Presentation for ET 4045 - Telecommunication Network Security on 2 April 2018. Topic: Information Security Management System Standards.

1. ET4045-KEAMANAN JARINGAN
TELEKOMUNIKASI

2. INFORMATION SECURITY
MANAGEMENT SYSTEM STANDARDS

3. REFERENCE
E. Humphreys, "Information Security Management System Standards," Datenschutz und
Datensicherheit - DuD, vol. 35, no. 1, pp. 7-11, 2011.

4. WHAT IS AN ISMS?
An ISMS is a systematic approach to managing sensitive company information so that
it remains secure. It includes people, processes and IT systems by applying a risk
management process.
It can help small, medium and large businesses in any sector keep information assets
secure.
https://www.iso.org/isoiec-27001-information-security.html
Question:
Is ISMS important?

5. A GLIMPSE ABOUT INFORMATION SECURITY
Worldwide security spending
exceeds $90 Billion!
As seen on
https://www.gartner.com/newsroom/id/3836563,
https://www.forbes.com/sites/tonybradley/2017/08/17/gartner-predicts-information-security-spending-to-
reach-93-billion-in-2018/#791d054b3e7f
Segment 2016 2017 2018
Identity Access Management 3,911 4,279 4,695
Infrastructure Protection 15,156 16,217 17,467
Network Security Equipment 9,789 10,934 11,669
Security Services 48,796 53,065 57,719
Consumer Security Software 4,573 4,637 4,746
Total 82,225 89,133 96,296
In US$ B, Source: Gartner (2017)
ISMS includes people, processes and IT
systems by applying a risk management
process.

6. INFORMATION SECURITY MANAGEMENT SYSTEM
STANDARDS
This article presents ISO’s most successful information security standard ISO/IEC
27001 together with the other standards in the family of information security
standards – the so-called ISO/IEC 2700x family of information security management
system (ISMS) standards and guidelines.

7. INTRODUCTION
What makes a successful information security standard?
The answer depends on positive responses to the following questions.
1. Are businesses successfully using the standard?
2. Are businesses seeing benefits and a return on investment regarding their implementation
of the standard?
3. Does the standard provide them with an effective means of protecting their critical assets
at a price that they can afford?
4. Is the standard internationally applicable across all business sectors?
5. Does it demonstrate through an independent auditing process that the business is ‘fit-for-
purpose’, that is the organization is secure enough to do business with?
“The reason why the ISMS standard ISO/IEC 27001 has been successful is for
the very reason that we are able to affirm with a yes to all of the above
questions. For example, there are many companies that have invested in
implementing an ISMS according to ISO/IEC 27001 and have gone through a
third-party certification and the result has been that they have been awarded
more contracts, they have boosted their market reputation and have been able
to use their ISMS as a market differentiator.” (Humphreys, 2011)

8. The emergence of notion
of baseline best controls,
primarily in the UK and the
USA
HISTORICAL ROOTS
Late 1980s
UK government set up an
industry group to take
forward best practice
security for the benefit of
industry at large
In 1995, BS 7799-1 was
adopted as a UK standard
(a code of practice of
ISM). In 1997, UK
published BS 7799-2
(ISMS specification).
Early 1990s
UK developed an ISMS
certification scheme to be used
with BS 7799-2. Pilot trials
went ahead in 1997-1998 and
later on the ISMS certification
scheme was launched officially.
Late 1990s
Interest in BS 7799-1 and -
2 started to grow. By the
end of 1999, some 20
countries, including Sweden,
Australia, and India, had
adopted these standards.
Late 1990s
October 2000, the UK standard
BS 7799-1 was submitted to
ISO/IEC and was approved for
publication as ISO/IEC17799.
2000s
The standard was renumbered
as ISO/IEC 27002 in 2006 and
opened the door to
development of a family of
ISO/IEC 2700x, followed by the
introduction of BS 7799-2 as
ISO/IEC 27001.
The standards continue
to develop, expand
and be adopted by
business around the
world.
Nowadays

9. ISMS FAMILY OF STANDARDS
The flagship of the ISO/IEC 2700x family, is the ISMS requirements standard
ISO/IEC 27001. This standard sets the scene and requirements which all the other
standards in the ISMS family are subordinate to, in the sense they provide support
and guidance on the implementation of ISO/IEC 27001.
The ISMS standard ISO/IEC 27001 provides a series of security process based on
the well-known Plan-Do-Check-Act (PDCA) model that is used by other ISO
management standards such as ISO 9001 (Quality Management System), ISO 14001
(Environmental Management System), ISO/IEC 20000-1 (IT Service Management)
and several others.

