IS Audit
IS Audit
I S O 2 7 0 0 1
ISO 27001: This International Standard covers all types of organizations (e.g. commercial enterprises, government agencies, non-profit organizations). International Standard specifies the requirements for establishing; implementing, operating, monitoring, reviewing, maintaining and improving documented ISMS within the context of the organizations overall business risks. It specifies requirements for the implementation of security controls customized to the needs of individual organizations or parts thereof. The ISMS is designed to ensure the selection of adequate and proportionate security controls that protect information assets and give confidence to interested parties
1
Features
F E A T U R E S
P D C A
PDCA Process
Interested Parties
ISMS PROCESS
Management Responsibility
Interested Parties
PLAN
P R O C E S S
Establish ISMS
DO
Implement & Operate the ISMS
ACT
Maintain & Improve
CHECK
Monitor &
Review ISMS
4/12/2014
Mohan Kamat
C O N T R O L C L A U S E S
Information Security Policy - To provide management direction and support for Information security. Organisation Of Information Security Management framework for implementation
Asset Management - To ensure the security of valuable organisational IT and its related assets
Human Resources Security - To reduce the risks of human error, theft, fraud or misuse of facilities. Physical & Environmental Security -To prevent unauthorised access, theft, compromise , damage, information and information processing facilities.
4/12/201
Mohan Kamat
C O N T R O L C L A U S E S
Communications & Operations Management - To ensure the correct and secure operation of information processing facilities. Access Control - To control access to information and information processing facilities on need to know and need to do basis. Information Systems Acquisition, Development & Maintenance - To ensure security built into information systems Information Security Incident Management - To ensure information security events and weaknesses associated with information systems are communicated.
4/12/201
Mohan Kamat
C O N T R O L C L A U S E S
Business Continuity Management - To reduce disruption caused by disasters and security failures to an acceptable level. Compliance - To avoid breaches of any criminal and civil law, statutory, regulatory or contractual obligations and of any security requirements.
4/12/201
Mohan Kamat
I M P L E M E N T A T I O N
P R O C E S S C Y C L E
IS POLICY
SECURITY ORGANISATION
MANAGEMENT REVIEW
Establish ISMS
ASSET IDENTIFICATION & CLASSIFICATION
PLAN
DO
ACT
Review ISMS
CONTROL SELECTION & IMPLEMENTATION OPERATIONALIZ E THE PROCESES CHECK PROCESSES
Monitor &
CHECK
4/12/201
Mohan Kamat
B E N E F I T S
At the organizational level Commitment At the legal level Compliance At the operating level - Risk management At the commercial level - Credibility and confidence At the human level - Improved employee awareness
4/12/201
Mohan Kamat
S C O P E O F
ISMS RGANISATION
Scope of ISMS
I S M S
Data Center DR site All Information, IT, Service and People Asset
4/12/201
Mohan Kamat
D O C U M E N T E D I S M S
ISMS ORGANISATION
Documented ISMS Apex Security Policy Specific policies eg. Physical & Environment Policy, E-mail Policy, HR, Incident Management etc Procedures, Guidelines and Records
4/12/201
Mohan Kamat
10
V I S I O N
ISMS ORGANISATION
Vision ORGANISATION would be a role model for having robust Information Security Management System Implementation with continual improvements, which assure and pervade very sphere of its activities and functional domains. Mission
& M I S S I O N
Empowerment of Information Security Management System through implementing best practices for People, Process and Technology.
Information Security is responsibility of everyone
4/12/201
Mohan Kamat
11
S E C U R I T Y
ISMS ORGANISATION
O R G A N I S A T I O N
Security Organisation Apex Committee ISMS Forum ISMS Task Force Incident Response BCP Team DRP Team Audit Committee
4/12/201
Mohan Kamat
12
S E C U R I T Y
ISMS ORGANISATION
Security Organization
O R G A N I S A T I O N
Apex Committee :
CEO CTO/CISO Service Head Technology Head (CTO) Head HR Project Managers Administrators IS Team Member
Appointed by Apex Committee Appointed by Apex Committee /ISMS Forum
ISMS Forum:
IS Task Force :
Audit Committee:
4/12/201
Mohan Kamat
I C N L F A O S S A I S F S I E C T A T I O N
4/12/201
Mohan Kamat
14
I C N L F A O S S A I S F S I E C T A T I O N
Low
Explanation Non-sensitive information available for public disclosure. The impact of unauthorized disclosure of such information shall not harm Organisation anyway. E.g. Press releases, Companys News letters e.g. Information published on companys website Information belonging to the company and not for disclosure to public or external parties. The unauthorized disclosure of information here can cause a limited harm to the organization. e.g. Organization Charts, Internal Telephone Directory. Information which is very sensitive or private, of highest value to the organization and intended to use by named individuals only. The unauthorized disclosure of such information can cause severe harm (e.g. Legal or financial liability, adverse competitive impact, loss of brand name). E.g. Clients pricing information, Merger and Acquisition related information, Marketing strategy
Mohan Kamat
Medium
High
4/12/201
15
I C N L F A O S S A I S F S I E C T A T I O N
Explanation There is minimal impact on business if the accuracy and completeness of data is degraded. There is significant impact on business if the asset if the accuracy and completeness of data is degraded. The Integrity degradation is unacceptable.
