Public How to gain and maintain ISO 27001 certification GÉANT SIG ISM 1 st Workshop, 2015-05-12, imperial.ac.uk Urpo Kaila, Head of Security CSC – IT Center for Science ltd. urpo.kaila@csc.fi, security@csc.fi
Agenda � Introduction � Scope and objectives of security � ISO/ IEC 27001:2013 � How CSC gained the certification � Learning from the certification experience � Ideas for cooperation 2
About CSC � CSC offers IT services for research, higher education, culture, and government � CSC provides scientific software and databases and Finland’s supercomputing environment that researchers can use via the Funet network � CSC - IT Center for Science Ltd. is a government owned, non-profit company 270 administered by the Ministry of Education and Culture Employees 3
CSC Services Computing Services • Research Information Management • Services Funet Network Services • Ministry of Education and Culture • Education Management and Student • Other ministries and state • Administration Services administration Identity and Access Management • Higher education institutions • Services Research institutions • Datacenter and Capacity Services • Companies • (IaaS) Training Services • Consultation and Tailored Solutions •
About myself Industry background � – Previously IT Manager – Later Presales manager/ Technical director in an IT security company At CSC since 2003 � – Previously manager for Internal IT, Datacenters – Information Security Manager – In charge of risk management, information security, operational security, incidents, security agreements, physical security, cyber security Security Officer for the EUDAT project � – A Collaborative Data Infrastructure for European researchers to preserve, find, access, and process data in a trusted environment 5
Example of EUDAT Services: B2DROP B2DROP is a secure and trusted data exchange service for researchers and scientists to keep their research data synchronized and up-to-date and to exchange with other researchers. An ideal solution to: Store and exchange data with � colleagues and team Synchronize multiple versions of data � Ensure automatic desktop � synchronization of large files
A pan European a network of collaborating, Consortium cooperating centres, combining the richness of numerous community-specific data repositories with the permanence and persistence of some of Europe’s largest scientific data centres e-Science Data Factory
Scope and objectives for security � Technical approach to security – Firewalls, vulnerabilities, intrusions, malware,… � Security management approach – Business objectives, availability, processes, governance � Narrow but deep scope: Incidents, IT risks, technology � Broader scope: people, processes ,business risks, stakeholders, management 8
What is information security all about? � Information security is about protecting assets (systems, data, services and reputation) against risks with security controls � Assets can be protected to prevail their – Confidentiality – Integrity – Availability � Information Security: – a building block of quality – implemented by security controls – management accountable but responsibility of all staff
Security vs. usability Security • The direct or indirect Usability benefits and • The perceived cost of security benefit and quality controls of a service/product Should be in a reasonable balance based on risk management 10
ISO/ IEC 27001:2013 � “Cuddle name”: ‘ISO27k’ � Background: BS7799 � Update of the standard :2005 - :2013 � Is the international standard for information security management systems � Organisations can apply for certification covering a scope of it’s activities by an accredited certification body 11
Other standards and best practices COBIT � National security standards � – IT-Grundschutzhandbuch ISO/IEC 15408 (Common criteria) � SCI (Security for Collaborating Infrastructures) � SANS Best Practices � TERENA Best Practices � Industry related regulation (for operators, e.g.) � Skills oriented certifications: CISSP, GCIH, GCED, � CISM,… 12
ISO 27001 practicalities � The big global players Google, MS, and Amazon has also achieved the certification for some of their core functions � Successful certification requires – Documented management support – An approved Statement of Applicability – Systematic management reviews of your information security management system (ISMS) – ISMS should be known, in use and documented 13
Why ISO 27001? � The standard can provide a comprehensive guidance for your ISMS � A systematic framework and checklist to motivate all stakeholders - managament, administrators, all staff, customers, providers – to information security � A clear indication to all stakeholders of a serious effort to implement comprehensive ISMS 14
ISO27001 Pros and Cons ISO 27001 will not guarantee good information security � True. Also possible to create a compliant but a counter � productive ISMS and achieve certification ISO 27001 will require excess bureacracy � – Depends. It is up to you to define how to comply with the standard � Certification is expensive – Depends. You don’t have to use expensive consultants to create your ISMS. The audits are not that expensive but not free either. 15
ISO27001 Pros and Cons (Contd.) Security should not be a management concern � Wrong. � ISO 27001 is just about creating policies nobody � reads. Wrong, the policies and guidelines must be known and � in use to achieve certification After achieving certification everything is forgotten � Wrong. Maintaining certification is often harder than � achieving it – requires continuous improvement We are so good that we don’t need standards… � The ad hoc way is more efficient and secure… � 16
The structure of the standard � Ten high level clauses and Annex A � New controls in the 2013 version: A.6.1.5 Information security in project management A.12.6.2 Restrictions on software installation A.14.2.1 Secure development policy A.14.2.5 Secure system engineering principles A.14.2.6 Secure development environment A.14.2.8 System security testing A.15.1.1 Information security policy for supplier relationships A.15.1.3 Information and communication technology supply chain A.16.1.4 Assessment of and decision on information security events A.16.1.5 Response to information security incidents A.17.2.1 Availability of information processing facilities 17
Annex A A.5: Information security policies (2 controls) A.6: Organization of information security (7 controls) A.7: Human resource security – (6 controls) A.8: Asset management (10 controls) A.9: Access control (14 controls) A.10: Cryptography (2 controls) A.11: Physical and environmental security (15 controls) A.12: Operations security (14 controls) A.13: Communications security (7 controls) A.14: System acquisition, development and maintenance (13 controls) A.15: Supplier relationships (5 controls) A.16: Information security incident management (7 controls) A.17: Business continuity management (4 controls) 18 A.18: Compliance; (8 controls)
The Audit (1/2) Must be preceded by � – Approval of SOA – Internal audits/reviews – (Pre-audit) During audit � – A systematic enquiry if SOA is compliant with the standard and implanted comprehensively – Management and staff are interviewed – Auditors gather systematically evidence to verify compliance with the standard – Verifying skills and security culture also a crucial part of the audit 19
The Audit (2/2) � � After audit – Non- compliances þ – Reporting fixes of non-compliances ý – Obtaining certification status ý – Surveillance audits (once p.a.) ý – Re-audits (every third year) ý – Enlarging audit scope? 20
How CSC gained the certification (1/2) Attended training on BS7799 in 2004 � Frustration with insufficient commitment and the � ad hoc approach on security Saw risks with over focusing on technical � implementations and with emotional reactions to security hype Frustration with non-coherent national security � standards Began to motivate management to apply for ISO � 27001 certification 21
How CSC gained the certification (2/2) CSC gained ISO27001 certification for Datacenter Kajaani � on summer 2013 Certification scope enlarged to cover all data centers 2014 � Certification scope enlarged to cover all ICT platforms � Certification for compliance with the 2013 version of the � standard Surveillance certification 2015 with no non-conformities � New services to be included in next phase � 22
23
Learning from the certification experience � The decision to strive for ISO 27001 certification included some risks but has shown to be very beneficial for CSC � The certification process helped us to: – Implement a comprehensive ISMS – Motivate management and all staff – Improve security culture and management � Now the ISO 27001 certifications status is a part of CSC communication package 24
Recommend
More recommend