10. ISMS FAMILY OF STANDARDS
ISMS Process Model Risk Management Process
ISMS Process Model & Risk Management Process

11. ISMS FAMILY OF STANDARDS
The system of security controls selected from the catalogue of controls that is
integrated into Annex A of the ISO/IEC 27001.
In establishing an ISMS an organization needs to carry out a risk assessment in
accordance with the requirement specified in ISO/IEC 27001.
The code of practice standard ISO/IEC 27002 provides users and
implementers advice and guidance on the implementation of the controls that
appear in Annex A.
Also advice and guidance is available in other standards in the ISMS family
such as guidance on risk management (ISO/IEC 27005) and on security
measurements (ISO/IEC 27004).

12. ISMS FAMILY OF STANDARDS
Published Standards in the ISO 27000 family:
 ISO/IEC 27000:2016
 ISO/IEC 27001:2013 (inc Cor 1:2014,
Cor2:2015)
 ISO/IEC 27002:2013 (inc Cor 1:2014,
Cor2:2015)
 ISO/IEC 27003:2017
 ISO/IEC 27003:2017
 ISO/IEC 27004:2016
 ISO/IEC 27006:2015
 ISO/IEC 27007:2017
 ISO/IEC 27008:2011
 ISO/IEC 27009:2016
 ISO/IEC 27010:2015
 ISO/IEC 27011:2016
 ISO/IEC 27013:2015
 ISO/IEC 27014:2013
 ISO/IEC 27016:2014
 ISO/IEC 27017:2015
https://www.itgovernance.co.uk/iso27000-family (latest update: January 2018)
 ISO/IEC 27018:2014
 ISO/IEC 27019:2013
 ISO/IEC 27023:2015
 ISO/IEC 27031:2011
 ISO/IEC 27032:2012
 ISO/IEC 27033-1:2015
 ISO/IEC 27033-2:2012
 ISO/IEC 27033-3:2010
 ISO/IEC 27033-4:2014
 ISO/IEC 27033-5:2013
 ISO/IEC 27033-6:2016
 ISO/IEC 27034-1:2011 (inc. Cor 1:2014)
 ISO/IEC 27034-2:2015:2013
 ISO/IEC 27034-5
 …
 ISO 27799:2016

13. ISMS FAMILY OF STANDARDS
ISO standard follows a six-step development process before publication, and at each
stage is ascribed an appropriate abbreviation to denote its status:
1. Preliminary stage: PWI (Preliminary Work Item) – Initial feasibility is assessed.
2. Proposal stage: NP (New Proposal) – Formal scoping takes place.
3. Preparatory stage: WD (Working Draft) – The standard is developed.
4. Committee stage: CD (Committee Draft) – Quality control takes place.
5. Enquiry stage: FCD (Final Committee Draft) – The standard is ready for final
approval. DIS (Draft International Standard) – International bodies vote formally
on the standard, and submit comments.
6. Approval stage: FDIS (Final Distribution International Standard) – The standard is
ready to publish.
7. Publication stage: IS (International Standard) – The standard is published.
PWI >> NP >> WD >> CD >> DIS >> FDIS >> IS
https://www.itgovernance.co.uk/iso27000-family (latest update: January 2018)

14. ISMS FAMILY OF STANDARDS
ISO 27000 family standards in development:
 ISO/IEC 27005:2011 (DIS)
 ISO/IEC PDTS TR 27008 (CD)
 ISO/IEC NP 27009 (NP)
 ISO/IEC FDIS 27034-3
 ISO/IEC FDIS 27034-7.2
 ISO/IEC DIS 27050-2
https://www.itgovernance.co.uk/iso27000-family (latest update: January 2018)

