Information Security

ISO 27001

ISO 27001 is a specification for the management of Information Security. It is applicable to all sectors of industry and commerce and not confined to information held on computers. It addresses the security of information in whatever form it is held. The information may be printed or written on paper, stored electronically, transmitted by post or email, shown on films, or spoken in conversation. Whatever form the information takes, or means by which it is shared or stored, ISO 27001 helps an organization ensure it is always appropriately protected.

Information security can be characterized as the preservation of:
Scanning systems have great Confidentiality - ensuring that access to information is appropriately authorized. Integrity - safeguarding the accuracy and completeness of information and processing methods. Availability - ensuring the authorized users have access to information when they need it.

ISO 27001 contains a number of control objectives and controls. These include:

Security policy
Organizational security
Asset classification and control
Personnel security
Physical and environmental security
Communications and operations management
Access control
System development and maintenance
Incident Response
Business continuity management
Compliance

Why is information Security Neeeded?

Information is now globally accepted as being a vital asset for most organizations and businesses. As such, the confidentiality, integrity, and availability of vital corporate and customer information may be essential to maintain competitive edge, cash-flow, profitability, legal compliance and corporate image. ISO 27001 is intended to assist with this task. It is easy to imagine the consequences for an organization if its information was lost, destroyed, corrupted, burnt, flooded, sabotaged or misused. In many cases it can (and has) led to the collapse of companies.

How do you start to implement ISO 27001? What is involved?

Developing an Information Security Management System (ISMS) that satisfies the requirements of ISO 27001 involves three steps:

Creation of a management framework for information

This sets the direction, aims, and objectives of information security and defines a policy which has management commitment.

Identification and assessment of security risks

Security requirements are identified by a methodical assessment of security risks. The results of this assessment will help guide and determine the appropriate management action and priorities for managing information security risks.

Selection and implementation of controls

Once security requirements have been identified, controls should be selected and implemented. The controls need to ensure that risks are reduced to an acceptable level and meet an organization's specific security objectives. Controls can be in the form of policies, practices, procedures, organizational structures and software functions. They will vary from organization to organization. Expenditure on controls needs to be balanced against the business harm likely to result from security failures.

Adopting ISO 27001 cannot make your organization immune from security breaches. But, it will make them less likely and reduce the consequential cost and disruption if they do occur.

Being Audited to ISO 27001

Once all the requirements of ISO 27001 have been met, you can apply for an external audit. This should be carried out by a third party - an accredited certification body.
The chosen certification body will firstly review relevant documentation. This should include the declared policy, scope of the ISMS, documents covering the risk assessment, risk treatment plan, statement of applicability, and documented security procedures. The auditors will also be checking that you have identified and implemented the controls that are appropriate to your size and type of business. This process is normally carried out at your premises, being more beneficial to both parties.

This is followed at a later date by a full on-site audit to ensure that working practices observe these procedures and stated objectives, and that appropriate records are kept. After a successful audit, a certificate of registration to ISO 27001 will be issued. It is followed by surveillance audits (usually once or twice a year) to ensure that the system continues to work.

What are the Benefits of Certification to ISO 27001?

Obtaining a certificate from a third party certification body demonstrates that you have addressed, implemented and controlled the security of your information. But the benefits don't stop there. Certification also:

Comforts customers, employees, trading partners and stakeholders - in the knowledge that your management information and systems are secure.
Demonstrates credibility and trust.
Can lead to cost savings. Even a single information security breach can involve significant costs.
Establishes that relevant laws and regulations are being met.
Ensures that a commitment to Information Security exists at all levels throughout an organization.

Security Awareness the missing link?

Information technology use is constantly on the rise in all types of organizations. We today live in a networked digital world where most information is communicated through computer systems. This form of work organization has offered us tremendous benefits constantly motivating us to explore new opportunities. There is however, an equal need to keep our network information technology infrastructures secure and disaster free. Conventional systems security is of the view that well designed physical and logical security system can guarantee organizational information security. To this end technology has come a long way; firewalls, anti-virus software, encryption, intrusion detection, smart cards and fingerprint scanning systems have greatly enhanced modern security infrastructure. Security breaches however are still on the rise worldwide. Since early 2005, more than 150 million personal records have been exposed (Privacy rights clearing house, 2007). Everyday there are reports of security breaches from all sectors and industries.

The missing link and the weakest link in the security infrastructure chain are humans. When technology is operated and used by humans the possibilities of error multiply. Simply forgetting to 'log off ' from a system can have dire consequences for a company both in terms of cost and reputation. Studies have shown that 'being unaware' and 'forgetting' are the primary reasons for unintentional human error. Thus the human/social aspect of security is as important as the technical one. Organizations need to make their employees aware of information security and develop 'safe systems use' habits amongst them.