How to gain and maintain ISO certification

Transcription

1 Public How to gain and maintain ISO certification Urpo Kaila, Head of Security CSC IT Center for Science ltd. GÉANT SIG ISM 1 st Workshop, , imperial.ac.uk

2 Agenda! Introduction! Scope and objectives of security! ISO/ IEC 27001:2013! How CSC gained the certification! Learning from the certification experience! Ideas for cooperation 2

3 About CSC! CSC offers IT services for research, higher education, culture, and government! CSC provides scientific software and databases and Finland s supercomputing environment that researchers can use via the Funet network! CSC - IT Center for Science Ltd. is a government owned, non-profit company administered by the Ministry of Education and Culture 270 Employees 3

4 CSC Services Computing Services Research Information Management Services Funet Network Services Education Management and Student Administration Services Identity and Access Management Services Datacenter and Capacity Services (IaaS) Training Services Consultation and Tailored Solutions Ministry of Education and Culture Other ministries and state administration Higher education institutions Research institutions Companies

5 About myself! Industry background Previously IT Manager Later Presales manager/ Technical director in an IT security company! At CSC since 2003 Previously manager for Internal IT, Datacenters Information Security Manager In charge of risk management, information security, operational security, incidents, security agreements, physical security, cyber security! Security Officer for the EUDAT project A Collaborative Data Infrastructure for European researchers to preserve, find, access, and process data in a trusted environment 5

6 Example of EUDAT Services: B2DROP B2DROP is a secure and trusted data exchange service for researchers and scientists to keep their research data synchronized and up-to-date and to exchange with other researchers. An ideal solution to:! Store and exchange data with colleagues and team! Synchronize multiple versions of data! Ensure automatic desktop synchronization of large files

7 A pan European Consortium a network of collaborating, cooperating centres, combining the richness of numerous community-specific data repositories with the permanence and persistence of some of Europe s largest scientific data centres e-science Data Factory

8 Scope and objectives for security! Technical approach to security Firewalls, vulnerabilities, intrusions, malware,! Security management approach Business objectives, availability, processes, governance! Narrow but deep scope: Incidents, IT risks, technology! Broader scope: people, processes,business risks, stakeholders, management 8

9 What is information security all about?! Information security is about protecting assets (systems, data, services and reputation) against risks with security controls! Assets can be protected to prevail their Confidentiality Integrity Availability! Information Security: a building block of quality implemented by security controls management accountable but responsibility of all staff

10 Security vs. usability Usability The perceived benefit and quality of a service/product Security The direct or indirect benefits and cost of security controls Should be in a reasonable balance based on risk management 10

11 ISO/ IEC 27001:2013! Cuddle name : ISO27k! Background: BS7799! Update of the standard : :2013! Is the international standard for information security management systems! Organisations can apply for certification covering a scope of it s activities by an accredited certification body 11

12 Other standards and best practices! COBIT! National security standards IT-Grundschutzhandbuch! ISO/IEC (Common criteria)! SCI (Security for Collaborating Infrastructures)! SANS Best Practices! TERENA Best Practices! Industry related regulation (for operators, e.g.)! Skills oriented certifications: CISSP, GCIH, GCED, CISM, 12

13 ISO practicalities! The big global players Google, MS, and Amazon has also achieved the certification for some of their core functions! Successful certification requires Documented management support An approved Statement of Applicability Systematic management reviews of your information security management system (ISMS) ISMS should be known, in use and documented 13

14 Why ISO 27001?! The standard can provide a comprehensive guidance for your ISMS! A systematic framework and checklist to motivate all stakeholders - managament, administrators, all staff, customers, providers to information security! A clear indication to all stakeholders of a serious effort to implement comprehensive ISMS 14

15 ISO27001 Pros and Cons! ISO will not guarantee good information security! True. Also possible to create a compliant but a counter productive ISMS and achieve certification! ISO will require excess bureacracy Depends. It is up to you to define how to comply with the standard! Certification is expensive Depends. You don t have to use expensive consultants to create your ISMS. The audits are not that expensive but not free either. 15

16 ISO27001 Pros and Cons (Contd.)! Security should not be a management concern! Wrong.! ISO is just about creating policies nobody reads.! Wrong, the policies and guidelines must be known and in use to achieve certification! After achieving certification everything is forgotten! Wrong. Maintaining certification is often harder than achieving it requires continuous improvement! We are so good that we don t need standards! The ad hoc way is more efficient and secure 16

