ISO/IEC 27001:2005, part of the growing ISO/IEC 27000 family of standards, is an information security management system (ISMS) standard published in October 2005 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its full name is ISO/IEC 27001:2005 – Information technology – Security techniques – Information security management systems – Requirements. As of July 2013[update], a new version is in draft: ISO/IEC 27001:2013. ISO 27001:2013 has been available in its release form since 25 September 2013.
ISO/IEC 27001:2005 formally specifies a management system that is intended to bring information security under explicit management control. Being a formal specification means that it mandates specific requirements. Organizations that claim to have adopted ISO/IEC 27001 can therefore be formally audited and certified compliant with the standard (more below).
The standard contains 11 domains(apart from introductory sections)
- Security policy - management direction
- Organization of information security - governance of information security
- Asset management - inventory and classification of information assets
- Human resources security - security aspects for employees joining, moving and leaving an organization
- Physical and environmental security - protection of the computer facilities
- Communications and operations management - management of technical security controls in systems and networks
- Access control - restriction of access rights to networks, systems, applications, functions and data
- Information systems acquisition, development and maintenance - building security into applications
- Information security incident management - anticipating and responding appropriately to information security breaches
- Business continuity management - protecting, maintaining and recovering business-critical processes and systems
- Compliance - ensuring conformance with information security policies, standards, laws and regulations
- 1 How the standard works
- 2 The PDCA Cycle
- 3 Origins of ISO/IEC 27001
- 4 Certification
- 5 ISO 27001:2005 Domains
- 6 See also
- 7 References
- 8 External links
How the standard works
|This section does not cite any references or sources. (February 2012)|
Most organizations have a number of information security controls. However, without an information security management system (ISMS), controls tend to be somewhat disorganized and disjointed, having been implemented often as point solutions to specific situations or simply as a matter of convention. Security controls in operation typically address certain aspects of IT or data security specifically; leaving non-IT information assets (such as paperwork and proprietary knowledge) less protected on the whole. Moreover business continuity planning and physical security may be managed quite independently of IT or information security while Human Resources practices may make little reference to the need to define and assign information security roles and responsibilities throughout the organization.
ISO/IEC 27001 requires that management:
- Systematically examine the organization's information security risks, taking account of the threats, vulnerabilities, and impacts;
- Design and implement a coherent and comprehensive suite of information security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable; and
- Adopt an overarching management process to ensure that the information security controls continue to meet the organization's information security needs on an ongoing basis.
The key benefits of 27001 are:
- It can act as the extension of the current quality system to include security
- It provides an opportunity to identify and manage risks to key information and systems assets
- Provides confidence and assurance to trading partners and clients; acts as a marketing tool
- Allows an independent review and assurance to you on information security practices
A company may want to adopt ISO 27001 for the following reasons:
- It is suitable for protecting critical and sensitive information
- It provides a holistic, risk-based approach to secure information and compliance
- Demonstrates credibility, trust, satisfaction and confidence with stakeholders, partners, citizens and customers
- Demonstrates security status according to internationally accepted criteria
- Creates a market differentiation due to prestige, image and external goodwill
- If a company is certified once, it is accepted globally.
While other sets of information security controls may potentially be used within an ISO/IEC 27001 ISMS as well as, or even instead of, ISO/IEC 27002 (the Code of Practice for Information Security Management), these two standards are normally used together in practice. Annex A to ISO/IEC 27001 succinctly lists the information security controls from ISO/IEC 27002, while ISO/IEC 27002 provides additional information and implementation advice on the controls. The domains covered by ISO 27002 include
- Security policy
- Organization of information security
- Asset management
- Human resources security
- Physical and environmental security
- Communications and operations management
- Access control
- Information systems acquisition, development and maintenance
- Information security incident management
- Business continuity management
- Regulatory compliance
Organizations that implement a suite of information security controls in accordance with ISO/IEC 27002 are simultaneously likely to meet many of the requirements of ISO/IEC 27001, but may lack some of the overarching management system elements. The converse is also true, in other words, an ISO/IEC 27001 compliance certificate provides assurance that the management system for information security is in place, but says little about the absolute state of information security within the organization. Technical security controls such as antivirus and firewalls are not normally audited in ISO/IEC 27001 certification audits: the organization is essentially presumed to have adopted all necessary information security controls since the overall ISMS is in place and is deemed adequate by satisfying the requirements of ISO/IEC 27001. Furthermore, management determines the scope of the ISMS for certification purposes and may limit it to, say, a single business unit or location. The ISO/IEC 27001 certificate does not necessarily mean the remainder of the organization, outside the scoped area, has an adequate approach to information security management.
