Adaptive Processes Simpler, Faster, Better 1 Adaptive Processes Understanding Information Security ISO / BS7799

Adaptive Processes Simpler, Faster, Better 2 Just Imagine… What will happen if our current office can’t be used for few days because of fire? What will happen if our competitor hacks into our network and gets all sensitive information? Our communication link to our customer goes down for prolonged period? And many more…..

Adaptive Processes Simpler, Faster, Better 3 So The Implications Are… Information security is essential to maintain competitive edge, cash-flow, profitability, legal compliance and commercial image It is extremely critical for us to identify, assess and take preventive / corrective measures for risks that our business faces It is legally required to protect information that customers provide us

Adaptive Processes Simpler, Faster, Better 4 Global Information Village

Adaptive Processes Simpler, Faster, Better 5 Information Criticality Digital Nervous System Strategic Thinking Business Reflexes Basic Operations Customer Interaction Information systems are nervous system of an information enterprise - Failure of nervous system indicates failure of the organization

Adaptive Processes Simpler, Faster, Better 6 Understanding Information Security Confidentiality –Ensuring that information is accessible only to those authorized to have access Integrity –Safeguarding the accuracy and completeness of information and processing methods Availability –Ensuring that authorized users have access to information and associated assets when required

Adaptive Processes Simpler, Faster, Better 7 Securing Information INFORMATION ATTACK

Adaptive Processes Simpler, Faster, Better 8 Introducing ISO Provides recommendations for information security management for use by those who are responsible for initiating, implementing or maintaining security in their organization Provides a common basis for developing organizational security standards and effective security management practice and to provide confidence in inter-organizational dealings

Adaptive Processes Simpler, Faster, Better 9 ISO What it is: An internationally recognized structured methodology dedicated to information security A defined process to evaluate, implement, maintain, and manage information security What it is: An internationally recognized structured methodology dedicated to information security A defined process to evaluate, implement, maintain, and manage information security What it is not: A technical standard Product or technology driven An equipment evaluation methodology such as the Common Criteria/ISO 15408) What it is not: A technical standard Product or technology driven An equipment evaluation methodology such as the Common Criteria/ISO 15408)

Adaptive Processes Simpler, Faster, Better 10 ISO What it is: A comprehensive set of controls comprised of best practices in information security Developed by industry for industry What it is: A comprehensive set of controls comprised of best practices in information security Developed by industry for industry What it is not: Related to the "Generally Accepted System Security Principles," or GASSP Related to the five-part "Guidelines for the Management of IT Security," or GMITS/ISO TR What it is not: Related to the "Generally Accepted System Security Principles," or GASSP Related to the five-part "Guidelines for the Management of IT Security," or GMITS/ISO TR 13335