Iso-Iec 17799 The New International Standard For Ination Security Management.ppt

1 iso iec17799thenewinternationalstandardforinformationsecuritymanagement carolinehamiltonriskwatch inc withassistancefrom mikenash gammasecuresystemsltdcamberley unitedkingdom 2 importanceofstandards examplesfromamerica spastincluderailroadtracksshoesizing 3 foundingofnist 1901 atthattime theunitedstateshadfew ifany authoritativenationalstandardsforanyquantitiesorproducts whatithadwasapatchworkoflocallyandregionallyappliedstandards oftenarbitrary thatwereasourceofconfusionincommerce itwasdifficultforamericanstoconductfairtransactionsorgetpartstofittogetherproperly constructionmaterialswereofunevenquality andhouseholdproductswereunreliable fewamericansworkedasscientists becausemostscientificworkwasbasedoverseas 4 thebaltimorefireof1904 theneedforstandardswasdramatizedin1904 whenmorethan1 500buildingsburneddowninbaltimore md becauseofalackofstandardfire hosecouplings whenfirefightersfromwashingtonandasfarawayasnewyorkarrivedtohelpdousethefire fewoftheirhosesfitthehydrants nisthadcollectedmorethan600sizesandvariationsinfire hosecouplingsinapreviousinvestigationand afterthebaltimorefire participatedintheselectionofanationalstandard 5 competingstandards us government niststandardsbs7799 iso iec17799standard 6 internationalstandards internationalstandardsininformationsecurityaredevelopedbysecuritytechniquescommitteeiso iecjtc1sc27threeareaswg1 securitymanagementwg2 securityalgorithms techniqueswg3 securityassessment evaluationincludesresponsibilityforiso iec17799 bs7799 themaintopicfortoday 7 history sc27formedin1990replacedpreviousiso iecsecuritycommitteewhichwasfailingtomakeprogressscopeexcludedstandardisationofalgorithms nowrelaxed 8 membership membersofsc27arenationalstandardsbodiesparticipatingorobservingalsoliaisonsfromotherstandardsmakingbodiesorcommitteesworkinggroupsarecomposedofexpertsnominatedbynationalbodiesupto200participatingexperts 9 participatingmembers saiaustraliaibnbelgiumabntbrazilscccanadacsbts cesichinacsniczechrepdsdenmarksfsfinlandafnorfrancedingermanymszthungarybisindiauninfoitalyjiscjapan katskorea repofdsmmalaysianennetherlandsnts itnorwaypknpolandgostrrussianfedsabssouthafricaaenorspainsisswedensnvswitzerlandbsiukdstuukraineansiusa 10 adoptionofnewstandard australia newzealandas nzsiso iec17799 2000theprimaryinformationsecuritystandardinaustraliawasas4444 andinnewzealandwasnzs4444 thesehavebeenreplacedwithanewinternationalstandard 17799 seestandardsaustraliaonlineat au 11 observers asroromaniadsnindonesiaevsestoniaipqportugaliramargentinansaiireland onaustriapsbsingaporesiiisraelsnznewzealandsutnslovakiaszsyugoslavia 12 wg2securitytechniques thereareinternationalstandardsfor encryption wd18033 modesofoperation is8372 messageauthenticationcodes is9797 entityauthentication is9798 non repudiationtechniques is13888 digitalsignatures is9796 is14888 hashfunctions is10118 keymanagement is11770 ellipticcurvecryptography wd15946 timestampingservices wd18014 13 otherstandards usgovernmentstandardsdataencryptionstandard des fips46 advancedencryptionstandard aes fips197 fips federalinformationprocessingstandard proprietarystandardse g rsa therivestshamiradlemanalgorithm 14 wg3securityevaluation thirdpartyevaluationcriteriaforanindependentbodytoformanimpartialandrepeatableassessmentofthepresence correctnessandeffectivenessofsecurityfunctionality commoncriteria cc is15408 15 commoncriteria producedbyaconsortiumofgovernmentbodiesinnorthamerica europeanunionmainlynationalsecurityagenciesinfluencedbyinternationalstandardisationcommitteeadoptedasinternationalstandard15408adoptedandrecognisedbyothermajorgovernmentsalleu australia japan russiareplaces orangebook us