17 The structure of the standard! Ten high level clauses and Annex A! New controls in the 2013 version: A Information security in project management A Restrictions on software installation A Secure development policy A Secure system engineering principles A Secure development environment A System security testing A Information security policy for supplier relationships A Information and communication technology supply chain A Assessment of and decision on information security events A Response to information security incidents A Availability of information processing facilities 17

18 Annex A A.5: Information security policies (2 controls) A.6: Organization of information security (7 controls) A.7: Human resource security (6 controls) A.8: Asset management (10 controls) A.9: Access control (14 controls) A.10: Cryptography (2 controls) A.11: Physical and environmental security (15 controls) A.12: Operations security (14 controls) A.13: Communications security (7 controls) A.14: System acquisition, development and maintenance (13 controls) A.15: Supplier relationships (5 controls) A.16: Information security incident management (7 controls) A.17: Business continuity management (4 controls) A.18: Compliance; (8 controls) 18

19 The Audit (1/2)! Must be preceded by Approval of SOA Internal audits/reviews (Pre-audit)! During audit A systematic enquiry if SOA is compliant with the standard and implanted comprehensively Management and staff are interviewed Auditors gather systematically evidence to verify compliance with the standard Verifying skills and security culture also a crucial part of the audit 19

20 The Audit (2/2)!! After audit Non- compliances þ Reporting fixes of non-compliances ý Obtaining certification status ý Surveillance audits (once p.a.) ý Re-audits (every third year) ý Enlarging audit scope? 20

21 How CSC gained the certification (1/2)! Attended training on BS7799 in 2004! Frustration with insufficient commitment and the ad hoc approach on security! Saw risks with over focusing on technical implementations and with emotional reactions to security hype! Frustration with non-coherent national security standards! Began to motivate management to apply for ISO certification 21

22 How CSC gained the certification (2/2)! CSC gained ISO27001 certification for Datacenter Kajaani on summer 2013! Certification scope enlarged to cover all data centers 2014! Certification scope enlarged to cover all ICT platforms! Certification for compliance with the 2013 version of the standard! Surveillance certification 2015 with no non-conformities! New services to be included in next phase 22

23 23

24 Learning from the certification experience! The decision to strive for ISO certification included some risks but has shown to be very beneficial for CSC! The certification process helped us to: Implement a comprehensive ISMS Motivate management and all staff Improve security culture and management! Now the ISO certifications status is a part of CSC communication package 24

25 Learning from (contd.)! Successful certification requires an active, experienced and goal oriented manager Sometimes you must use the word must! Certification also requires sensitivity and good listening skills! At least one sponsor in the management board is necessary! Certification improved risk management and management commitment a lot 25

26 Learning from (contd.)! The most challenging requirements were in operations and in developments! The very core in CSC ISMS is the internal production catalogue with defined owners,admins, BCP s, DRP s, classifications and review cycles! The certification has improved a lot trust to CSC services and to CSC as an organisation NOW we suddenly have very security conscious customers suggesting huge contract fines for security breaches! The certification made CSC management look professional and good, also most staff seems to feel that it was a good idea 26

27 Maintaining certification status! Often harder than obtaining certification! After the first phase, people tend to forget to update guidelines and procedures, new services and people do not always comply! Good security training and constant awareness campaigns help to keep people motivated! Regular management reviews must be continued invest in risk management! Try to streamline and make your ISMS more agile 27

28 Would ISO certification be something for my organisation?! Start with studying the standard and related literature The standard requires professional interpretation! Do an initial gap-analysis in writing! Sketch an draft version of your SOA (contact me for improved templates)! Do you have or will you get management support?! Would it help your stakeholders?! Are you ready to become a less liked person on your organisation at least for some time (3-10 years)! Meet peer organisations on the same path 28

29 Ideas for further cooperation! CSC has a long and rewarding history in cooperation on security TF-CSIRT, FIRST, (ISC)2, SANS, Currently a joint project with Finnish universities for security compliance and peer audits! I look forward to share and jointly develop best ISMS practices with our European peer organisations Cooperatin on service level, on organisational level and between infrastrucures (GÉANT/EUDAT/..) Peer reviews? Liaison with SCI?! Upcoming EU research project for piloting ISMS 29

30 This has of course been a high-level overview, the devil lies in the details. Any comments, criticism and questions are welcome. Lets keep in touch: Urpo.kaila@csc.fi LinkedIn (unique name) 30