How To Manage Information Technology
|
|
|
- Corey Payne
- 3 years ago
- Views:
Transcription
1 Nachweis der erreichten Sicherheit durch Prüfungen nach Standards?! DECUS Rheinlandtreffen St. Augustin, Bundesamt für Sicherheit in der Informationstechnik
2 ISO/IEC nicht ISO/IEC 2. Standards 1. Basics Sicherheitsmanagement Darstellungsmerkmale Bewertungskriterien 3. Charakteristika 4. Fazit
3 Securing business processes Business needs Customer requests Critical business processes Information Processing Service/ Product delivery ICT Support
4 Relationship between I and ICT The more Information is processed by Information and communications technology the more ICT is required to secure Information!
5 ISO/IEC nicht ISO/IEC 2. Standards 1. Basics Sicherheitsmanagement Darstellungsmerkmale Bewertungskriterien 3. Charakteristika 4. Fazit
6 Standard will guide you on your way BS IS IS BSI IT BPM IS ISF FSoGP
7 ISO/IEC-Standards on Management TR 13335: Guidelines for the Management of IT (GMITS) IS 13335: Management of information and communications technology security (MICTS) IS 17799: Code of Practice for Information Management IS 21827: System Engineering - Capability Maturity Model TR 13569: Banking and other financial services Study period on information security management systems => NP on ISMS requirements (IS 24743) NP on ISM metrics and measurement (IS 24742) [ISO/IEC JTC 1 SC 27 WG 1]
8 Some more non ISO-Standards (German) IT Baseline Protection Manual (IT BPM) (British) ISMS - Specification with Guidance for Use (BS ) ISF: The Forum s Standard of Good Practice (FSoGP) ISACA: Control objectives for information and related technologies (Cobit) NIST: An Introduction to Computer - The NIST Handbook (SP ) Information Technology Infrastructure Library (ITIL)...
9 Benefit and effort of assessment What a standard is able to do! What a standard is expected to do! Peer-to-peer comparison makes no sense -> classification scheme
10 ISO/IEC nicht ISO/IEC 2. Standards 1. Basics Sicherheitsmanagement Darstellungsmerkmale Bewertungskriterien 3. Charakteristika 4. Fazit
11 Using which standard what for? Peer-to-peer comparison makes no sense -> classification scheme Black box comparison -> characteristics: subject, audience, granularity, certificate standard fits to users s problem White box comparison -> characteristics: purpose, focus, statement application of standard supports user s intention
12 IS Code of practice for information security management (fast track of BS , under revision since 2000, now FDIS)... guidelines and principles for initiating, implementing, maintaining, and improving information security management... -> what to do -> security officer... each area introduced by a description of the goal ( objective ) and structured into subchapters ( controls ) with different depth new: control statement, implementation guidance, other information... covers several control areas such as policy, organization, asset management, personnel, physical security, operational issues, access control, systems aquisistion & development, incident management, business continuity, and compliance new: risk assessment and treatment checklist without priority/ sequence BUT: no metric defined in order to support the assessment
13 Control areas Business Continuity Policies Information and Communications Technology Compliance Checking Personnel Operational Issues Organization Incident Management Physical & Environmental Configuration & Change Management Asset Management [See IS 17799]
14 IS Management of Information and Communications Technology (MICTS = the new GMITS) part 1: concepts and models for ICT security management (now IS) part 2: techniques for ICT security risk management (now 4thWD)... to assist the implementation of information security... -> how to do -> security officer... covers security elements and relationships, ICT policy, organizational aspects, security management functions, risk management process... contains techniques for ICT risk management which can be used to assess security requirements and risks, and help to initiate and followup appropriate safeguards concepts/models, and techniques without pre-scribing BUT: no metric defined to check whether the techniques are in place
15 Risk activities Communicate/ Document & report Assess risks Establish context Identify risks Analyse risks Evaluate risks Treat risks Monitor & review [See IS ]
16 BS Information security management systems - Specification with guidance for use (new NP in ISO/IEC, now FCD)... based on the PDCA-model (by Deming) -> management system -> senior management...defines key elements such as general requirements, establishing an maintaining ISMS, documentation requirements, management commitment, resource management, general review requirements, review input, review output, internal audits, continual improvements, corrective and prevention action... emphasises systematic approach to risk assessment mingles operative and management processes BUT: no parameters/ indicators to measure effectiveness/ performance
17 IT BPM IT Baseline Protection Manual... focuses on ICT security -> what AND how to do -> security officer and administrator... based on the risk assessment methodology and risk treatment option of IS comprises criteria to select safeguards based on typical technical components & methodology to evaluate security level (based on a published assessment scheme)... deals with security activities/ elements supported by in-depth implementation guidance & gives background information on threats/ vulnerabilities listed in catalogues AND: defines metric to support assessment and to check whether techniques are in place
18 IT BPM - assess risks Identify risks IT Structure analysis: Document technical topology (network plan) Draw up inventory of assets (systems/applications) Reduce complexity (by grouping) Analyse risks Analysis of protection requirements Baseline protection modelling Supplementary security analysis Evaluate risks (compliance) checking: Compare implementation against catalogues Evaluate non-conformities Document results
19 IT BPM - assessment self-declaration certificate Produce an audit report based on a defined methodology and a published scheme documentation Model & Check Logical clusters of technical components (=set of IT assets) Entry level A Advanced level B Complete level C
20 Black box comparison - summary subject audience granularity certificate IS Information officer Medium No IS Informations- & communications technology security officer Medium No BS Information Senior management Low Yes BSI IT-BPM Informations- & communications technology security officer & administrator High Yes
21 Using which standard what for? Peer-to-peer comparison makes no sense -> classification scheme Black box comparison -> characteristics: subject, audience, granularity, certificate standard fits to users s problem White box comparison -> characteristics: purpose, focus, statement application of standard supports user s intention
22 Sicherheitsmanagement ist... die Gesamtheit aller Tätigkeiten und Zielsetzungen zum Erreichen und Aufrechterhalten eines angemessenen Sicherheitszustands basierend auf einer entsprechenden Aufbau- und Ablauforganisation bezogen auf die Bedürfnisse einer Organisation unter Mitwirkung aller Mitglieder mittels bestimmter Mittel und Verfahren ausgerichtet auf Kunden-/ Mitarbeiterzufriendenheit, langfristigen Geschäftserfolg sowie gesellschaftlichen Nutzen.