anditsec eu 16 contentofcc part1 introductionandgeneralmodelpart2 functionalcomponentspart3 assurancecomponentsrelatedstandards protectionprofileregistrationprocedures is15292 frameworkforassurance wd15443 guideonproductionofprotectionprofiles wd15446 securityevaluationmethodology wd18045 17 relevanceofcc thecommoncriteriaanditspredecessors orangebook itsec raisedthelevelandreliabilityofsecurityfunctionalityfoundinstandardproductsoperatingsystems databases firewallsimportantformajorproductvendorsimportantforhigh riskgovernmentsystemsimportantforsmartcardsirrelevanttoeveryoneelse 18 why commoncriteriaiscomplexevaluationiscomplexandtimeconsuminglimitednumberofapprovedevaluationfacilitiesexpensiveinflexiblemoneyisusuallybetterspentimprovingsecurity 19 wg1securitymanagement twokeystandards guidelinesforinformationsecuritymanagement gmits tr13335 codeofpracticeforinformationsecuritymanagement is17799 otherstandards guidelinesontheuseandmanagementoftrustedthirdparties tr14516 guidelinesforimplementation operationandmanagementofintrusiondetectionsystems wd18043 guidelinesforsecurityincidentmanagement wd18044 20 gmitsand17799 gmitsdevelopedbyiso iecjtc1sc27 standardscommittee is17799is almost identicaltobs7799 1bs7799 1wasthemostwidelypurchasedsecuritystandardworldwideofficially nooverlapthisisrubbishgmitsisdyingscopeisitsecurity notinformationsecurityonlyatr technicalreport editorsofgmitsaremovingtoworkon17799 21 iso iec17799andbs7799 2 is17799isacatalogueofgoodthingstodobs7799part2isaspecificationforanisms informationsecuritymanagementsystem ismscompliancecanbeindependentlyassessed 22 whatisanisms 23 iso iec17799layout 10majorheadings36objectives127majorcontrolsseveralthousandpiecesofguidance 24 the10majorheadings securitypolicysecurityorganisationassetclassificationandcontrolpersonnelsecurityphysicalandenvironmentalsecuritycommsandoperationalmanagementaccesscontrolsystemsdevelopmentandmaintenancebusinesscontinuitymanagementcompliance 25 securityobjectives securitypolicysecurityorganisationassetclassificationandcontrolpersonnelsecurityphysicalandenvironmentalsecuritycommsandoperationalmanagementaccesscontrolsystemsdevelopmentandmaintenancebusinesscontinuitymanagementcompliance secureareasequipmentsecuritygeneralcontrols 26 securitycontrols securitypolicysecurityorganisationassetclassificationandcontrolpersonnelsecurityphysicalandenvironmentalsecuritycommsandoperationalmanagementaccesscontrolsystemsdevelopmentandmaintenancebusinesscontinuitymanagementcompliance secureareasequipmentsecuritygeneralcontrols sitingpowersuppliescablingmaintenanceoff premisesdisposal reuse 27 iso iec17799 astandardforinformationsecuritymanagementverywideacceptancebasedonbritishstandardbs7799replacedpart1ofbs7799part2ofbs7799stillexistsandiscurrentpart2describeshowtobuildandassessasecuritymanagementsystemnationalequivalentstobs7799 2existinmostdevelopedcountriesexceptnorthamerica 28 bs7799 2 ismsrequirementsscopesecuritypolicyriskassessmentstatementofapplicabilitydevelop maintainismsdocumentationiso iec17799controls inimperativeformat 29 complyingwithbs7799 2 securitypolicyriskassessmentstatementofapplicabilitymanagementsystem 30 securitypolicy scopeconfidentialityintegrityavailabilityaccountabilityassetsriskassessmentregulatory legal 31 riskassessment asset vulnerability threat risk 32 statementofapplicability identifiesactualsecuritycontrolsmustconsiderall7799 2listedcontrolsincludeorexcludewithjustificationselectapplicablecontrolsbybusinessandriskanalysis 33 34 35 securitymanagement themeansbywhichmanagementmonitorsandcontrolssecurityrequiresregularchecksthat controlsarestillinplaceandeffectiveresidualrisksarestillacceptableassumptionsaboutthreatsetc remainvalid 36 revisionofis17799