The basic logic of ISO 27001: How does information security work?
ISO 27001 Certification
When talking with another person to ISO 27001 Certification, frequently I experience an identical issue: this individual thinks the quality will describe intimately everything they have to try to to – for instance , how regularly they're going to got to perform backup, how distant their disaster recovery site should be, or maybe worse, which type of innovation they need to use for network protection or how they need to configure the router.
Why is ISO 27001 not prescriptive?
Let’s imagine that the quality recommends that you simply got to perform a backup every 24 hours – is that this the right measure for you? it'd be, but believe me, numerous organizations lately will find this insufficient – the speed of change of their data is so quick that they have to try to to backup if not in real time, then a minimum of every hour. On the opposite hand, there are still some organizations that might find the once-a-day backup too often – their rate of change remains very slow, so performing backup so often would be overkill.
The fact of the matter is– if this standard is to suit any sort of a organization, at that time prescriptive methodology isn't possible. Along these lines, it's simply unimaginable not only to characterize the backup frequency, yet additionally which technology to use, the way to configure each device, etc.
Risk management is that the focal thought of ISO 27001
Things being what they're , “For what reason would i want a typical that does not tell to me anything concretely?”
Because ISO 27001 Certification gives you a structure for you to settle on on appropriate protection. an identical way, e.g., you cannot duplicate a marketing campaign of another organization to your own, this same principle is valid for information security – you've got to tailor it to your particular needs.
And the way ISO 27001:2013 Certification instructs you to realize this tailor-made suit is to perform risk assessment and hazard treatment. this is often nothing but a scientific overview of the bad things which will happen to you (assessing the risks), then deciding which protections to execute to stop those bad things from happening (treating the risks).
The entire thought here is that you simply should execute only those safeguards (controls) that are required due to the risks, not people who somebody believes are fancy; but, this logic also means you ought to implement all the controls that are required due to the risks, which you can't avoid some just because you don’t like them.
IT alone isn't enough
If you're employed within the IT office, you're likely aware that the majority of the incidents are happening not because the PCs broke down, but because the clients from the business side of the association are utilizing the knowledge systems within the incorrect manner.
And such wrongdoings can't be prevented with technical safeguards only – what's also required are clear policies and procedures, training and awareness, legal protection, discipline measures, and so on. Real-life experience has proved that the more diverse safeguards are applied, the upper level of security is achieved.
And once you take under consideration that not all the sensitive information is in digital form (you probably still have papers with tip on them), the top is that IT safeguards aren't enough, which the IT department, although vital in an information security project, can’ run this type of project alone.
Again, this incontrovertible fact that IT security is merely 50% of data security is recognized in ISO 27001 – this standard tells you ways to run the knowledge security implementation as a company-wide project where not only IT, but also the business side of the organization, must participate .
Getting the highest management aboard
But, ISO 27001:2013 Certification doesn’t stop with the implementation of varied safeguards – its authors understood perfectly well that folks from the IT department, or from other lower- or mid-level positions within the organization, cannot achieve much if the executives at the highest don’t do something about it.
For instance, you'll propose a replacement policy for the protection of confidential documents, but if your top management doesn't enforce such policy with all employees (and if they themselves don't suits it), such a policy will never gain an edge in your company.
So, ISO 27001 gives you a scientific checklist of what the highest management must do:
• set their business expectations (objectives) for information security
• publish a policy on the way to control whether those expectations are met
• designate main responsibilities for information security
• provide enough money and human resources
• regularly review whether all the expectations were really met
Not allowing your system to deteriorate
If you're employed during a company for a few of years or more, then you almost certainly skills the new initiatives/projects work – at the start they appear nice and glossy and everybody (or a minimum of most of the people) try to try to to their best to form everything work. However, in time, the interest and therefore the zeal deteriorate, and with them, everything associated with such a project also deteriorates.
For instance, you'll have had a classification policy that worked fine initially, but in time the technology changed, the organization changed and other people changed, and if nobody has cared to update the policy, it'll become obsolete. And, as you're cognizant , nobody will want to suits an obsolete document, meaning that your security will grow worse.
To prevent this, ISO 27001 has described a few of methods that prevent such deterioration from taking place; even more, those methods are wont to improve the safety over time, making it even better than it had been at the time when the project was at its highest. These methods include monitoring and measurement, internal audits, corrective actions, etc.
Comments
Post a Comment