disclosure agreements and trusted partners......Page 142
this page intentionally left blank......Page 143
Human resources security......Page 144
Job descriptions and competence requirements......Page 145
Screening......Page 146
Terms and conditions of employment......Page 149
During employment......Page 151
Disciplinary process......Page 156
Termination or change of employment......Page 157
Secure areas......Page 160
Physical security perimeter......Page 161
Physical entry controls......Page 163
Securing offices, rooms and facilities......Page 165
Working in secure areas......Page 167
Public access, delivery and loading areas......Page 168
Equipment siting and protection......Page 170
Supporting utilities......Page 173
Cabling security......Page 175
Equipment maintenance......Page 176
Security of equipment off-premises......Page 177
Removal of property......Page 178
Documented operating procedures......Page 180
Change management......Page 182
Segregation of duties......Page 183
Separation of development, test and operational facilities......Page 184
Third party service delivery management......Page 185
Monitoring and review of third party services......Page 186
Managing changes to third party services......Page 187
Capacity planning......Page 188
System acceptance......Page 189
this page intentionally left blank......Page 193
Viruses, worms and Trojans......Page 194
Anti-malware software......Page 196
Hoax messages......Page 197
Anti-malware controls......Page 198
Airborne viruses......Page 201
Back-up......Page 202
Network management......Page 206
Security of network services......Page 208
Management of removable computer media......Page 209
Information handling procedures......Page 210
Security of system documentation......Page 211
Information exchange policies and procedures......Page 212
Exchange agreements......Page 215
Business information systems......Page 216
E-commerce issues......Page 220
Security technologies......Page 223
Secure sockets layer (SSL)......Page 224
Server security......Page 225
Online transactions......Page 226
Publicly available information......Page 227
E-mail and internet use......Page 230
Security risks in e-mail......Page 231
Misuse of the internet......Page 233
Internet acceptable use policy (AUP)......Page 235
Hackers......Page 238
Hacker techniques......Page 239
Access control policy......Page 242
User access management......Page 245
User registration......Page 246
Privilege management......Page 249
User password management......Page 250
Review of user access rights......Page 251
User responsibilities – password use......Page 252
Clear desk and clear screen policy......Page 253
this page intentionally left blank......Page 255
Networks......Page 256
Extranets......Page 257
Wireless networks......Page 258
Firewalls and network perimeter security......Page 260
Routers and switches......Page 262
User authentication for external connections......Page 263
Equipment identification in the network......Page 264
Segregation in Networks......Page 265
Network connection control......Page 266
Network routing control......Page 267
Secure log-on procedures......Page 268
Password management system......Page 270
Session time-out......Page 271
Limitation of connection time......Page 272
this page intentionally left blank......Page 273
Application and information access control......Page 274
Information access restriction......Page 275
Mobile computing and teleworking......Page 276
Mobile computing......Page 277
Teleworking......Page 279
Security requirements analysis and specification......Page 282
Correct processing in applications......Page 283
Input data validation......Page 284
Control of internal processing......Page 285
Output data validation......Page 286
this page intentionally left blank......Page 287
Cryptographic controls......Page 288
Symmetric encryption......Page 289
Public key infrastructure (PKI)......Page 290
Digital signatures......Page 291
Key management......Page 292
this page intentionally left blank......Page 295
Control of operational software......Page 296
Protection of system test data......Page 297
Change control procedures......Page 298
Technical review of applications after operating system changes......Page 299
Information leakage......Page 300
Outsourced software development......Page 301
Vulnerability management......Page 302
Monitoring......Page 304
Monitoring system use......Page 305
Protection of log information......Page 306
Administrator and operator logs......Page 307
Clock synchronization......Page 308
Reporting information security events......Page 309
Reporting software malfunctions......Page 312
Reporting security weaknesses......Page 313
Responsibilities and procedures......Page 314
Learning from incidents......Page 316
Collection of evidence......Page 317
this page intentionally left blank......Page 319
Business continuity management......Page 320
Business continuity management process......Page 321
Business continuity and risk assessment......Page 322
Developing and implementing continuity plans......Page 323
Business continuity planning framework......Page 324
Testing, maintaining and reassessing business continuity plans......Page 328
Compliance......Page 332
Identification of applicable legislation......Page 333
Data Protection Act 1998 (DPA)......Page 335
Privacy and Electronic Communications Regulations 2003......Page 337
Computer Misuse Act 1990 (CMA)......Page 338
Copyright, Designs and Patents Act 1988 (CDPA)......Page 339
Regulation of Investigatory Powers Act 2000 (RIPA)......Page 340
Intellectual property rights (IPR)......Page 341
Software copyright......Page 342
Safeguarding of organizational records......Page 345
Data protection and privacy of personal information......Page 347
Regulation of cryptographic controls......Page 348
Compliance with security policy and standards......Page 349
Technical compliance checking......Page 351
Protection of information system audit tools......Page 352
Note......Page 353
Selection of auditors......Page 354
Initial audit......Page 356
Preparation for audit......Page 357
Appendices......Page 360
this page intentionally left blank......Page 361
BS 7799 certification organizations......Page 362
Information security......Page 363
Accounting, finance and economics......Page 366
Contingency planning and disaster recovery......Page 367
Information technology......Page 368
Risk management......Page 369
ISO/IEC 17799:2005......Page 370
this page intentionally left blank......Page 371
Further reading......Page 372
Index......Page 374