Information Technology – Guidelines for the Management of IT Security ISO/IEC 13335 Information Technology – Guidelines for the Management of IT Security 普華資安股份有限公司 報告人：蔡興樺 Steven.Tsai@mail.pwcglobal.com.tw

報告大綱 ISO 13335 part 1 ISO 13335 part 2 ISO 13335 part 3

ISO 13335 Part 1 Concepts for the Management of IT Security Security Elements Processes for the Management of IT Security

Concepts for the Management of IT Security Approach Objectives, Strategies and Policies

Security Elements Assets Threat Vulnerability Impact Risk Safeguard Residual Risk Constraints

Processes for the Management of IT Security Configuration Management Change Management Risk Management Risk Analysis Accountability Security Awareness Monitoring Contingency Plans and Disaster Recovery

ISO 13335 Part 2 Management of IT Security Corporate IT Security Policy Organizational Aspects of IT Security Corporate Risk Analysis Strategy Options IT Security Recommendations

ISO 13335 Part 2 (cont.) IT System Security Policy IT Security Plan Implementation of Safeguards Security Awareness Follow-up

Management of IT Security Planning and Management Process Overview Risk Management Overview Implementation Overview Follow-up Overview

Corporate IT Security Policy Objective Management Commitment Policy Relationships Corporate IT Security Policy Elements

Organizational Aspects of IT Security Roles and Responsibilities Commitment Consistent Approach

Corporate Risk Analysis Strategy Options Baseline Approach Information Approach Detailed Risk Analysis Combined Approach

IT Security Recommendations Safeguard Selection Risk Acceptance

ISO 13335 Part 3 Techniques for the Management of IT Security IT Security Objectives, Strategy Options Corporate Risk Analysis Strategy Options

ISO 13335 Part 3(Cont.) Combined Approach Implementation of the IT Security Plan Follow-up

IT Security Objectives, Strategy Options IT Security Objectives, Strategy and Policies Corporate IT Security Policy

Corporate Risk Analysis Strategy Options Baseline Approach Information Approach Detailed Risk Analysis Combined Approach

Combined Approach High Level Risk Analysis Baseline Approach Detailed Risk Analysis Selection of Safeguards Risk Acceptance IT System Policy Security IT Security Plan

Implementation of the IT Security Plan Implementation of Safeguards Security Awareness Security Training Approach of IT System

Follow-up Maintenance Security Compliance Checking Change Management Monitoring Incident Handling

ISO 13335 Part 4 Introduction to Safeguard Selection and the Concept of Baseline Basic Assessments Safeguards Baseline Approach : Selection of Safeguards According to the Type of IT System

ISO 13335 Part 4 (Cont.) Selection of Safeguards According to Security Concerns and Threats Selection of Safeguards According to Detail Assessment Development of an Organization-wide Baseline

Basic Assessment Identification of the type of IT System Identification of Physical/Environment Conditions Assessment of Existing/planned Safeguards

Safeguards Organizational and Physical Safeguards IT System Specific Safeguards

Selection of Safeguards According to the type of IT System General Applicable Safeguards IT System Specific Safeguards

Selection of Safeguards According to security Concerns and Threat Assessment of Security Concerns Safeguards for Confidentiality Safeguards for Integrity Safeguards for Availability Safeguards for Accountability, Authenticity, Reliability

Selection of Safeguards According to Detailed Assessment Relation Between Part 3 and Part 4 of this Technical Report Principles of Selection

敬請指教 普華資安：蔡興樺 Steven.Tsai@mail.pwcglobal.com.tw