Information Security Risk Management for ISO27001/ISO27002

Steve Watkins, Alan Calder, Alan Calder

• Publisher: ITGP
• Year: 2010
• eBook ISBN:
  9781849281492
• Topic: Informatique
• Subtopic: Cybersécurité

Plan and carry out a risk assessment to protect your business information.

In the knowledge economy, organisations have to be able to protect their information assets. Information security management has, therefore, become a critical corporate discipline. The international code of practice for an information security management system (ISMS) is ISO27002.

As the code of practice explains, information security management enables organisations to 'ensure business continuity, minimise business risk, and maximise return on investments and business opportunities'.

Information Security Management System requirements

The requirements for an ISMS are specified in ISO27001. Under ISO27001, a risk assessment has to be carried out before any controls can be selected and implemented, making risk assessment the core competence of information security management.

This book provides information security and risk management teams with detailed, practical guidance on how to develop and implement a risk assessment in line with the requirements of ISO27001.

International best practice

Drawing on international best practice, including ISO/IEC 27005, NIST SP800-30 and BS7799-3, the book explains in practical detail how to carry out an information security risk assessment. It covers key topics, such as risk scales, threats and vulnerabilities, selection of controls, and roles and responsibilities, and includes advice on choosing risk assessment software.

Benefits of a risk assessment

• Stop the hacker. With a proper risk assessment, you can select appropriate controls to protect your organisation from hackers, worms and viruses, and other threats that could potentially cripple your business.

• Achieve optimum ROI. Failure to invest sufficiently in information security controls is 'penny wise, pound foolish', since, for a relatively low outlay, it is possible to minimise your organisation's exposure to potentially devastating losses. However, having too many safeguards in place will make information security system expensive and bureaucratic; so without accurate planning your investment in information security controls can become unproductive. With the aid of a methodical risk assessment, you can select and implement your information security controls to ensure that your resources will be allocated to countering the major risks to your organisation. In this way, you will optimise your return on investment.

• Build customer confidence. Protecting your information security is essential if you want to preserve the trust of your clients and to keep your business running smoothly from day to day. If you set up an ISMS in line with ISO27001, then, after an assessment, you can obtain certification. Buyers now tend to look for the assurance that can be derived from an accredited certification to ISO27001 and, increasingly, certification to ISO27001 is becoming a prerequisite in service specification procurement documents.

• Comply with corporate governance codes. Information security is a vital aspect of enterprise risk management (ERM). An ERM framework is required by various corporate governance codes, such as the Turnbull Guidance contained within the UK's Combined Code on Corporate Governance, and the American Sarbanes-Oxley Act (SOX) of 2002, and standards such as ISO310000.

As the authors point out, 'Just because a threat has not occurred yet does not mean that it never will'.

Information Security Risk Management for ISO27001 / ISO27002

ALAN CALDER

STEVE G WATKINS

ABOUT THE AUTHORS

Alan Calder is the founder director of IT Governance Ltd (www.itgovernance.co.uk), an information, advice and consultancy firm that helps companies tackle governance, risk management, compliance and information security issues. He has many years of senior management and board-level experience in the private and public sectors. The company’s website is a ‘one-stop-shop’ for information, books, tools, training and consultancy on governance, risk management, compliance and information security.

Steve G Watkins leads the consultancy and training services of IT Governance Ltd. In his various roles in both the public and private sectors, he has been responsible for most support disciplines. He has over 20 years’ experience of managing integrated management systems, including maintenance of information security, quality, environmental and Investors in People certifications. As well as being a lead auditor for ISO27001 and ISO9000, Steve is a trained EFQM assessor and holds diplomas in safety and financial management. He is Chair of the ISO/IEC 27001 User Group, the UK Chapter of the ISMS International User Group and was recently invited to become, and is now, an ISMS Technical Expert for UKAS, advising on their assessments of certification bodies offering ISO27001 accredited certification. Steve sits on the Management Committee of the British Standards Society where he chairs the Corporate Governance Group and is an active member of the committee responsible for writing BS31100, the British Standard for Risk Management (Code of Practice).

Alan Calder and Steve G Watkins have written a number of other books together, including:

• IT Governance: A Manager’s Guide to Data Security and ISO 27001/ISO 27002 (fourth edition published by Kogan Page, 2007)

• International IT Governance: An Executive Guide to ISO 17799/ISO 27001 (published by Kogan Page, 2006)

• ISO27001 and Information Security: A Glossary (published by ITGP, 2010).

A list of all their publications can be found at the back of this book.

CONTENTS

Introduction

Chapter 1: Risk Management

Risk management: two phases

Enterprise risk management

Chapter 2: Risk Assessment Methodologies

Publicly available risk assessment standards

Qualitative versus quantitative

Quantitative risk analysis

Qualitative risk analysis – the ISO27001 approach

Other risk assessment methodologies

Chapter 3: Risk Management Objectives

Risk acceptance or tolerance

Information security risk management objectives

Risk management and PDCA

Chapter 4: Roles and Responsibilities

Senior management commitment

The (lead) risk assessor

Other roles and responsibilities

Chapter 5: Risk Assessment Software

Gap analysis tools

Vulnerability assessment tools

Penetration testing

Risk assessment tools

Risk assessment tool descriptions

Chapter 6: Information Security Policy and Scoping

Information security policy

Scope of the ISMS

Chapter 7: The ISO27001 Risk Assessment

Overview of the risk assessment process

Chapter 8: Information Assets

Assets within the scope

Grouping of assets

Asset dependencies

Asset owners

Sensitivity classification

Are vendors assets?

What about duplicate copies and backups?

