The 2011 Standard of Good Practice For Information Security

The 2011 Standard of Good Practice for Information Security......Page 1
The ISF 2011 Standard of Good Practice......Page 3
The ISF Security Model......Page 4
Contents......Page 5
The ISF Information Risk Management Business Cycle......Page 6
Basis for the 2011 Standard......Page 7
Target audience......Page 8
Enable compliance with ISO 27001 and support compliance with other recognised standards......Page 9
Validate information security arrangements in external suppliers......Page 10
Provide a foundation for your information risk assessment......Page 11
Raise information security awareness......Page 12
Develop or improve specific information security arrangements......Page 13
Modular and Aspect-based formats......Page 14
Relationship between the 2011 Standard and other major information security standards......Page 16
Comparing the 2011 Standard with previous versions......Page 17
Overview......Page 18
Topic layout......Page 19
About the Index......Page 20
SECURITY GOVERNANCE......Page 21
SG1.1 Security Governance Framework......Page 22
SG1.2 Security Direction......Page 24
SG2.1 Information Security Strategy......Page 26
SG2.2 Stakeholder Value Delivery......Page 28
SG2.3 Information Security Assurance Programme......Page 30
SECURITY REQUIREMENTS......Page 33
SR1.1 Managing Information Risk Assessment......Page 34
SR1.2 Information Risk Assessment Methodologies......Page 37
SR1.3 Confidentiality Requirements......Page 39
SR1.4 Integrity Requirements......Page 41
SR1.5 Availability Requirements......Page 43
SR1.6 Information Risk Treatment......Page 45
SR2.1 Legal and Regulatory Compliance......Page 47
SR2.2 Information Privacy......Page 49
CONTROL FRAMEWORK......Page 53
CF1.1 Information Security Policy......Page 56
CF1.2 Information Security Function......Page 58
CF2.1 Staff Agreements......Page 60
CF2.2 Security Awareness Programme......Page 62
CF2.3 Security Awareness Messages......Page 64
CF2.4 Security Education / Training......Page 66
CF2.5 Roles and Responsibilities......Page 68
CF3.1 Information Classification......Page 70
CF3.2 Document Management......Page 72
CF3.3 Sensitive Physical Information......Page 74
CF3.4 Asset Register......Page 76
CF4.1 Application Protection......Page 78
CF4.2 Browser-based Application Protection......Page 80
CF4.3 Information Validation......Page 82
CF5.1 Customer Access Arrangements......Page 83
CF5.2 Customer Contracts......Page 86
CF5.3 Customer Connections......Page 88
CF6.1 Access Control......Page 90
CF6.2 User Authorisation......Page 92
CF6.3 Access Control Mechanisms......Page 93
CF6.4 Access Control Mechanisms – Password......Page 95
CF6.5 Access Control Mechanisms – Token......Page 97
CF6.6 Access Control Mechanisms – Biometric......Page 99
CF6.7 Sign-on Process......Page 101
CF7.1 Computer and Network Installations......Page 102
CF7.2 Server Configuration......Page 104
CF7.3 Virtual Servers......Page 106
CF7.4 Network Storage Systems......Page 108
CF7.5 Back-up......Page 110
CF7.6 Change Management......Page 112
CF7.7 Service Level Agreements......Page 114
CF8.1 Security Architecture......Page 116
CF8.2 Identity and Access Management......Page 119
CF8.3 Critical Infrastructure......Page 121
CF8.4 Cryptographic Solutions......Page 123
CF8.5 Cryptographic Key Management......Page 125
CF8.6 Public Key Infrastructure......Page 127
CF8.7 Information Leakage Protection......Page 130
CF8.8 Digital Rights Management......Page 132
CF9.1 Network Device Configuration......Page 134
CF9.2 Physical Network Management......Page 136
CF9.3 External Network Connections......Page 137
CF9.4 Firewalls......Page 139
CF9.5 Remote Maintenance......Page 141
CF9.6 Wireless Access......Page 142
CF9.7 Voice over IP (VoIP) Networks......Page 144
CF9.8 Telephony and Conferencing......Page 145
CF10.1 Patch Management......Page 146
CF10.2 Malware Awareness......Page 148
CF10.3 Malware Protection Software......Page 149
CF10.4 Security Event Logging......Page 151
CF10.5 System / Network Monitoring......Page 153
CF10.6 Intrusion Detection......Page 154
CF11.1 Information Security Incident Management......Page 156
CF11.2 Cybercrime Attacks......Page 159
CF11.3 Emergency Fixes......Page 161
CF11.4 Forensic Investigations......Page 162
CF12.1 Local Environment Profile......Page 164
CF12.2 Local Security Co-ordination......Page 166
CF12.3 Office Equipment......Page 168
CF13.1 Inventory of Desktop Applications......Page 170
CF13.2 Protection of Spreadsheets......Page 172
CF13.3 Protection of Databases......Page 174
CF13.4 Desktop Application Development......Page 176
CF14.1 Remote Environments......Page 178
CF14.2 Mobile Device Configuration......Page 180
CF14.3 Mobile Device Connectivity......Page 183
CF14.4 Portable Storage Devices......Page 185
CF14.5 Consumer Devices......Page 187
CF15.1 Email......Page 189
CF15.2 Instant Messaging......Page 191
CF16.1 External Supplier Management Process......Page 192
CF16.2 Hardware / Software Acquisition......Page 195
CF16.3 Outsourcing......Page 197
CF16.4 Cloud Computing Policy......Page 199
CF16.5 Cloud Service Contracts......Page 202
CF17.1 System Development Methodology......Page 204
CF17.2 System Development Environments......Page 206
CF17.3 Quality Assurance......Page 207
CF18.1 Specifications of Requirements......Page 208
CF18.2 System Design......Page 210
CF18.3 System Build......Page 212
CF18.4 Systems Testing......Page 214
CF18.5 Security Testing......Page 217
CF18.6 System Promotion Criteria......Page 219
CF18.7 Installation Process......Page 221
CF18.8 Post-implementation Review......Page 222
CF19.1 Physical Protection......Page 223
CF19.2 Power Supplies......Page 225
CF19.3 Hazard Protection......Page 226
CF20.1 Business Continuity Strategy......Page 227
CF20.2 Business Continuity Programme......Page 229
CF20.3 Resilience......Page 231
CF20.4 Crisis Management......Page 233
CF20.5 Business Continuity Planning......Page 235
CF20.6 Business Continuity Arrangements......Page 237
CF20.7 Business Continuity Testing......Page 239
SECURITY MONITORING AND IMPROVEMENT......Page 241
SI1.1 Security Audit Management......Page 242
SI1.2 Security Audit Process – Planning......Page 244
SI1.3 Security Audit Process – Fieldwork......Page 246
SI1.4 Security Audit Process – Reporting......Page 248
SI1.5 Security Audit Process – Monitoring......Page 250
SI2.1 Security Monitoring......Page 251
SI2.2 Information Risk Reporting......Page 253
SI2.3 Monitoring Information Security Compliance......Page 255
Appendices......Page 257
Appendix A: Categories and topics......Page 258
Appendix B: Sources used in developing the 2011 Standard......Page 260
Appendix C: Threat types......Page 261
Appendix D: The 2011 Standard in Aspect format......Page 264
Index......Page 273