Other standards in the ISO/IEC 27000 family of standards provide additional guidance on certain aspects of designing, implementing and operating an ISMS, for example on information security risk management (ISO/IEC 27005).
The PDCA Cycle
- Plan (establishing the ISMS)
- Establish the policy, the ISMS objectives, processes and procedures related to risk management and the improvement of information security to provide results in line with the global policies and objectives of the organization.
- Do (implementing and workings of the ISMS)
- Implement and exploit the ISMS policy, controls, processes and procedures.
- Check (monitoring and review of the ISMS)
- Assess and, if applicable, measure the performances of the processes against the policy, objectives and practical experience and report results to management for review.
- Act (update and improvement of the ISMS)
- Undertake corrective and preventive actions, on the basis of the results of the ISMS internal audit and management review, or other relevant information to continually improve the said system.
Origins of ISO/IEC 27001
The first part, containing the best practices for information security management, was revised in 1998; after a lengthy discussion in the worldwide standards bodies, it was eventually adopted by ISO as ISO/IEC 17799, "Information Technology - Code of practice for information security management." in 2000. ISO/IEC 17799 was then revised in June 2005 and finally incorporated in the ISO 27000 series of standards as ISO/IEC 27002 in July 2007.
The second part of BS7799 was first published by BSI in 1999, known as BS 7799 Part 2, titled "Information Security Management Systems - Specification with guidance for use." BS 7799-2 focused on how to implement an Information security management system (ISMS), referring to the information security management structure and controls identified in BS 7799-2. This later became ISO/IEC 27001:2005. The 2002 version of BS 7799-2 introduced the Plan-Do-Check-Act (PDCA) cycle (Deming cycle), aligning it with quality standards such as ISO 9000. BS 7799 Part 2 was adopted by ISO as ISO/IEC 27001 in November 2005.
BS 7799 Part 3 was published in 2005, covering risk analysis and management. It aligns with ISO/IEC 27001:2005.
An ISMS may be certified compliant with ISO/IEC 27001 by a number of Accredited Registrars worldwide. Certification against any of the recognized national variants of ISO/IEC 27001 (e.g. JIS Q 27001, the Japanese version) by an accredited certification body is functionally equivalent to certification against ISO/IEC 27001 itself.
In some countries, the bodies that verify conformity of management systems to specified standards are called "certification bodies", while in others they are commonly referred to as "registration bodies", "assessment and registration bodies", "certification/ registration bodies", and sometimes "registrars".
The ISO/IEC 27001 certification, like other ISO management system certifications, usually involves a three-stage external audit process defined by the ISO/IEC 17021 and ISO/IEC 27006 standards:
- Stage 1 is a preliminary, informal review of the ISMS, for example checking the existence and completeness of key documentation such as the organization's information security policy, Statement of Applicability (SoA) and Risk Treatment Plan (RTP). This stage serves to familiarize the auditors with the organization and vice versa.
- Stage 2 is a more detailed and formal compliance audit, independently testing the ISMS against the requirements specified in ISO/IEC 27001. The auditors will seek evidence to confirm that the management system has been properly designed and implemented, and is in fact in operation (for example by confirming that a security committee or similar management body meets regularly to oversee the ISMS). Certification audits are usually conducted by ISO/IEC 27001 Lead Auditors. Passing this stage results in the ISMS being certified compliant with ISO/IEC 27001.
