Identify :: Align :: Remedy :: Verify :: Secure

113 Pages·2008·0.68 MB·English

Developing and Auditing an
Effective Information Security
Management System through
COBIT and ISO 27001/27002
Javed Ikbal
www.zsquad.com
ISACA Rhode Island, November 15, 2007
© 2007 Javed Ikbal
Identify :: Align :: Remedy :: Verify :: Secure
Goals
Understand the problems with a typical

information security organization
Understand ISO 27001 and 27002

standards and COBIT
Understand an ISO 2700x view of an ideal

information security management system
Using COBIT to fill in the gaps

Following ISO 2700x even if it is not

required
How (not) to do it

2
Identify :: Align :: Remedy :: Verify :: Secure
Problems with a typical
information security organization
3
Identify :: Align :: Remedy :: Verify :: Secure
Genesis of Security Organizations
Information security organizations are

often created organically.
-
IT personnel handle security
Often, only network security, virus

-
Importance of security grows
-
Split up in a separate security group.
Information security groups often last to

be audited, if at all.
Result: Sub-optimal security organization

4
Identify :: Align :: Remedy :: Verify :: Secure
In a nutshell
This seminar will cover the issues around

creating (or re-engineering) an effective
security organization, and how Auditors
can educate and guide in that effort.
5
Identify :: Align :: Remedy :: Verify :: Secure
ISMS?
Information Security's biggest problem: it

often ignores process and people
Maintaining the Confidentiality, Integrity

and Availability of Data and Services =
Information Security
6
Identify :: Align :: Remedy :: Verify :: Secure
ISMS?
CIA: Confidentiality, Integrity and

Availability of Data
-
At what cost?
-
What data?
-
Who says so?
ISMS: If business risk is used to

evaluate, decide and implement
information security, we have an
Information Security Management
Systems
7
Identify :: Align :: Remedy :: Verify :: Secure
In practice, incomplete ISMS
Unclear division of responsibility

Ineffective information security

organization
Inadequate management support

Lack of clear policy direction

Poorly managed outsourcing

Risk management ignored

Lack of awareness

Inadequate physical security

Unproven business continuity plans

8
Identify :: Align :: Remedy :: Verify :: Secure
Unclear division of responsibility
Too many cooks?

-
Security
-
Legal/Compliance
-
Operational risk mgmt
-
Quality
-
Safety
Known and unknown

inconsistencies
Policy-storm

Inefficient processes

Unhappy users

- “Not another one”
- May ignore
- May even hinder
9
Identify :: Align :: Remedy :: Verify :: Secure
Ineffective infosecurity organization
The struggle for hearts, minds and $$

-
Information security?
-
Physical security?
-
Change management?
-
Audit?
Who is responsible?

- Security gap
Who is accountable?

- Inconsistency and gap
Who should be consulted?

- Gap
Who should be informed?

- Gap
10
Identify :: Align :: Remedy :: Verify :: Secure