Factores y Medidas en ISMS

ISMS Factors and Measurements

• A factor is an attribute of an ISMS that can change over time.
• A measurement is a quantitative observation of a factor at a specific point in time.
• A baseline is a reference value for a factor, indicating a condition is met.
• A metric is a derived value from comparing multiple measurements, or against a baseline.
• Good metrics are relevant, quantifiable, actionable, robust, simple, and comparative.
• An indicator details a key element of an ISMS's effectiveness.
• A KPI (Key Performance Indicator) is a significant indicator comparing ISMS performance to goals.
• KRIs (Key Risk Indicators) measure the inherent risk in certain actions.

ISMS Risk Management

• Privileged user accounts present significant organizational risk, requiring careful management.
• User accounts should be suspended when a user leaves permanently or for an extended period.

Business Continuity and Disaster Recovery

• Data backups should be verified for usability for data restoration.
• Business continuity describes the processes to keep vital business functions operational during incidents.
• Disaster recovery focuses on restoring information systems after a disaster.

Security Training and Awareness

• Security training equips people for specific security functions effectively.
• Security awareness training educates people about security issues to better recognize and respond to them.
• Social engineering manipulates individuals to violate security protocols.
• Phishing is social engineering employing digital communication.

Additional Concepts

• A drive-by download is an automatic attack triggered by visiting a malicious website.
• Disaster recovery and business continuity should be regularly evaluated to remain effective.
• Reports should be tailored to their audience for effectiveness.
• Management reviews determine if information security management systems effectively meet goals.