When thinking of certification of an information security
management system, the base for it would be ISO 27001.
And just as SOC is for attestation, we can think of ISO 27001 being
for certification. Upon passing the audit process, an organization
can have its information security management system certified by an
ISO compliant organization.
And ISMS will typically ensure that a structured, measured, and ongoing view of
security is taken across an organization allowing security impacts and
risk‑based decisions to be properly managed. Here, just as in other places,
there needs to be executive sponsorship as an imperative element of success for
the information security management system.
There are some 14 domains inclusive inside of so 27001 that
an organization would need to maintain.
The first is a set of policies for information security needing to be
defined, approved by management, published, and communicated to all
employees and relevant external parties.
There's the organization of information security, which would include all
information security responsibilities being defined and allocated. Conflicting
duties in areas of responsibility shall be segregated to reduce opportunities
for unauthorized or unintentional modification,
misuse, or disclosure of data.
Human resource security has to do with background verification checks
on all candidates in accordance with relevant laws,
regulations, and ethics.
Also, the classification of that corresponding information and who has access
should be strictly controlled. Asset management has to do with associated
information and processing facilities being identified and inventoried drawn
upon rules for acceptable use. Access control, as it sounds, would be the policy
that establishes in a documented way and a reviewed fashion on the information
security requirements for getting access to network and network services on an
authorized bases.
Cryptography would spell cryptographic controls for protection of
information being developed and implemented.
A policy and the use protection in a lifetime of
cryptographic keys is also developed.
The physical environmental security would have to do with
protection areas that contain either sensitive or critical
information and processing facility protection.
When we think about the operation security, what we're
considering is documentation made available to all users who
need them, changes to the organization, the business process,
the information processing facilities that affect information
security shall be controlled. With communication security, networks
should be managed and controlled to protect information in systems
and applications. Security mechanisms,
service levels, and management requirements of all
network services shall be identified.
The whole process of acquiring or developing or maintaining
systems should be specified in a lifecycle.
And this would also be inclusive of services over public networks.
Think about the supply chain attacks that have occurred in recent years.
Here, we're thinking about the suppliers access to the
organization's assets shall be agreed upon with the supplier and
documented. Incident management, just as it sounds,
is to ensure consistent and effective approach to the
management of information security during any kind of
degradation or disruption of services.
Business continuity management focuses on the resiliency of the
organization, the continuity of information security management in
adverse situations during a crisis or a disaster.
And then finally, compliance is the holistic view,
the contractual, the regulatory,
the legislative capabilities that the organization needs to
identify and document and keep up to date. When we look at ISO
27002, these are the controls that you would apply from a set
of guidelines to ISO 27001.
So these controls take into consideration the organization's
information security environment. And as we said,
it works in conjunction with ISO 27001.
These control objectives are how you reach the
certification capability of ISO 27001.
Earlier,
we described ISO 27018 and it's five‑part requirements
in order to protect PII in the cloud.
So if you were to take ISO 27001 and form it for cloud
concerns, ISO 27018 would be its counterpart.
ISO 27017,
which we have not talked about, could be compared to ISO 27002, but here again,
in the cloud. The first thing it does is delineates responsibility between the
cloud service provider and the cloud consumer.
It looks at asset disposition upon contractual termination. It
considers the cloud service customers environment and making sure
that there's isolation between customers.
It makes certain that the virtual machine configuration is
at the gold‑image level that you would expect for something
that is patched and certified.
It also ensures that there are administrative procedures and
operational procedures for the cloud service provider in their
environment for maintaining that control. Activity monitoring is not
just for the cloud service provider,
but giving an offshoot of that monitoring holistically to the consumer as well,
which I must say is done very well by most cloud service providers by means of
a rich suite of monitoring of APIs. And then also, environmental alignment to
make sure that the virtual and the cloud network environment align from a
security perspective. ISO 27017 guidelines specifically for the cloud that
reflects the interests of ISO 27002.
Next, let's take a look at cloud‑specific attestations and certifications.