15. ISMS SUPPORTING STANDARDS
ISO/IEC27002
ISO/IEC 27002 Code of practice for information security controls
This International Standard providing a set of best practice information
security controls together with implementation advice for each of the
controls. These best practice controls cover the following areas of ISMS
support:
 Information Security Policy
 Organizing Information Security
 Asset Management
 Human Resources Security
 Physical and Environmental Security
 Communications and Operations Management Access Control
 Information Systems Acquisition, Development and Maintenance
 Information Security Incident Management
 Business Continuity Management
 Compliance with Legal Requirements and Security Standards

16. ISMS SUPPORTING STANDARDS
ISO/IEC27003
ISO/IEC 27003 ISMS Implementation guidance
The purpose of this International Standard is to provide practical guidance in
developing the implementation plan for an Information Security Management
System (ISMS) within an organization in accordance with ISO/IEC 27001. The
actual implementation of an ISMS is generally executed as a project. The
process described within ISO/IEC 27003 been designed to provide support of
the implementation of ISO/IEC 27001:
 The preparation of an ISMS implementation plan in an organization, defining
the organizational structure for the project, and gaining management
approval,
 The critical activities for the ISMS project, and
 Examples to achieve the requirements in ISO/IEC 27001

17. ISMS SUPPORTING STANDARDS
ISO/IEC27004
ISO/IEC 27004 Information Security Measurements
This International Standard provides guidance on the development and use of
measures and measurements to assess the effectiveness of an implemented
information security management system (ISMS) and controls or groups of
controls, as specified in ISO/IEC 27001.
This would include policy, information security risk management, control
objectives, controls, processes and procedures, and support the process of its
revision, helping to determine whether any of the ISMS processes or controls
need to be changed or improved.

18. ISMS SUPPORTING STANDARDS
ISO/IEC27005
ISO/IEC 27005 ISMS risk management
This International Standard provides guidelines for Information Security Risk
Management in an organization, supporting in particular the requirements of an ISMS
according to ISO/IEC 27001.
However, this International Standard does not provide any specific methodology for
information security risk management. It is up to the organization to define their
approach to risk management, depending for example on the scope of the ISMS,
context of risk management, or industry sector.
A number of existing methodologies can be used under the framework described in
this International Standard to implement the requirements of an ISMS.

19. ISMS ACCREDITATION AND AUDITING STANDARDS
ISO/IEC 27006 Requirements for the accreditation of certification/registration bodies
providing ISMS audits. This standard defines the requirements that certification
bodies need to meet in order for them to become accredited to offer 3rd party
certification services to ISMS customers.
ISO/IEC 27007 Guidelines for information security management systems auditing. This
standard provides essential auditor guidance for those involved in all forms of
ISO/IEC 27001 auditing: internal audits and 3rd party certification audits. This
standard has been developed taking account revision of ISO 19011 and ISO
17021-2 both of which address auditor guidance for the generic family of
management system standards.
ISO/IEC 27008 Guidance for auditors on information security controls. This provides
guidance on reviewing the implementation and operation of controls, including
technical compliance checking of information system controls, in compliance with an
organization’s established information security standards.

20. ISMS SECTOR SUPPORTING STANDARDS
ISO/IEC 27010 – for inter-sector communications This standard considers various security
requirements regarding those sectors and organizations involved in national infrastructure. This
includes the security of inter-sector communications between infrastructure components.
ITU-T X.1051 | ISO/IEC 27011 – for telecommunication organizations. This is based on ISO/IEC
27002 and defines specific telecoms controls requirements additional to those found in ISO/IEC
27002. This standard was jointly published by ITU-T and ISO/IEC in 2008.
ISO/IEC 27013 – guidelines for the integrated implementation of ISO/IEC 27001 and ISO/IEC
20000-1. This standard provides guidance to those organizations that wish to integrate their IT
service management and information security management systems to take advantage of the
common elements of these to standards. For example, they can combine documentation systems,
incident handling systems and secure service delivery, monitoring and review processes.
ISO/IEC 27014 – information security governance framework. This standard supports the
information security aspect of a corporate governance framework. ISO/IEC 27001 is an ideal
information security framework as it includes the three key elements of governance: risk
management, system of controls and an auditing function.
ISO/IEC 27015 – ISMS for the financial sector. This standard addresses the specific requirements
of those organizations in the financial sector that are adopting ISO/IEC 27001

