Scribd Logo
Upload

Welcome to Scribd!

  • 62 views

    Security Standard

    Uploaded by

    Jnol Arifin
    The document discusses baseline security and the ISO/IEC 17799 standard. It provides an overview of the ISO/IEC 17799 standard, which originated as a British Standard (BS7799) and is intended to provide a comprehensive reference point for information security practices. The standard has 10 sections and 36 sub-sections covering key security controls. While adoption of the standard by organizations has increased, surveys still find that only a small percentage comply with or have reviewed their practices against the standard. Reasons for lack of compliance include issues like cost and lack of priority or knowledge. The document emphasizes that complete security is not achievable and that organizations must determine the appropriate security measures based on a risk assessment of their assets.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPTX, PDF, TXT or read online from Scribd

    Security Standard

    Uploaded by

    Jnol Arifin
    62 views15 pages
    The document discusses baseline security and the ISO/IEC 17799 standard. It provides an overview of the ISO/IEC 17799 standard, which originated as a British Standard (BS7799) and is intended to provide a comprehensive reference point for information security practices. The standard has 10 sections and 36 sub-sections covering key security controls. While adoption of the standard by organizations has increased, surveys still find that only a small percentage comply with or have reviewed their practices against the standard. Reasons for lack of compliance include issues like cost and lack of priority or knowledge. The document emphasizes that complete security is not achievable and that organizations must determine the appropriate security measures based on a risk assessment of their assets.

    Original Description:

    Computer Security

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses baseline security and the ISO/IEC 17799 standard. It provides an overview of the ISO/IEC 17799 standard, which originated as a British Standard (BS7799) and is intended to provide a comprehensive reference point for information security practices. The standard has 10 sections and 36 sub-sections covering key security controls. While adoption of the standard by organizations has increased, surveys still find that only a small percentage comply with or have reviewed their practices against the standard. Reasons for lack of compliance include issues like cost and lack of priority or knowledge. The document emphasizes that complete security is not achievable and that organizations must determine the appropriate security measures based on a risk assessment of their assets.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    62 views15 pages

    Security Standard

    Uploaded by

    Jnol Arifin
    The document discusses baseline security and the ISO/IEC 17799 standard. It provides an overview of the ISO/IEC 17799 standard, which originated as a British Standard (BS7799) and is intended to provide a comprehensive reference point for information security practices. The standard has 10 sections and 36 sub-sections covering key security controls. While adoption of the standard by organizations has increased, surveys still find that only a small percentage comply with or have reviewed their practices against the standard. Reasons for lack of compliance include issues like cost and lack of priority or knowledge. The document emphasizes that complete security is not achievable and that organizations must determine the appropriate security measures based on a risk assessment of their assets.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    of 15

    TMN 2073 Computer Security

    Baseline Security
    A minimum level of protection that should be considered by all organisations utilising IT

    systems. Example : ISO/IEC 17799 standard Many organisations will require protection considerably above the baseline level

    ISO / IEC 17799 Standard


    A code of practice for information security

    management

    Evolved from a 1994 DTI Code of Practice

    developed with leading UK companies; based on best information security practices in current use

    Became a British Standard (BS7799) in 1995. BS7799 was revised in 1999 and again in 2000/01. BS7799-1:2000 is the same as ISO/IEC 17799

    Intended to be comprehensive:
    A single reference point for most situations; Suited to small, medium and large organisations; A common reference, basis for mutual trust.

    Technical Committee BSFD/12


    Original BS7799 devised by representatives from :
    The BOC Group plc British Computer Society British

    Telecommunications plc CCTA Department of Trade and Industry Marks & Spencer plc Midland Bank plc

    Nationwide Building Society Prudential Assurance Corporation SEMA Group Consulting Shell International Petroleum Co Ltd. Shell UK Ltd. Unilever plc

    Structure of ISO / IEC 17799


    Sections

    10

    Sub-Sections (control objectives)

    36

    Controls

    127

    ISO / IEC 17799 Overview


    Security Policy Security Organisation

    Assets classification and control


    Personnel security Physical and environmental security

    Continued . . .
    6

    ISO / IEC 17799 Overview (cont.)


    Communications and operations management Access control Systems development and maintenance Business continuity management Compliance
    7

    Accreditation
    DTI launched a BS7799 accreditation scheme called

    C:Cure in 1998 Becoming accredited as complying with the standard provides a means for an organisation to demonstrate its commitment to security Also provides a basis for mutual trust with other parties

    Adoption of BS7799
    From BISS 2000:
    Survey of 250 UK employers by National Computing

    Centre 35.5% aware of BS7799, of whom 36.6% had reviewed their own security standards against BS7799; Of the remaining aware respondents, 42% planned undertake a review within a year.

    Adoption of BS7799 (cont.)


    From the Audit Commission (2001):
    Survey of 688 organisations from the private and public

    sectors Only 15% considered their organisation to comply with BS7799 This compares with 19% in the previous survey in 1997

    10

    Adoption of BS7799 (cont.)


    Reasons for not seeking ISO/IEC 17799 accreditation:
    not a business priority no knowledge of BS7799 no knowledge of BS7799 certification no skills/resources in this area too expensive no top management support

    (UK Audit Commission, 2001)


    11

    Managing Security
    Security Policies New Systems Existing Systems Security Management

    Connectivity

    Developing
    Risk Analysis Recommendations
    Technical Physical Personnel Procedural Legal

    Installed
    Monitor Maintain Educate and train Reassess

    Implementation

    12

    Managing Security (cont.)


    Monitor effectiveness of the technical measures Monitor compliance by staff, via manual and

    computer records Maintain protection by acting upon monitored information where necessary Provide general and specialist training for all staff Periodically reassess whether countermeasures are still relevant to current threats Ensure that new systems are developed / procured in accordance with policy

    13

    Conclusion
    100% security is not an achievable goal Security costs money : Must determine the appropriate level of countermeasures for the assets requiring protection; Require a means to address the problem in a consistent and structured manner. Baseline security helps, but is not a total solution.

    14

    Reference:
    This lecture slide is adapted from Prof. Steven Furnell,

    University of Plymouth 2006.

    15

    You might also like