ISMS Overview and Components

Information Security Management System (ISMS) Overview

• An information security management system (ISMS) provides confidence that information systems protect data, operate as expected, and are under the control of authorized users.
• ISMS is not purely technical; it involves policies, training, documentation, and technical implementations across the entire organization.
• The ISMS is a crucial component of an organization's management structure, integrated with its processes and controls, and crucial for providing information assurance.
• The ISMS's aim is to preserve confidentiality, integrity, and availability of information by applying risk management.

ISMS Components

• Context: The basis for actions to be taken.
• Scope: Defining what needs protecting or supporting. Establishes the boundaries of the ISMS's application.
• Objectives: Basis for evaluating overall effectiveness, providing assurance and direction to the organization to reach security goals. Aligns objectives with components.
• Policy: High-level statement of security goals for the organization; should be concise and practical for implementation.
• Planning: Aligning objectives with components, managing the program and identifying risks, acceptable risks, and needing controls.
  • Risk assessment (analysis) & treatment: Evaluating existing risks related to assets and controls needed.
  • 'Checklist': Ensuring likely controls are considered.
  • Internal audit, management review, performance improvement, non-conformance, and continuous improvement.
• Statement of Applicability: Documents how the ISMS applies to the organization, clarifying areas of compliance and implementation.
• Assurance processes: Procedures verifying that processes and methods align with the stated objectives.

Scope of ISMS

• Ideally encompasses all levels of the organization, but in practice, it's often limited to sensitive parts due to usability issues. Security measures must balance with usability.

Policy

• A high-level statement defining the organization's security goals.
• Should be concise and easy to implement.

Risk Analysis

• Identifies assets, vulnerabilities, and the likelihood of exploitation.
• Considers the impact if assets were compromised using the CIA triangle (Confidentiality, Integrity, and Availability).
• Evaluates if controls are worthwhile implementing and what those controls should be.
• Key to both IS management and the overall module.
• Outcomes include an asset register and a risk register.

Controls

• Measures to mitigate risks to acceptable levels.
  • Can be categorized as technical, procedural/administrative, or physical.
  • Preventative, detective, or corrective controls.
• Risk reduction is the aim, not complete removal.

Technical Controls

• Use technology to minimize risks.
  • Access control, encryption, anti-virus software, intrusion detection systems, and firewalls.

Procedural/Administrative Controls

• Define behavior within the organization.
  • Password policies, training programs, recruitment policies, fair usage policies, and BYOB (bring your own device) guidance.

Physical Controls

• Deter or prevent access to assets.
  • CCTV cameras, alarm systems, staff cards, and biometrics.

The Security Plan

• Outlines the organization's security strategy.
  • Policy: Security goals.
  • Current state: Overview of the current ISMS and security effort.
  • Requirements: Recommended ways to meet security goals through risk assessments.
  • Recommended controls: Measures to address vulnerabilities.
  • Accountability: Responsibilities for each process stage and assets.
  • Timetable: Deployment schedule.
  • Incident response procedures: Handling breaches.
  • Continuing attention: Frequency of reviews.

Information Security Lifecycle

• This cyclical process, commonly known as the PDCA (Plan-Do-Check-Act) cycle, is essential for continuous improvement in organizational processes and practices. Each phase involves specific actions that help organizations refine their strategies and enhance overall efficiency.

Incident Response

• Attacks will occur despite risk reduction efforts.
  • Staff training to identify and handle incidents.
  • Incident response includes reporting, investigation, assessment, corrective action, and review.
  • Requires a team (IRT) with varied expertise.
• Evidence recording and adherence to laws (e.g., PACE).

Business Continuity Planning

• Maintains business operations after significant incidents or disasters.
  • Identifies key assets critical for operation.
  • Evaluates how long operations can function without those assets. Uses Business Impact Analysis alongside risk assessment.
  • Tests plans for readiness using exercises.

Disaster Recovery Phase

• The time period for restoring services to normal levels after a disaster.
  • Recovery Time Objective (RTO): How long the organization can survive without affected assets.
  • Recovery Point Objective (RPO): The point in time when systems should be restored (usually less than RTO).
  • Disaster recovery plans may become permanent operating procedures.

Key Roles

• Chief Information Security Officer (CISO): Responsible for day-to-day information assurance policies.
• In some organizations, the CISO is at board level for top-down corporate assurance.
  • Important responsibility and accountability at board level.
• Other roles incorporate security activities across the organization.

Summary

• The session provided an overview of the ISMS.
• Described the elements needed for a compliant ISMS and security plan.
• From asset vulnerability assessment to incident recovery.