IT Governance: A Manager's Guide to Data Security and ISO 27001 ISO 27002

0749452714......Page 1
Contents......Page 6
Acknowledgements......Page 12
Introduction......Page 14
1 Why is information security necessary?......Page 22
The nature of information security threats......Page 23
The prevalence of information security threats......Page 25
Impacts of information security threats......Page 26
Cybercrime......Page 28
Future risks......Page 30
Benefits of an information security management system......Page 34
The Combined Code......Page 36
The Turnbull Report......Page 37
The Revised Combined Code......Page 38
Sarbanes–Oxley......Page 41
IT governance......Page 44
Benefits of certification......Page 46
The history of ISO27001 and ISO27002......Page 48
The ISO/IEC 27000 series of standards......Page 49
ISO/IEC 27002......Page 50
The Plan–Do–Check–Act and process approach......Page 52
Structured approach to implementation......Page 53
Quality system integration......Page 55
Documentation......Page 56
Continual improvement and metrics......Page 60
4 Organizing information security......Page 62
Internal organization......Page 63
Management review......Page 64
The information security manager......Page 65
The cross-functional management forum......Page 66
The ISO27001 project group......Page 68
Approval process for information processing facilities......Page 73
Product selection and the Common Criteria......Page 74
Specialist information security advice......Page 75
Independent review of information security......Page 80
Summary......Page 81
Information security policy......Page 82
A policy statement......Page 89
Costs and the monitoring of progress......Page 90
Risks, impacts and risk management......Page 92
Selection of controls and statement of applicability......Page 106
Risk assessment tools......Page 110
Risk treatment plan......Page 111
Measures of effectiveness......Page 112
Identification of risks related to external parties......Page 114
Types of access......Page 116
Reasons for access......Page 117
Outsourcing......Page 118
On-site contractors......Page 120
Addressing security when dealing with customers......Page 121
Addressing security in third-party agreements......Page 123
Asset owners......Page 127
Inventory......Page 128
Information classification......Page 131
Unified classification markings......Page 134
Information labelling and handling......Page 136
Non-disclosure agreements and trusted partners......Page 141
9 Human resources security......Page 142
Job descriptions and competency requirements......Page 143
Screening......Page 144
Terms and conditions of employment......Page 147
During employment......Page 149
Termination or change of employment......Page 155
Secure areas......Page 158
Public access, delivery and loading areas......Page 167
Equipment siting and protection......Page 169
Supporting utilities......Page 172
Cabling security......Page 174
Equipment maintenance......Page 175
Security of equipment off-premises......Page 176
Removal of property......Page 177
Documented operating procedures......Page 180
Change management......Page 182
Segregation of duties......Page 183
Separation of development, test and operational facilities......Page 184
Third-party service delivery management......Page 185
Monitoring and review of third-party services......Page 186
Managing changes to third-party services......Page 187
System planning and acceptance......Page 188
13 Controls against malicious software (malware) and back-ups......Page 193
Viruses, worms and Trojans......Page 194
Anti-malware software......Page 195
Hoax messages......Page 196
Anti-malware controls......Page 197
Airborne viruses......Page 200
Controls against mobile code......Page 201
Back-up......Page 202
Network management......Page 206
Media handling......Page 209
Information exchange policies and procedures......Page 212
Exchange agreements......Page 215
Physical media in transit......Page 216
Business information systems......Page 217
E-commerce issues......Page 220
Security technologies......Page 223
Server security......Page 226
Online transactions......Page 227
Publicly available information......Page 228
17 E-mail and internet use......Page 231
Security risks in e-mail......Page 232
Misuse of the internet......Page 234
Internet acceptable use policy......Page 236
Hackers......Page 239
Hacker techniques......Page 240
System configuration......Page 243
Access control policy......Page 244
User access management......Page 246
Clear desk and clear screen policy......Page 255
Networks......Page 257
Network security......Page 261
Secure log-on procedures......Page 270
Password management system......Page 272
Session time-out......Page 273
Limitation of connection time......Page 274
Application and information access control......Page 275
Mobile computing and teleworking......Page 277
22 Systems acquisition, development and maintenance......Page 283
Correct processing in applications......Page 284
23 Cryptographic controls......Page 288
Encryption......Page 289
Public key infrastructure......Page 290
Digital signatures......Page 291
Non-repudiation services......Page 292
Key management......Page 293
System files......Page 295
Development and support processes......Page 297
Vulnerability management......Page 301
Monitoring......Page 303
Information security events......Page 308
Management of information security incidents and improvements......Page 313
Legal admissibility......Page 318
26 Business continuity management......Page 319
The business continuity management process......Page 320
Business continuity and risk assessment......Page 321
Developing and implementing continuity plans......Page 322
Business continuity planning framework......Page 324
Testing, maintaining and reassessing business continuity plans......Page 328
27 Compliance......Page 332
Identification of applicable legislation......Page 333
Intellectual property rights......Page 342
Safeguarding of organizational records......Page 347
Data protection and privacy of personal information......Page 348
Prevention of misuse of information processing facilities......Page 349
Compliance with security policies and standards, and technical compliance checking......Page 350
Information systems audit considerations......Page 353
28 The ISO27001 audit......Page 355
Selection of auditors......Page 356
Initial audit......Page 357
Preparation for audit......Page 358
Terminology......Page 360
Appendices......Page 362
Appendix 1 Useful websites......Page 364
Appendix 2 Further reading......Page 372
Index......Page 376