Defining the scope of the Information Security Management System (ISMS) in a company

University Degree Mathematical and Computer Sciences

Learning Task 2

Part 1

Submitted work:

Defining the scope of the Information Security Management System (ISMS) in a company depends on the company itself.

Organisation the Company is a small business with 10 employees which produces printed goods (T-Shirts and other items capable of taking logos, printed text or photos). The company also undertakes other printing work such as business cards, flyers.

Location the Company have permanent premises from which they operate from but also operate and take orders on-line. The website is hosted by an external host.

Assets the company has two computers and printers to produce the printed goods. The company also has materials such as stationary (paper, pens) and materials to produce designs on (T-Shirts).

Technology Outlook Express is used for mail communication. The company must use a range of multimedia software to produce printed goods. The company has two computers one of which is High Spec used for accounting and ordering and the other for the printers.

Information security management system is a set of policies connected with information security management and information security risks. The expressions came from ISO 27001.

“The principle behind ISMS is that an organisation should design, implement and maintain a clear set of policies, processes and systems to manage risks to its information assets, therefore ensuring acceptable levels of information security risk.”

ISMS should be competent in the future and should adapt to changes whether they are internal or external and therefore should integrate the Plan-Do-Check-Act cycle method which will keep it up to date.

PLAN

Establish ISMS policy, objectives, processes in the organisation to manage risks and improve security.

Implement and operate the ISMS policy, controls and processes.

CHECK

Assess and measure process performance against policy and objectives.

ACT

Take corrective and preventative action based on the results of ISMS audit, management review or other relevant information to enable continuous improvement.

Part 2

Submitted work:

The requirement of ISO 27001 are that management:

“Systematically examine the organization's information security risks, taking account of the threats, vulnerabilities and impacts;

Design and implement a coherent and comprehensive suite of information security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable; and

Adopt an overarching management process to ensure that the information security controls continue to ...

This is a preview of the whole essay

ACT

Take corrective and preventative action based on the results of ISMS audit, management review or other relevant information to enable continuous improvement.

Part 2

Submitted work:

The requirement of ISO 27001 are that management:

“Systematically examine the organization's information security risks, taking account of the threats, vulnerabilities and impacts;

Adopt an overarching management process to ensure that the information security controls continue to meet the organization's information security needs on an ongoing basis.”

To ensure compliance with ISO 27001 the company will need to look at Security risks and assess them to do this they will need to:

Create an inventory of information assets
Assign a value to assets
Assess impact rating of assets
Identify threats
Identify and prioritise threats and threat agents
Assess likelihood for vulnerabilities
Calculate relative risk factor for assets

From the above the company will determine whether it is cost beneficial to place for example a lock on the stationary room, if the lock cost more than the stationary then it can indeed be seen as useless reason being that the stationary can be replaced if stolen this would be a cheaper alternative to buying a lock. But a lock could act as a deterrent to stop the theft in the first place.

Web hosting as the site is not hosted by the company is it secure and safe, is it vulnerable to attack from the web hosting side. Secure passwords should be used which use a combination keyboard keys, it is also vital to see what security measures the hosting company has in place. If a hacker gets control of the company’s website then secure card details are at risk.

Online sales are being processed through the website are the credit/debit card details and customer details safe and are they being encrypted e.g. SSL, where are the details being saved and who has access to them. Is the website secure e.g. VeriSign secure SSL or MacAfee hacker tested?

Are there any validations on computerized processes that are completed by employees to reduce human error, e.g. a form would only allow alphabetical letters and not allow numbers in certain text boxes such as ‘Name’ to avoid errors, or have drop down combo boxes for dates.

Data protection is also vital as data should be protected either by access control, encryption and passwords. Only allowing the accounts department access to employee payrolls would increase data protection as the risk of data theft, loss and corruption occurring is reduced. As well as that the company needing to check whether the customer data is secure and employee data is secures as well as it being backed up regularly.

Access Control

Identification

Obtaining the identity of the person requesting access to a logical or physical area. So if an employee wants to login to a workstation they need to identify themselves with a username.

Authentication

Confirming the identity of the person seeking access to a logical or physical area. This links in with identification the user enters a password to authenticate that it is he/she that wants to login; otherwise anyone can login to a workstation with another. Users should have their own usernames and passwords.

Authorization

Determining which actions that a person can perform in that physical or logical area. This is where access control comes into play; authorization is a very big factor in controlling what users can access and what they cannot access. A user (who does not work for the finance department) should not be able to access to financial accounts as this should only be accessed by the finance department, if access was granted the employee could change his pay or others. Access control also narrows down the chances of risks occurring. Each user should have access control on their accounts limiting them to the functions they need to do their job.

Accountability

Documenting the activities of the authorized individual and systems. This is like a web browser which remembers each webpage visited, monitoring software such as Net Support can be used to log what users are accessing and modifying. Everything should be logged to deter employees from wrong doing.

The company uses Outlook for their email requirements. Virus protection should be used to avoid any spam/spoofing/mail bombs. Again is the mail account connected with the hosting provider and does it have a secure password.

Intrusion detection/prevention system (IDPS)

Intrusion detection/prevention system (IDPS) can detect an intrusion and then prevent that intrusion from successfully attacking the company by means of an active response. An IDPS can be configured to notify administrators through e-mail or other forms of communication for pre-determined alarm levels like firewall systems, IDPSs require complex configurations to provide the level of detection and response desired, these do come at a high price so the company may have to bring in an external IT Security Manager or train their current staff if they wish to implement it.

IDPS technologies can respond to a detected threat by attempting to prevent it from succeeding the types of response techniques are:

The IDPS stops the attack itself
The IDPS changes the security environment
The IDPS changes the attack’s content

Forces of Nature:

The company should be ready for any threats from nature; these can include floods, hurricanes/tornadoes, and earthquakes. Each of which can have a devastating effect on the company from taking out the power to destroying the premises where they are based, threats such as these are rare and should be based upon the history of the area in which the premises are located, if near a river then floods could be likely and computers and printers should be placed above the ground floor. Power generators should be used to stop power failure in case of power cuts, but most importantly premises and content should be insured in case of major disasters which could bring down the company.

Software Attack

Virus protection is vital to fight the threat of software attacks regular updates should be checked for and important patches should be installed for the OS. An IDS would detect if any attack was being made and alert the appropriate person to the attack. A ‘Honey pot’ (a decoy system fabricated with useless data) should be deployed to deter hackers to it allowing the IT Security Manager to see where the hack is originating from and to block it.

Premises

The premises should have locks on doors, CCTV and alarmed so that the data on the computers inside the premises is secure and reasonable steps have been taken to secure it

Conclusion:

Overall to comply with ISO 27001 the company needs to start looking at risks starting within the company itself, the employees are the most likely risk, steps should be taken to implement access control to the current system. The external system should be secured by means IDPS, if that is not possible a firewall should be put in place to secure the system and configured for the company’s requirements. The website should be secured if not already even if this means moving to a different host, loosing customer data to hackers could mean a drop in sales as customers will not believe their data is safe within the company, the company being sued under the Data Protection Act 1998.

References:

Websites

http://security.practitioner.com/introduction/infosec_4_4.htm

http://en.wikipedia.org/wiki/ISO/IEC_27001

Books

Implementing ISO27001 in a Windows Environment By Brian Honan

Information Security Based on ISO 27001/ISO 27002: A Management Guide By Alan Calder