3. Security Standards & Security Management

Question 1

What should information security standards offer?

Answer 1

Coherent approach (to information security)
Pragmatic & flexible (i.e. appropriate controls)
Guidance (to security)
Best practice (& sensible approach)
Help with compliance (regulatory / customers / business / government etc)

Question 2

What are the problems associated with security standards?

Answer 2

Lack of awareness (several business surveys show this)
Lack of acceptance?
Cost & time (possibly easier to become assessor that gets certified (as with other standards))
Accreditation or good practice (being accredited doesn’t necessarily mean every area is secure & not being accredited doesn’t necessarily mean things aren’t secure)

Question 3

What are the formal security standards?

Answer 3

Lots of ‘red tape’ and bureaucracy!
Long process (6 months to 1 year, plus continual process)
Not a one-off fix
Expensive, needs support mechanisms (e.g. teams, committees, focus groups, consultants, audit functions / facilities (and to take actions from these))
Needs top management support - or will not work or be adopted
Probably affects all of the organisation

Question 4

What are the other security standards?

Answer 4

Technical standards / schemes for products:
TCSEC - Trusted Computer Security Evaluation Criteria
ITSEC - IT Security Evaluation Certification Scheme

Less formal information security standards - business certification schemes - e.g. webtrust

Question 5

What are webtrust’s principles?

Answer 5

Security
Availability
Processing integrity
Online privacy
Confidentiality

Question 6

What is required for a security strategy to be consistent?

Answer 6

Threat vulnerability assessment
Comprehensive security plan
Other strategies (general / overall business, marketing, operational)

Question 7

What are the possible security strategy threats that need to be identified?

Answer 7

System unavailable
Unauthorised disclosure / modification of information
Malware affecting systems
Unauthorised access (local & remote)
Fraud (by staff)
Errors & omissions
Privacy & confidentiality
Repudiation & accountability
Non-compliance

Question 8

What is the process required for a security strategy?

Answer 8

Implement the strategy (allocate people, resources, equipment, set policies, tasks, processes)
Monitor (what things should you monitor? how regular?)
Evaluation (costs, effectiveness, responsiveness)
Update (policy, plans, resources)