21. ISMS CERTIFICATION AND AUDITS
There are three approaches to demonstrating conformity to ISO/IEC 27001:
1. First-Party (or self) assessment: by internal ISMS audit;
2. Second-party assessment: supplier audit by one of customers, may be directly carried out by the
customer or by an auditing company on the customer’s behalf; and
3. Third-party (or certification) assessment: by certification bodies.

22. DELIVERING BUSINESS SOLUTIONS USING ISO/IEC
27001
Organizations around the world have growing concerns about the security of their
information. ISO/IEC 27001 is a standard that can delivery value and a good return
on security investment. The following are a few of the highlights for delivery business
value:
Strategic alignment: ISMS should be driven by enterprise requirements; Security
solutions should be ‘fit for purpose’ for enterprise processes; Investment in information
security needs to be aligned with enterprise strategy and agreed upon the
organization’s risk profile.
Value delivery: A standard set of security practices (following the ISO/IEC 27002
code of practice); Properly prioritized and distributed effort to areas with greatest
impact and business benefit; Complete and customized solutions covering
organization, process as well as technology; A continuous improvement culture needs
to be deployed.

23. DELIVERING BUSINESS SOLUTIONS USING ISO/IEC
27001
Risk Management (ISO/IEC 27001 and 27005): Identified risks and agreed upon
risk profiles; Understanding the impact of risk exposures; User awareness of risk; Risk
management plan and priorities for taking action; Risks and information security
measurements (ISO/IEC 27004); Regular risk reviews.
Measuring Performance and System Assurance (ISO/IEC 27004): Defined set of
metrics; Measurement process with feedback on progress made; Reviews and audits
(ISO/IEC 27007 + 27008); Independence assurance.
Maintaining and/or Improving Performance: Monitoring and review of the ISMS – is
my return on security investment still good or is their a need for ISMS improvements;
Assessing performance and the effectiveness of the ISMS controls; Implementing
improvements – add new controls and/or improve existing controls.

24. BIBLIOGRAPHY*
[1] Humphreys, Edward (2008), Implementing the ISO/IEC 27001 Information Security
Management System Standard (Information Security and Privacy Series), pub. Artech House
[2] Humphreys, Edward (2010), Information Security Risk Management – Handbook for ISO/IEC
27001, Pub. BSI British Standards Institution
[3] James Butler-Stewart author (2009), Father of ISMS Standards (BS 7799-1 | ISO/IEC
27002 & BS 7799-2 | ISO/IEC 27001), Infosec Publications, Australia, India and USA
[4] ISO Publication (2010): ISO/IEC 27001 Information Security Management Systems – An
easyto-use ISO/IEC 27001 guide for the small business, author Humphreys, Edward
[5] Humphreys, Edward and Plate Angelika (2005), Are you ready for an ISMS Audit based on
ISO/IEC 27001? Pub. BSI British Standards Institution
*of the reference

25. BIBLIOGRAPHY*
[6] Humphreys, Edward and Plate Angelika (2005), Guidelines on Requirements and Preparation
for ISMS Certification Based on ISO/IEC 27001, Pub. BSI British Standards Institution
[7] Humphreys, Edward (2009), Implementation of ISO/IEC 27001, Pub. MIQA, London
[8] Humphreys, Edward and Plate Angelika (2010), ROSI and ISO/IEC 27001, Pub. Risk
Publications Associates, LA, USA
[9] Humphreys, Edward and Plate Angelika (2008), Pub. BSI British Standards Institution
[10] Humphreys, Edward and Plate Angelika (2007), ISMS Metrics, Pub. MIQA, London
[11] Humphreys, Edward and Plate Angelika (2006), Measuring the Effectiveness of your ISMS
implementation based on ISO/IEC 27001, Pub. BSI British Standards Institution
*of the reference