Security Mgt U3, BS7799 (Part 1)

Security Mgt U3, BS7799 (Part 1)

1. BS7799 (ISO 17799)

   • originally published as a code of practice
   • standards for information security management
   • outlines risk analysis and management
   • don't have to certify whole business
   • foundations of BS7799 (image)
     • [Image: https://lh6.googleusercontent.com/-f6Kk9fXgL-s/UV_a5iweR8I/AAAAAAAAAck/g0rFxMeOSJo/s600/triangle+of+bs7799.png]
   • why?
     • develop best practice
     • helps realize security policy
     • value proposition
       • propmise of value to be deliverd and belief of customer in that value
     • introduce benchmark standards
     • builds business confidence
     • international standard
     • easy and flexible architecture
     • provide secuity
       • # of apps and complexity growing
       • information theft
         • motivations: COMIC
           • Commercial
             • someone gets commercial advantage by using or blocking our information
           • Opportunist
             • people happen upon bad security controls and suddenly have opportunity
           • Monetary
             • someone is paid to steal or attack
           • Idealist
             • hacktivist
           • can-do
             • they do it just because they can
       • CIA
         • confidentiality
         • integrity
         • availability
     • legislation
       • human rights act
       • computer misuse act
         • covers unauthorized
           • viewing
           • copying
           • modification
       • computer design and patent act
       • regulation of investagatory powers act
       • FAST: federation against software theft
         • http://www.fastiis.org/
       • Protect your IP (intellectual property)
         • If you do not demonstrate that you had the appropriate controls in place, you will lose a case in court.

2. critical success factors

   • KPIs (key performance indicators)
   • policies, objectives, activities that reflect business objectives
   • appropriate resources
   • consistency with business culture
   • visible commitment from management
   • effective awareness, education and training
   • distribution to all employees, partners and suppliers

3. controls

   • key controls
     • info sec policy
     • info sec education and training
     • security incident reporting
     • virus controls
     • business continuity planning (BCP)
     • software copying control
     • company record safegarding
     • data protection compliance
     • compliance with security policy
   • selection
     • identify business objectives
     • identify business strategy
     • identify controls relative to risk
       • with risk, don't forget areas of inpact such as reputation and customer confidence