High
4/12/201
Mohan Kamat
16
I C N L F A O S S A I S F S I E C T A T I O N
High
4/12/201
Explanation There is minimal impact on business if the asset / information is not Available for up to 7 days There is significant impact on business if the asset / information is not Available for up to 48 hours The Asset / information is required on 24x7 basis
Mohan Kamat
17
N C O L N A S I S N I F F O I C A A S T S I E O T N
Explanation Information processed / stored / carried or services rendered by the asset in the business process have confidentiality requirements as LOW. Information processed / stored / carried or services rendered by the asset in the business process have confidentiality requirements as Medium. Information processed / stored / carried or services rendered by the asset in the business process have confidentiality requirements as HIGH.
Mohan Kamat
Medium
High
4/12/201
18
P E O P L E
A S S E T
C L A S S I F I C A T I O N
People Assets
Information is accessed or handled by the people from within the organisation as well as the people related to organisation for business requirements. It becomes necessary to identify such people from within the organisation as well as outside the organisation who handle the organizations information assets. The analysis such people, who has access rights to the assets of the organisation, is to be done by Business Process Owner i.e. process / function head. The people assets shall include roles handled by a. Employees b. Contract Employees c. Contractors & his employees
4/12/201
Mohan Kamat
19
P E O P L E
A S S E T
C L A S S I F I C A T I O N
Medium
High
Explanation The role or third party identified has access limited to information assets classified as 'Public'. Security breach by individual/s whom the role is assigned would insignificantly affect the business operations. The role or third party identified has access limited to information assets classified as 'Internal and 'Public'. Security breach by individual/s whom the role is assigned would moderately affect the business operations. The role employee or third party identified has access to all types of information assets including information assets classified as 'Confidential' Or IT Assets classified as 'Critical'. Security breach by individual/s to whom the role is assigned would severely affect the business operations.
4/12/201
Mohan Kamat
20
P E O P L E
A S S E T
C L A S S I F I C A T I O N
Medium
High
4/12/201
Mohan Kamat
21
P E O P L E
A S S E T
C L A S S I F I C A T I O N
Explanation Unavailability of the individual/s whom the role is assigned would have insignificant affect the business operations. Unavailability of the individual/s whom the role is assigned would moderately affect the business operations. Unavailability of the individual/s whom the role is assigned would severely affect the business operations.
4/12/201
Mohan Kamat
22
U S E R
R E S P O N S I B I L I T I E S
in
operations
area
without
prior
Bring and use pen drives, zip drives, ipods, other storage devices unless and otherwise authorized to do so
4/12/201
Mohan Kamat
23
U S E R
R E S P O N S I B I L I T I E S
Password Guidelines
Always use at least 8 character password with combination of alphabets, numbers and special characters (*, %, @, #, $, ^) Use passwords that can be easily remembered by you Change password regularly as per policy Use password that is significantly different from earlier passwords
Use passwords which reveals your personal information or words found in dictionary Write down or Store passwords Share passwords over phone or Email Use passwords which do not match above complexity criteria
4/12/201
Mohan Kamat
24
U S E R
R E S P O N S I B I L I T I E S
Internet Usage
Use internet services for business purposes only
Do not access internet through dial-up connectivity Do not use internet for viewing, storing or transmitting obscene or pornographic material Do not use internet for accessing auction sites Do not use internet for hacking other computer systems Do not use internet to download / upload commercial software / copyrighted material Technology Department is continuously monitoring Internet Usage. Any illegal use of internet and other assets shall call for Disciplinary Action.
4/12/201
Mohan Kamat
25
U S E R
R E S P O N S I B I L I T I E S
E-mail Usage
Use official mail for business purposes only Follow the mail storage guidelines to avoid blocking of E-mails If you come across any junk / spam mail, do the following a) Remove the mail. b) Inform the security help desk c) Inform the same to server administrator d) Inform the sender that such mails are undesired
Do not use official ID for any personal subscription purpose Do not send unsolicited mails of any type like chain letters or E-mail Hoax Do not send mails to client unless you are authorized to do so Do not post non-business related information to large number of users Do not open the mail or attachment which is suspected to be virus or received from an unidentified sender
4/12/201
Mohan Kamat
26
27