How Does the New ISO 27001 Impact Your IT Risk Management Processes?
1 like2,145 views
The document discusses changes to the new ISO 27001 standard for information security management systems. Some key changes include new content and requirements numbering, while maintaining backwards compatibility. It emphasizes the importance of risk management, referencing ISO 31000 for enterprise risk management. The new standard provides more flexibility in choosing a risk assessment method. It also requires identifying risks and opportunities, and designating a risk owner to approve treatment plans and accept residual risks.
How Does the New ISO 27001 Impact Your IT Risk Management Processes?
- 1. How Does the new ISO 27001 Impact Your IT Risk Management Processes? Presented by Lars Neupart Founder, CEO of Neupart – The ERP of Security [email protected] twiBer @neupart
- 2. The ISO 2700x standards ISO 27000 • Overview and vocabulary ISO27001 • InformaKon Security Management Systems – Requirements ISO27002 • Code of pracKce for informaKon security management ISO 27003 • ISMS ImplementaKon Guidelines ISO 27004 • InformaKon Security Management -‐ Measurement. ISO27005 • InformaKon Security Risk Management ISO27006 • Requirements for bodies providing audit and cerKficaKon + + + +
- 3. New drafts available ISO 27000 • Overview and vocabulary ISO27001 • InformaKon Security Management Systems – Requirements ISO27002 • Code of pracKce for informaKon security management ISO 27003 • ISMS ImplementaKon Guidelines ISO 27004 • InformaKon Security Management -‐ Measurement ISO27005 • InformaKon Security Risk Management ISO27006 • Requirements for bodies providing audit and cerKficaKon + + + +
- 4. Information Security Management Systems – Requirements ISO 27001 – the 2013 edition ISO/IEC DIS 27001 = draft. I.e. changes are likely to happen Aim of todays webinar is to give you a head start preparing for the new standard so you can have a smoother transition.
- 5. What’s new? • A lot! • New content • New requirements numbering • Still short: 9 pages of requirements to an ISMS • Controls are still listed in Annex A, and referring to ISO 27002 (the new) • Maintaining a fair portion of backwards compatibility
- 6. Poll: How do you use ISO 27001 today? • We are certified • We plan to certify • We plan to comply; no certification • Best practice inspiration • Don't know
- 7. Still risk oriented: • The first requirement in the new ISO 27001 refers to an Enterprise Risk Management Standard: ISO 31000
- 8. ISO 31000 Enterprise Risk Management Plan Do Check Act
- 9. Enterprise Risk Management (ISO 31000) InformaKon Security Risk Management (ISO 27005) ISMS Requirements (ISO 27001)
- 10. ISO 27005 recap
- 11. IT Risk Management -‐ Explained Risk Incident Likelihood Incident Consequence Threat Frequency Threat Effect Threats Preventive Measures Corrective Measures
- 12. Reduce LikelihoodProactive Security IT Security Policy Compliance & Awareness Change Management Operating Procedures Access Control Monitoring System Redundancy Firewall Antivirus Reactive Security Reduce Consequence IT Service Continuity Teams IT Service Continuity Strategy IT Service Continuity Plans Disaster Recovery Procedures Emergency Operations Flexibility Standby Equipment Virtualization Backup IT Risk Management -‐ Explained Risk Prioritization Incident Likelihood Incident Consequence Threat Frequency Threat Effect Threats Preventive Measures Corrective Measures
- 13. Vulnerability & control environment assessment AdministraKve Measures Physical / Technical Measures PrevenKve Measures CorrecKve Measures Firewall AnKvirus Server Cluster RAID Backup Standby Equipment VirtualizaKon Security Policy System DocumentaKon Awareness Compliance Checks Alarm System Fire Suppression Logging Change Management IT Service ConKnuity Plan Disaster Recovery Procedures Business ConKnuity Strategy Redundancy Access Control System Standby Site Server snapshots Assessments based on Capability Maturity Model Monitoring
- 14. Assets: Dependency Hierarchy Business Impact values are inherited downwards Vulnerability values are inherited upwards Server 01 Virtual Server SAN 01 Data Staorage HP DL380 Hardware unit Data Center Oslo Datacenter Finance DB Database ERP IT Service Dynamics AOS Business system HP DL380 Hardware unit Server 02 Virtual Server Finance Business Process
- 15. Comparing ISO 27005, NIST SP800-‐30 ISO 27005 NIST SP800-‐30 Context establishment Identification of assets System Characterization Identification of threats Threat Identification Identification of existing controls Vulnerability Identification Identification of vulnerabilities Control Analysis Identification of consequences Assessment of consequences Likelihood Determination Assessment of incident likelihood Impact Analysis Risk estimation Risk Determination Risk evaluation Risk treatment Control Recommendations Risk acceptance Risk communication Results Documentation
- 16. Examples of how the 27001 update will impact your risk management processes
- 17. 27001: Not only downside risks • 6.1 Actions to address risks and opportunities • Quote ISO 31000: “Organizations of all types and sizes face internal and external factors and influences that make it uncertain whether and when they will achieve their objectives. The effect this uncertainty has on an organization's objectives is “risk”.
