ISO turbehalduse standardid Monika Oit Cybernetica Eesti esindaja ISO/IEC JTC1 SC27s (osalenud põhiliselt WG1 töös)

ISO/IEC JTC1 ISO & IEC Joint Technical Committee on IT standardization (EU: CEN/CENELEC)

JTC1 allkomiteed: JTC 1/SC 2 Coded character sets JTC 1/SC 6 Telecommunications and information exchange between systems JTC 1/SC 7 Software and system engineering JTC 1/SC 17 Cards and personal identification JTC 1/SC 22 Programming languages, their environments and system software interfaces JTC 1/SC 23 Digital storage media for information interchange JTC 1/SC 24 Computer graphics, image processing and environmental data representation JTC 1/SC 25 Interconnection of information technology equipment

JTC1 allkomiteed: JTC 1/SC 27 IT Security techniques JTC 1/SC 28 Office equipment JTC 1/SC 29 Coding of audio, picture, multimedia and hypermedia information JTC 1/SC 31 Automatic identification and data capture techniques JTC 1/SC 32 Data management and interchange JTC 1/SC 34 Document description and processing languages JTC 1/SC 35 User interfaces JTC 1/SC 36 Information technology for learning, education and training JTC 1/SC 37 Biometrics

SC27 IT Security techniques Secretariat: DIN Secretary: Ms. Krystyna Passia Chair: Dr. Marijke De Soete (Germany) Number of published ISO standards under the direct responsibility of the JTC 1/SC 27 Secretariat: 59 Participating countries: 31 Observer countries: 11

SC27 töögrupid: JTC 1/SC 27/WG 1 Requirements, security services and guidelines (BSI - UK) JTC 1/SC 27/WG 2 Security techniques and mechanisms (IBN - Belgia) JTC 1/SC 27/WG 3 Security evaluation criteria (SIS - Rootsi)

Turbehaldus: oli ISO/IEC GMITS Guidelines for the Management on IT Security, Part 1: Concepts and Models for IT Security, Part 2: Managing and Planning IT Security, Part 3: Techniques for the Management of IT Security, Part 4: Selection of Safeguards, and Part 5: Management Guidance on Network Security. Kõik need on ka EVS-d ja eestikeelsed “Infoturbe baaskursus”

Määratlused 3.10 infoturve: kõik konfidentsiaalsuse, tervikluse, käideldavuse, jälitatavuse, autentsuse ja töökindluse määratlemise, saavutamise ja säilitamisega seotud aspektid.

Turvamudel

Relationships in Risk Management

Infoturbe haldus kui protsess

Siis tuli BS 7799…. ISO/IEC 17799:2000 Code of Practice for Information Security Management Otsus: EI TULE SERTIFITSEERIMSISKEEMI Uus 13335: Management of Information and Communication Technology Security Part 1: Concepts and models for information and communication technology security management Part 2: Techniques for the information security risk management ISO/IEC 17799:2005 – oluliselt töödeldud FCD ISMS Specification -

Information Security Road Map

Terminology SD6 Glossary of IT Security terminology ISO Guide 73 Oleks vaja: Definitions of terms in ISM

Principles Ei mingeid

Framework *… Oleks vaja: Information Security Management Framework

Element Standards ISMS requirements *

Application Guides Ei ole, aga kasutatakse… ISO Auditing Financial ISMS Guide (TC68, ISO 13569) Telecom ISMS Guide (ITU) Health Care ISMS Guide (?)

Toolboxes and Techniques ISO/IEC IT Intrusion Detection Framework ISO/IEC IT Network Security ISO/IEC Information Security Incident Management ISO/IEC TR Guidelines on the use and management of trusted Third Party services ISO/IEC Systems Security Engineering – Capability Maturity Model (SSE-CMM)…

Uus initsiatiiv: ISO/IEC – framework ( * ??) Information Security Management Systems – Requirements ( ??) – “Best Practice” (17799:2005…??) – ISMS implementation Guidance – , *…??) – Security Risk Management ( *) Täpsustub novembris 2005 !