Identification of existing controls

Chapter 9: Threats and Vulnerabilities

Threats

Vulnerabilities

Technical vulnerabilities

Chapter 10: Impact and Asset Valuation

Impacts

Defining impact

Estimating impact

The asset valuation table

Business, legal and contractual impact values

Reputation damage

Chapter 11: Likelihood

Risk analysis

Information to support assessments

Chapter 12: Risk Level

The risk scale

Boundary calculations

Mid-point calculations

Chapter 13: Risk Treatment and the Selection of Controls

Types of controls

Risk assessment and existing controls

Residual risk

Risk transfer

Optimising the solution

Chapter 14: The Statement of Applicability

Drafting the Statement of Applicability

Chapter 15: The Gap Analysis and Risk Treatment Plan

Gap analysis

Risk Treatment Plan

Chapter 16: Repeating and Reviewing the Risk Assessment

Appendix 1: Carrying out an ISO27001 Risk Assessment using vsRisk™

How the tool actually works

Training requirements

Start using vsRisk™ for your risk assessment

Identify the assets

Identify the risks

Assess the risks

Identify and evaluate options for the treatment of risks

Select control objectives and controls for treatment of the risks

Appendix 2: ISO27001 Implementation Resources

Books by the Same Authors

ITG Resources

INTRODUCTION

In today’s information economy, the development, exploitation and protection of information assets are key to the long-term competitiveness and survival of corporations and entire economies. The protection of information assets – information security – is therefore overtaking physical asset protection as a fundamental corporate governance responsibility. Information security management, defined as ‘the protection of information from a wide range of threats in order to ensure business continuity, minimize business risk, and maximize return on investments and business opportunities’,¹ is becoming a critical corporate discipline, alongside marketing, sales, HR and financial management.

A key corporate governance objective is to ensure that the organisation has an appropriate balance of risk and reward in its business operations and, as a consequence, enterprise risk management (ERM) increasingly provides a framework within which organisations can assess and manage risks in their business plan. The recognition of substantial, strategic risk in information and communication technologies has led to the development of IT governance.²

The changing global economy, together with recent corporate and IT governance developments, all provide the context within which organisations have to assess risks to the information assets on which their organisations, and the delivery of their business plan objectives, depend. Information security management decisions are entirely driven by specific decisions made as an outcome of a risk assessment process in relation to identified risks and specific information assets.

Risk assessment is, therefore, the core competence of information security management.

The early clauses of ISO/IEC 27002:2005 (ISO27002), the international code of best practice for information security management systems, support this business- and risk-oriented approach. Information security requirements should be ‘identified by a methodical assessment of security risks. Expenditure on controls needs to be balanced against the business harm likely to result from security failures’.³

A growing number of organisations are adopting this approach to the management of risk. A number of national or proprietary standards that deal with information security risk management have emerged over the last few years. They all have much in common. ISO27001 is the international standard for information security management and provides an approach to risk management which is consistent with all other guidance. This approach is also appropriate for organisations complying with the PCI DSS.⁴

Of course, every organisation needs to determine its criteria for accepting risks, and identify the levels of risk it will accept. It is a truism to point out that there is a relationship between the levels of risk and reward in any business. Most businesses, particularly those subject to the Sarbanes-Oxley Act of 2002 and, in the UK, the Turnbull Guidance within the Combined Code on Corporate Governance, will want to be very clear about which risks they will accept and which they won’t, the extent to which they will accept risks and how they wish to control them. Management needs to specify its approach, in general and in particular, so that the business can be managed within that context. As we have already indicated, risk assessment, as an activity, should be approached within the context of the organisation’s broader enterprise risk management (ERM) framework.

Whilst ISO27002 is a code of practice, ISO/IEC 27001:2005 (ISO27001) is a specification that sets out the requirements for an information security management system (ISMS). ISO27001 is explicit in requiring a risk assessment to be carried out before any controls⁵ are selected and implemented, and is equally explicit that the selection of every control must be justified by a risk assessment. Risk assessment, as we’ve already said, is therefore, the core competence of information security management.

Organisations that design and implement an ISMS in line with the specification of ISO27001 can have it assessed by a third party certification body and if, after audit, it is found to be in line with ISO27001, an accredited certificate of conformity can be issued.⁶

This standard is increasingly seen as offering a practical solution to the growing range of information-related regulatory requirements, as well as helping organisations to more cost-effectively counter the increasingly sophisticated and varied range of information security threats in the modern information economy.⁷ As a result, a rapidly growing number of companies around the world are seeking certification to ISO27001.

An ISMS developed and based on risk acceptance/rejection criteria, and using third party accredited certification to provide an independent verification of the level of assurance, is an extremely useful management tool. Such an ISMS offers the opportunity to define and monitor service levels internally, as well as in contractor/partner organisations, thus demonstrating the extent to which there is effective control of those risks for which directors and senior management are accountable.

It is becoming increasingly common for ISO27001 certification to be a pre-requisite in service specification procurement documents and, as buyers become more sophisticated in their understanding of the ISO27001 accredited certification scheme, so they will increasingly set out their requirements more specifically, not only in terms of certification itself, but also in respect to the scope of the certification and the level of assurance they require. This rapid maturing in the understanding of buyers, as they seek greater assurance from an accredited certification to ISO27001, is driving organisations to improve the quality of their ISMS and, by definition, to improve the granularity and accuracy of their risk assessments.

The level of assurance relates, of course, directly to the risk assessment and management aspects of creating and maintaining an ISO27001-compliant ISMS. It is this key aspect that ensures that a consistent level of assurance is achieved across all facets of information security within an organisation.

ISO27001 is a specification for an ISMS. As we have said, it is b...

Table of contents

• Information Security Risk Management for ISO27001 / ISO27002