- 18. Risk Owner • Risk Owner approves risk treatment plan and accepts residual risks • Note: Asset ownership is formally no longer a ISO 27001 requirement, but it’s still in the annex A Control List. Practically same requirement, as you can’t expect it to not be in your Statement of Applicability
- 19. Increased flexibility in your choice of risk method The organization shall define an information security risk assessment process that: 1. establishes and maintains information security risk criteria, including the risk acceptance criteria; 2. determines the criteria for performing information security risk assessments; and 3. ensures that repeated information security risk assessments produce consistent, valid and comparable results. (section 6.1 )
- 20. Time to vote • What IT risk assessment method or framework do you use today? – ISO 27005 – NIST SP 800 series – IRAM – OCTAVE – Some other threat based approach – Some other control based approach – Don’t know
- 21. The organization shall apply an information security risk treatment process
- 22. Treating Risks Accept Reduce Share Avoid Treatment opKons according to ISO 27001:2005 and ISO 27005. ISO 27001:2013, do not require these specific treatment opKons; but you are free to choose these.
- 23. SoA linked even closer to Risk Treatment Risk treatment SoA = Statement of Applicability • Select treatment options • Determine controls • Check controls with Annex A, verify no necessary controls are omitted • Make SoA and justify exclusions AND inclusions (new) • Clearly worded that you must determine all necessary controls
- 24. Review of Neuparts well known 4 responsible short-‐cuts – do they still apply? Assess your most important assets first (you can add more later) 1: Not all assets Do not use complete threat catalogue on each of your assets (relevant threats depends on asset type) 2: Not all threats • Inheritance: Business impact values inherits downwards • Vulnerability scores inherits upwards • Asset dependencies / Hierarchy 3: Inheritance • Make overall assessment first – refine later • Example: Assess threats combined first – individually later 4: Fewer assessments
- 25. Oh, what happened to PDCA? Plan -‐ Do – Check -‐ Act is still there, now called continual improvement
- 26. Risk Management • Risk Owner • (Assets) • Threats • Business Impact Assessment • Vulnerability Assessment • Reporting & evaluating • Treating (Accept, Reduce, Share, Avoid)
- 27. Time to vote • Will the new ISO improve your risk management processes? – Yes – the update is easy to understand and makes sense – Not much – nothing really new here – I’m concerned of the introduced flexibility – Don’t know
- 28. About Neupart • ISO 27001 certified company • Provides SecureAware®, an all-‐in-‐one, efficient IT GRC solution allowing organizations to automate IT governance, risk and compliance management • “The ERP of Security” • HQ in Denmark, subsidiary in Germany and a 200+ customer portfolio covering a wide range of private enterprises and governmental agencies IT GRC = IT Governance, Risk & Compliance Management
- 29. SecureAware Risk TNG Benefits • Less specialist knowledge needed to conduct professional risk management • Know your IT related business risks • Fast results • Saves time for you and your organization • ISO 27005 based methodology – and fully compatible with NIST SP800-‐30 • Cloud or on-‐premise software
- 30. Try ISO 27001 compliant IT GRC soluKon at www.neupart.com Presented by Lars Neupart Founder, CEO of Neupart – The ERP of Security [email protected] twiBer @neupart