Fazila Nurani, CIPP/C

Most organizations are dependent upon their information and business systems, leaving them exposed to critical loss in the aftermath of a security breach. Fortunately, by implementing an information security management system (ISMS), as outlined in the only internationally accepted standard/code to address information security, a business can significantly reduce the risk of a security breach.

ISO/IEC 17799:2005 (ISO 17799), known as the Code of Practice for information security management, was developed by an IT Security Subcommittee of the International Organization for Standardization and was published in June 2005. ISO 17799 is superior to other security standards becauseit is globally accepted and comprehensive. ISO 17799 has been crafted cleverly to work well across industries and geographies. Also, the International Organization for Standardization consciously has made this standard consistent with most other existing information security audit- and control-standards, such as those developed by the NIST (National Institute of Standards and Technology). Therefore, ISO 17799 can be the common framework that links to all other standards, regulatory requirements and corporate governance initiatives.

ISO 17799 provides practical guidelines for developing organizational security controls and effective security management practices. An ISO 17799 evaluation results in a snapshot of the company's security infrastructure, in that it provides a high-level view of how well (or how badly) a company implements information security. This standard is a great tool for companies whether establishing or improving information security within their organization.
The information security process traditionally has been based on sound best practices and guidelines, with the goals of preventing, detecting and containing security breaches, as well as restoration of the affected data to its previous state. While this cumulative wisdom of the ages is valid, it also is subject to various interpretations and implementations. ISO 17799 offers an achievable benchmark against which to build organizational information security.

Control Selection Based on Risks Identified
ISO 17799 consists of 39 security controls, which can be used as a basis for a security risk assessment. The controls encompass all forms and types of information, whether they are electronic files, paper documents or various forms of communications such as email, fax and spoken conversations. The standard sets out a variety of hardware and software considerations, policies, procedures and organizational structures that protect a company's information assets from a broad range of modern security threats and vulnerabilities. How organizations shape their information security programs will depend on the unique requirements and risks they face. An organization only should deploy controls that relate to, and are in proportion to, the actual risks it faces.

Controls also can be described as the "countermeasures" for risks. Apart from knowingly accepting risks considered acceptable, or transferring those risks (through insurance) to others, there are essentially four types of control:

• Deterrent controls reduce the likelihood of a deliberate attack.
• Preventative controls protect vulnerabilities and make an attack unsuccessful or reduce its impact.
• Corrective controls reduce the effect of an attack.
• Detective controls discover attacks and trigger preventative or corrective controls.

It is essential that any controls that are implemented are cost-effective. The cost of implementing and maintaining a control should be no greater than the identified and quantified cost of the impact of the identified threat (or threats). It is not possible to provide total security against every single risk; the trade-off involves providing effective security against most risks. No board should sign off on any ISMS proposal that seeks to remove all risk from the business — the business does, after all, exist within a risk framework and, since it is impossible to exist risk-free, there is little point in proposing to eliminate every risk.
No organization should invest in information security technology (hardware or software) or implement information security management processes and procedures without having carried out an appropriate risk and control assessment that assures them that:

• The proposed investment (the total cost of the control) is the same as, or less than, the cost of the identified impact;
• The risk classification, which takes into account its probability, is appropriate for the proposed investment; and
• Mitigating the risk is a priority — i.e. all the risks with higher prioritization already have been adequately controlled and, therefore, it is appropriate now to invest in controlling this one.

If the organization cannot justify that the proposed investment meets these criteria, it would be wasting money — and the time required to implement the control — while leaving itself open to more likely risks and, conceivably, with inadequate resources to respond to the more likely risk when it occurs. Simply put — there is a risk associated with not carrying out an adequate risk assessment.

The Security Categories in ISO 17799
Once information security needs and requirements are identified, a suitable set of controls from ISO 17799 can be established, implemented, monitored, reviewed and improved upon in order to ensure that the specific security objectives of the organization are met. The following is a high-level description of the 11 security categories containing the 39 controls outlined in the standard:

1. Security Policy: Establish a comprehensive information security document. The policy should contain a set of implementation-independent, conceptual information security policy statements governing the security goals of the organization.
2. Organizational Security: Create a management framework that sustains and manages the security infrastructure. This step involves organizing the protection of information both internally and externally. For example, an internal control would be allocating information security responsibilities; whereas an external control would be addressing security in third-party service agreements.
3. Asset Classification and Control: Institute an organizational asset management system to assess the ability of the security infrastructure to protect organizational assets. This control would include using an information classification system.
4. Personnel Security: Human resource security management addresses an organization's ability to mitigate the risk inherent in human interactions. This involves exploring different ways of emphasizing the security interests in company information to employees prior to, during, and at termination of employment. This control addresses the need to provide security training, education and awareness.
5. Physical and Environmental Security: Establish protections for company premises and equipment.
6. Communications and Operations Management: Adopt a comprehensive set of operational procedures, change management procedures, and methods to manage third-party service agreements and protect the exchange of information.
7. Access Control: Control access to assets based on business and security requirements, including user responsibilities and network access control mechanisms.
8. System Development and Maintenance: Information systems security management encompasses the acquisition, development and maintenance of information systems.
9. Incident Management: Develop a plan for the reporting of information security events and weaknesses. This control assists with managing these incidents and related improvements, such as establishing response responsibilities and procedures.
10. Business Continuity Management: Protect information by engaging in business continuity planning, testing and maintenance.
11. Compliance: Ensure compliance with regulatory, statutory and contractual security requirements.

ISO 17799 is a comprehensive information security code of practice that provides enterprises an internationally recognized and structured methodology for information security. In addition to ISO 17799, the International Organization for Standardization also published ISO 27001, which specifies a number of requirements for establishing, implementing, maintaining and improving an ISMS using the controls outlined in ISO 17799.

ISO 27001 is the formal standard against which an organization may seek independent certification of their ISMS. While certification is entirely optional, as of January 2007, more than 3,000 organizations worldwide were ISO 27001-certified, demonstrating their commitment to information security. Organizations may be certified as compliant with ISO 27001 by a number of accredited certification bodies worldwide. ISO 27001 certification generally involves a two-stage audit process, with a "table top" review of key documentation at the first stage and a more in-depth audit of the ISMS at the second stage. The certified organization would need to be re-assessed periodically by the certification body.

Organizations can purchase the ISO 17799 code of practice online from the official Web site of the International Organization for Standardization for approximately $160.

Additionally, organizations can obtain more sophisticated resources and tools, such as the ISO 17799 Toolkit, which includes both the ISO 17799 and the ISO 27001 text, a management presentation, a complete set of ISO 17799 compliance information security policies, a certification roadmap as well as an essential audit kit, among others. The ISO 17799 Toolkit is available for purchase at www.17799-toolkit.com for the price of $995. It was put together by David Watson, the first certified ISO 27001 auditor.

In summary, organizations face threats to their information assets on a daily basis. At the same time, they increasingly are becoming dependent on these assets. Technical solutions are only one portion of a holistic approach to information security. Establishing broad information security requirements in the framework of the organization's own unique risk environment are essential.

Fazila Nurani, CIPP/C, is President and Founder of PrivaTech Consulting, based in Toronto, Canada. PrivaTech specializes in advising organizations on compliance with Canadian privacy laws. Nurani, who holds engineering and law degrees, assists businesses in diverse industries manage privacy and information security risks. She may be reached at +1.905.886.0751 or

fnurani@privatech.ca

This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

.