The thing about information security the question is what is information
security about and why do you really want to even look at ISO 27001 for those
who are not accustomed to what this means just a quick view about what
information security management system is all about and that's in short is ms
now for people who are in the information security field information
security and the managing of information security I'm sure you do know that there
are a wide best practices around as to how you can actually improve or manage
information security and ISO 27001 is one of those standards and why we are
actually promoting ISO 27001 is because it's one of the well recognized globally
recognized standards where it provides you from end to end view as to how you
can manage information security now a lot of the other standards that are
around what they do do is that they provide you with very prescriptive view
about how you implement controls to manage information but what they don't
do is to provide you with how to actually implement a framework in place
to then implement controls so let's have a look at information in itself we what
we like to introduce is the concept of information that you look at from an
organization-wide perspective so what is actually your crown jewels everybody
talked about crown jewels so in every organization information is an important
part of the enterprise when we're talking about information we start
looking at what are the information that you're receiving from your customers
from your clients what are you doing with them using them processing them
managing them and the other thing that we then look at is that are you storing
it where are you storing it how are you actually
managing information that you stored how protected are those information so when
we try to understand that and an understanding of business in itself
there are many components in a business so we can start looking at right at the
top look at the CEO to the CEO what does it mean to him or her in terms of an
information what are their information needs and then if you look at the next
thing is that thank you for that and looking at in terms of a CEO so looking
at operations what is information to a CEO why is information important so
while at a CEO perspective I'm very interested to know and how are you
protecting my brand what happens if there's an information breach and then
from a CEOs perspective how am I using those information in terms of making
sure that I have seamless effective and efficient processes in place and then
looking at the next category of people who look at information in looking from
CFOs perspective what what do I expect our chief privacy officer perspective
what am I looking at from an information what do I need to protect so for
organizations who deal a lot with personal information and personal
information that are sensitive in nature now that would be the core interests of
a chief privacy officer and then the next category of people would be the
CIOs now this is a new category or group of
people in an organization specifically looking at information in the past
there's a lot of talk about data there's a lot of talk about information but
nobody actually ever thought about what do they need to actually protect
information so now we've created a whole new role for chief information officer
and as a chief information officer what you will be interested in is how do I
actually gather everybody in the organization
and look at information and then looking at how we protect them so what we're
trying to introduce is the concept of looking at information as an information
lifecycle itself and how it means what it means to different people in an
organization and from there we'll start to look at what is the value of that.
information to you and hence why we need to protect them so one of the questions
that we need to ask ourselves when we look at protecting information is what
is the value of that information to each person in the organization right so
let's start looking at what we call information security management system
the is ms as I said earlier is ms is actually a terminology that we use to
basically mean management of information and there are many methodologies out
there to help you do that so having a is ms in place it actually ensures that you
would have management commitment into managing of information so we're taking
the concept of information security from top down approach getting your board
level people involved and then getting senior management involved operational
level people involved and then finally we at the operational level on how to
implement some of those controls to protect information so when we look at
information and we start treating them like a business assets just like any
other assets that you have in an organization that brings the meaning and
the value which has a critical impact on the organization when we start treating
information in that same way then we start to look at the value of having to
protect those information so having an IMS in place once we understand what the
the information is that we need to protect it provides a systematic
approach towards managing information using a risk-based
so in terms of the way I've just explained it
what happens then is that we we then take an organization of view because
we've taken it from a top-down approach we're actually taking an organizational
view to managing information security now the important thing to note about
that is the information security managing is not a revolution it is an
evolution and hence it is actually a journey so we can't actually manage
information security in a couple of months or even a year and often when we
help organizations to improve a state of maturity it often takes three four years
to do so as a result of that we can't actually say we want to implement
security and then kind of pull it out of the Hat and say let's improve security
what we need to do is that because it does take a long time to improve on the
state of your current security we we look at information security management
as a project like any other projects that you have so to get the importance
of the commitment of top management and you start taking is SMS seriously and to
start it off as a project so some of the things that we need to think about is
that how do we get a project going if you present to the next one thank you so
as any other projects that we've we've started in an organization we first need
to actually set up the project itself so when we say when we start up the project
we need to first identify what is the business requirements for a project so
what are the commitments that we want to put into the project what sort of
resources that you want so I assume as projet is no different from any other
projects that you do there will always be constraints the constraints of
resources to put in a particular project and at the same time you want them to be
involved in your business as you BAU activities now as a result of that
often you will find that if you don't treat ice MS as a project you will tend
to end up with undetermined attending of a project so it is really important that
if we were to take is MSS a project we need to then set up all the rules as you
would do in a project in terms of defining what the project means to each
person who are the interested parties who are the stakeholders in into this
what are the risks what are the threats and what are the resources that you need
what are the skills that you need all this needs to be identified it needs to
be measured so that then you can have a successful measurement of a project as
it goes along and next one so by setting up such a precedence in terms of
treating SMS as a project you actually introduce a culture and awareness of
information security you provide an avenue for introducing ownership of
information security so by treating them as a project getting everybody involved
when you identify the stakeholders within the project that's when we start
the project rolling and doing all the briefings so that you could actually
cascade down what it means to have information security and what it means
about information values to each category of people that you get involved
in that project in itself now once all those have been defined the most
important thing obviously is to be able to communicate those values to everyone
on the project and hence that's where you get the concept about governance so
by having a structured approach to introducing IMS as a project we actually
then introduce the concept of governance into information security now once we
have that already set up the next face obviously to look at is how do we
plan for the is SMS itself so within the in within the project we need to
identify what we normally call as a contacts establishment which we will go
on a little bit further on later part is that we need to plan for the ICMS to
understand who are the people that is involved in the project what what are
the information security objectives what are the risk acceptance criteria so that
you can actually move from the planning into the implementation stage and then
following from that will be the next part where you need to build in measures
of what we call key performance indexes in this is for you to be able to track
how well you are actually moving against what you've set up right at the earlier
part where you've defined what your objectives are now basically if you look
at that as a whole that kind of gives you a few that well ice ms is a project
after all so in in the beginning I started saying that is MS is actually a
process of managing information security now there are many standards out there
and the is M is ten is twenty seven double zero one the latest version is
2013 it provides you a whole suite of a framework as how do you actually manage
information security and then 27 double zero to provides you with a detailed
descriptions of what those controls are and within 27 double zero two they are
actually 14 control domains but what they're what the 27 double zero one is
different from all the other standards that could be you could name NIST they
could name sands or even some people look at copied from you Sokka to look as
a guidance and how to implement controls now basically all these standards that
just mentioned they are methods of controls that you can implement so they
are actually very much at the controls level 27 double zero one on the other
hand actually sits on top of that control level to say that well for me to
be able to implement controls I first need to have a framework in place that
will take me from the start as in the project that we looked at earlier to
define what your information security objective is to define what are the in
the the risk and the threats are to the organization to define who the
interested parties are for the information that you're trying to
protect up until the point where you actually look at implementing those
controls which you could use the the controls which have been provided by
isil 27 double zero to which they call the controls within the annex a or you
can then start to use with more prescriptive controls so as I said
before you can use NIST you can use OS for development you can use Kabat and
even for those who are government agencies you could actually then refer