es. In
addition, one new section has been
added on information security
incident management (section 13).
TYPES OF INFORMATION
The ISO 27002 standard is all about
information. Since information
can exist in many forms, the ISO 27002 standard takes a very broad
approach. In the context of this standard, the term information
includes at least
- Electronic files
- Software files
- Data files
- Paper documents
- Printed materials
- Hand written notes
- Video recordings
- Audio recordings
- Telephone conversations
- Cell phone conversations
- Face to face conversations
- Email messages
- Fax messages
- Video messages
- Instant messages
- Physical messages
From the standpoint of an organization, information has
is therefore an
asset. It therefore needs to be protected just like
other corporate asset. And because information must be protected, the
information must also be protected.
infrastructure includes all the
systems, and functions
that allow an
organization to manage and control its information
The big question is
how do you protect your information assets? That’s
ISO IEC 27002
standard comes in. It explains what you
can do to protect your
organization’s information assets.
But why should information assets need to be protected?
needs to be protected
because modern organizations are faced with
a wide range of security threats.
threats include everything
error and equipment failure to theft, fraud, vandalism,
sabotage, fire, flood,
and even terrorism.
And because most modern organizations operate in a
interconnected, technological world, information is also vulnerable to
an entirely new set of high-tech threats and attacks. Because of their
interconnectedness, modern organizations are also threatened by
hackers, malicious code, and denial of service attacks.
ISO 27002, information can be protected
using a wide
controls. In addition to hardware and software
controls include things like policies, procedures, processes,
organizational structures. In order to
protect their information,
organizations must develop, implement,
monitor, evaluate, and
improve these types of security controls.
YOUR SECURITY REQUIREMENTS
But how and where do you start? ISO IEC suggests that you begin
by identifying your
organization’s information security needs and
requirements. They suggest
that you identify your security needs
and requirements in the following way:
- Perform a
Identify major security
vulnerabilities. Then determine how likely
it is that each threat
and vulnerability will cause a
security incident. Then evaluate the
potential impact each incident could have on your
given your overall business objectives and strategies. This will
help you to pinpoint your organization’s unique
security needs and requirements.
your legal requirements. Study all the legal, statutory,
regulatory, and contractual requirements that your organization,
and service providers must
meet. Look for all the
information security requirements
that must be met. This will help you to
identify your organization’s
unique legal information security needs and
Examine your own requirements. Examine your organization’s own
information processing principles, objectives, and requirements.
methods and practices
your organization has
developed in order to support its operations.
This will help you to identify
and refine your organization’s unique
information security needs and
YOUR SECURITY PROGRAM
Once you’ve identified your information security needs
you can begin to establish or improve your own
program. Choose from the
practices recommended by the
ISO IEC 27002 2005
standard. Select the
practices that meet your
organization's unique security needs and requirements,
ignore the ones that don't.
ISO IEC suggests that the following security practices
are a good
place to start, and therefore ought to be at the center of your
information security program:
YOUR SUCCESS FACTORS
According to ISO IEC, your organization’s information security program
more successful if you accept the following suggestions:
Make sure that your senior management
and is committed to your
information sec