- Stage 3 involves follow-up reviews or audits to confirm that the organization remains in compliance with the standard. Certification maintenance requires periodic re-assessment audits to confirm that the ISMS continues to operate as specified and intended. These should happen at least annually but (by agreement with management) are often conducted more frequently, particularly while the ISMS is still maturing.
ISO 27001:2005 Domains
The asset register documents the assets of the company or scope in question. The asset management domain deals with analyzing and attaining the necessary level of protection of organizational assets. The typical objectives of the asset management domain is to identify and create an inventory of all assets, establish an ownership on all assets identified, establish a set of rules for the acceptable use of assets, establish a framework for classification of assets, establish an asset labeling and handling guideline. Asset management, broadly defined, refers to any system that monitors and maintains things of value to an entity or group. It may apply to both tangible assets such as buildings and to intangible concepts such as intellectual property and goodwill.
An asset is anything that has value to the organization. Assets can include infrastructure (e.g. buildings, store houses, towers etc.), physical assets ( computer equipment, communications, utility equipment, heavy machinery), software assets ( applications, software code, development tools, operational software etc.), information (database information, legal documentation, manuals, policies & procedures, organizational documents etc.), services ( transport, air conditioning, communications, utilities etc.), people (management, skills, experience etc.) and imperceptible (reputation, image etc.).
Asset management is a systematic process of operating, maintaining, upgrading, and disposing of assets cost-effectively. Organizations need to identify all assets and create and maintain security controls around them. For each asset a designated owner needs to be made responsible for implementation of appropriate security controls. When creating an asset management policy the organization needs to define the scope of the policy (which parts of the organization are covered under the policy), responsibility (who is ultimately responsible for the policy), compliance (is compliance mandatory or not, what are the guidelines to follow), waiver criteria (on what basis can someone ask for a waiver) and effective date (from when to when is the policy applicable).
Typical policy statements for Asset Management include:
- All assets shall be clearly identified, documented and regularly updated in an asset register
- All assets shall have designated owners and custodians listed in the asset register
- All assets will have the respective CIA (Confidentiality, Integrity and Availability) rating established in the asset register
- All employees shall use company assets according to the acceptable use of assets procedures
- All assets shall be classified according the asset classification guideline of the company
Asset management consists of all the activities associated with ongoing management and tracking of assets some of which are as follows: asset discovery (physical & logical), create & maintain conclusive software library, create & maintain conclusive hardware stock, configuration management, physical asset tracking, software license management, request & approval process, procurement management, contract management, assessment on ISO 27001 and PCI controls, supplier/ vendor management, re-deployment & movement, retire & disposal Management, compliance to laws if applicable etc.
Typically all business functions are required to maintain an asset register of their business units. The asset register is required to contain, at a minimum, the following information about the assets: the asset identifier, the asset name, the type and location of assets; the name of the function and process that uses this asset, the asset owner, custodian and user and the CIA (Confidentiality, Integrity, Availability) ratings of the asset. Organizations can choose to include additional information in the asset register as deemed necessary; for example, IT assets can have IP addresses as part of the asset register.
For all asset registers, a primary person responsible for the asset register needs to be identified. Typically the business unit head or director is the owner of the asset register and recognized functional heads identified are asset custodians. The asset owner is accountable for the comprehensive protection of assets owned by him/her. The asset owner may delegate the responsibility of applying the relevant controls for the maintenance of the assets to an individual/ function referred to as the ‘asset custodian’. It is the responsibility of the asset custodian to implement appropriate security controls that are required for the protection of information assets. It is the responsibility of all employees and third party staff to maintain the confidentiality, integrity and availability of the assets that they use.
Assets need to be classified in order to provide an appropriate level of protection for a certain category of assets. Information assets need to be classified in terms of its value, requirements and criticality to the business operations of the company. Typical company classification guidelines follow restrictive principles. Some of the common classifications criteria which are used by companies are given below:
CONFIDENTIAL: This category refers to asset information that relates to individuals or is otherwise restricted only to authorized users, and if disclosed outside the company would harm the organization, its customers, or its partners. This classification applies to any sensitive business information which is intended for use within the company. Examples of confidential information include customer information, negotiating positions, marketing strategy, personnel information, internal company memos and presentations
RESTRICTED: The restricted level of asset information pertains to highly sensitive information to the company; which when disclosed would cause substantial damage to the reputation and competitive position of the company in the market. Its unauthorized disclosure could adversely impact its business, its shareholders, its business partners and/ or its customers, leading to legal and financial repercussions and adverse public opinion. Examples of restricted information are details of major acquisitions, divestments and mergers, business and competition strategy, sensitive customer, competitor, partner or contractor assessments, intellectual property information, law enforcement and government related information.
INTERNAL: This classification refers to asset information that is potentially available to all personnel within the company, but is not public. This can also include information that is restricted to a group or project within the company, but is not designated as “Private” or “Restricted.” Examples of internal information include product design information, system documentation, company employee details, company organizational charts, minutes of department meetings.
PUBLIC: This classification refers to asset information that has been published or obtainable from a published source, e.g. the Internet. Example of public information include published marketing material, company public statements or announcements, published company performance information, published job vacancies.
All important and critical assets to the company shall be labeled physically / electronically as per the information labeling and handling procedures of the company. The asset owners are required to ensure that their assets are appropriately labeled (marked) for ease of identification. This may exclude information classified as ‘public’. For each classification level, the handling procedures should include the assets introduction; secure processing, storage; transmission and destruction. Classification level must be indicated wherever possible for all forms of physical / electronic information that are sensitive in nature. For example: subject of email stamped with “Confidential” etc.
The access control domain deals with implementation of access controls across all electronic forms of information processing systems like operating systems, applications, networks or mobile platforms. Access control is the selective restriction of access to a place or other resource. Typically an organizations access control policy establishes the requirement of controls that need to be implemented for controlling access to information, information processing facilities and business processes on the basis of business and security requirements. The policy should aim to control the assimilation, authorization, and dissemination of information in a controlled manner. The typical organizational objectives of the access control policy are to establish a procedure for user registration and de-registration, establish a procedure to grant the correct level of access privilege, establish a procedure to control password use, password change and password removal, establish a procedure for managements review of access rights, establish a procedure for unattended equipment, maintain a clear desk policy, establish a procedure to control network service access, establish a control method for authentication of remote users, establish a procedure for configuration ports, establish a procedure to segregate networks, establish a procedure to use precise routing controls, establish a procedure to control system utilities and to establish a procedure to secure communications over mobile computing devices.
A registered user is one who uses an information processing facility and provides his/her credentials, effectively proving his/her identity. Generally speaking, any person can become a registered user by providing some credentials, usually in the form of a username (or email) and password. After that, one can access information and privileges unavailable to non-registered users, usually referred to simply as guests. The action of providing the proper credentials for a system is called logging in, or signing in. Without proper policies to govern user registration, unauthorized people can gain access to confidential company information and leak it out causing harm to the organization economic status and repute. Organizations need to establish a user registration procedure which shall include controls for operating systems and applications access.
Typical policy statements can include:
- All users shall have a unique user ID based on a standard naming convention
- A formal authorization process shall be defined and followed for provisioning of user IDs.
- An audit trail shall be kept of all requests to add, modify or delete user accounts/IDs
- User accounts shall be reviewed at regular intervals
- Employee shall sign a privilege form acknowledging their access rights
- Access rights will be revoked for employee changes or leaving jobs
- Privileges shall be allocated to individuals on a ‘need-to-have’ basis.
- A record of all privilege accounts shall be maintained and updated on regular basis
The password management deals with allocation, regulation and change of password rules of the organization. Organizations face significant security exposure in the course of routine IT operations. For example, dozens of system administrators may share passwords for privileged accounts on thousands of devices. When system administrators move on, the passwords they used during their work often remain unchanged, leaving organizations vulnerable to attack by former employees and contractors.
Weak password management means that the most sensitive passwords are often the least well defended. The need to coordinate password updates among multiple people and programs makes changing the most sensitive passwords technically difficult. Inability to secure sensitive passwords exposes organizations to a variety of security exploits. Strong, manual controls over access to privileged accounts may sometimes create unanticipated risks, such as impaired service in IT operations and escalation of physical disasters from one site to an entire organization. Inability to associate administrative actions with the people who initiated them may violate internal control requirements.
Typical organizational password management policies include:
- Users shall be forced to change their passwords at the time of first use
- Passwords shall have a minimum length of eight characters
- Passwords for all users shall expire in 30/60 days
- A record of five previous passwords shall be maintained to prevent re-use of these passwords
- A maximum of three successive login failures shall result in a user’s account being locked out
- Passwords shall not be displayed in clear text when they are being keyed in
- Passwords must include at least one small character (a-z), one capital character (A-Z) and one numeric character (0 – 9) / one special character (@ # $ & / +)
- All password entry tries shall be logged along with date, time, ip address, machine name, application and user ID for successful, unsuccessful login attempts
Clear Work Environment
The clear work environment can go a long way in securing the organizations security situation. Most important organizational documents are generally lying around on employee’s desks on desktops open to privy to all individuals within the company. The main reasons for a clean desk policy are manifold including: a clean desk can produce a positive image when our customers visit the company; it reduces the threat of a security incident as confidential information will be locked away when unattended, sensitive documents left in the open can be stolen by a malicious entity.
Example of clear work environment policies include:
- Critical information shall be protected when not required for use
- Only authorized users shall use the photocopier machines
- All loose documents from employee’s desks shall be confiscated at the end of business day
- A users desktop shall not contain reference to any document directly or indirectly
Operating System & Application Control
Management of configurable security controls that are built into the operating system or application. In the scope of the ISMS framework, objective is to ensure system / application security settings are restrictive enough to protect the system (information) whilst not adversely impacting availability to the business (end user).
If an attacker can easily view someone's username and password, he can impersonate that user, and do massive damage by modifying critical information, read corporate emails, damage corporate websites etc. The procedure to log into an operating system or application control should minimize the risk of unauthorized access. The procedure shall therefore follow a strict set of rules to govern what information is displayed to the potential user during the process of log-in.
Sample operating system and application control policies include:
- All users in the organization shall have a unique ID
- No systems or application details shall be displayed before log-in
- In the condition of log-in failure, the error message shall not indicate which part of the credential is incorrect
- The number of unsuccessful log-in attempts shall be limited to 3/5/6 attempts
- During log-in process, all password entries shall be hidden by a symbol
- The use of system utility program shall be restricted e.g. password utility
- All operating systems and application shall time out due to inactivity in 5/10/15/30 minutes
- All applications shall have dedicated administrative menus to control access rights of users
Network security assumes importance to the organization when viewed in light that networks change frequently as new users and devices are added and newer data communication technologies are introduced, usage of various networking, communications, and computing technologies to effectively meet the expanding need, sensitive data is increasingly transmitted over networks, proliferation of internet access has increased the vulnerability as employees use internet more for information and knowledge.
The primary objectives of a network security policy should be to ensure that access to company’s network is only provided to authorized users, that adequate controls are in place to manage remote users, that all equipment can be recognized uniquely, that networks should be segregated based on needs, and that appropriate network routing protocols are enabled.
Typical policy statements for Network Security include:
- Appropriate authentication mechanisms shall be used to control the access by remote users.
- Allocation of network access rights shall be provided as per the business and security requirements
- Two-factor authentication shall be used for authenticating users using mobile/remote systems
- ISO/IEC JTC 1/SC 27 - IT Security techniques
- ISO/IEC 27000-series
- ISO/IEC 27001:2013
- ISO 9001
- ISO/IEC 15408
- BS 7799
- Cyber security standards
- International Organization for Standardization
- List of ISO standards
- Standard of Good Practice published by the Information Security Forum
- ISO 27001 and ISO 27002 User Group
- ISO 17799 and ISO 27001 Wiki
- Opensource software to support ISO 27001 PDCA/ISMS processes