23 ... from the view of a process approach Strategies, Policies,... Parameters, Indicators,... Business needs/ policy Prozess: Activities & Sub-processes level/ plan Roles & Responsibilities, Principles,... People, Budget,...
24 management process Design plan Operation Integration/ Deployment
25 management system Goals Metrics policy Organization Resources
26 Business needs Engineer requirements Policy Detect events React on incidents Functionality What is to do to secure? Select controls level Implement controls plan detect, protect, react
27 Business needs Assurance Document results Report deviations level Review requirements What was done to be ensured? Monitor controls Policy Asses risks plan accept, avoid, REDUCE, transfer
28 Assessing Business needs fulfilled! policy Procedures performed! Conformance? plan level realised! Non-technical compliance? Technical compliance?
29 Assessing (cont.) Management System Performance/ Efficiency? Quality/ Effectiveness? Management Process Doing things right! Doing the right things!
30 White box comparison - summary purpose focus statement IS Process/ System Functionality Conformance IS System/ Process Functionality/ Assurance Conformance BS System Assurance Conformance BSI IT-BPM Process/ System Functionality/ Assurance Conformance/ Compliance
31 ISO/IEC nicht ISO/IEC 2. Standards 1. Basics Sicherheitsmanagement Darstellungsmerkmale Bewertungskriterien 3. Charakteristika 4. Fazit
32 Process(es) Intro Environment Business needs/ policy level/ plan
33 Vielen Dank für Ihre Aufmerksamkeit!??????? Fragen?
Integrated Information Management Systems
Integrated Information Management Systems Ludk Novák ludek.novak@anect.com ANECT a.s. Brno, Czech Republic Abstract The article tries to find consensus in these tree different types of the systems the
Safeguards Frameworks and Controls. Security Functions Parker, D. B. (1984). The Many Faces of Data Vulnerability. IEEE Spectrum, 21(5), 46-49.
Safeguards Frameworks and Controls Theory of Secure Information Systems Features: Safeguards and Controls Richard Baskerville T 1 F 1 O 1 T 2 F 2 O 2 T 3 F 3 O 3 T 4... T n...... F l O m T F O Security
De Nieuwe Code voor Informatiebeveiliging
De Nieuwe Code voor Informatiebeveiliging Piet Donga, ING Voorzitter NEN NC 27 - IT Security 1 Agenda Standardisation of Information security The new Code of Practice for Information Security The Code
iso20000templates.com
iso20000templates.com Public IT Limited 2011 IT Service Policy Document Ref. ITSM01001 Version: 1.0 Draft 1 Document Author: Document Owner: V 1.0 Draft 1 Page 1 of 11 Revision History Version Date RFC
SPICE auf der Überholspur. Vergleich von ISO (TR) 15504 und Automotive SPICE
SPICE auf der Überholspur Vergleich von ISO (TR) 15504 und Automotive SPICE Historie Software Process Improvement and Capability determination 1994 1995 ISO 15504 Draft SPICE wird als Projekt der ISO zur
Information security audit (IS audit) - A guideline for IS audits based on IT-Grundschutz
Information security audit (IS audit) - A guideline for IS audits based on IT-Grundschutz German Federal Office for Information Security Postfach 20 03 63 53133 Bonn Tel.: +49 22899 9582-0 E-Mail: isrevision@bsi.bund.de
Cyber Security From product to system solution
Markus Brändle, Network Management Forum Heidelberg, 8./9./10. October 2013 Cyber Security From product to system solution ABB Network Management Forum October 14, 2013 Slide 1 Cyber Security A definition
ISO 27000 Information Security Management Systems Foundation
ISO 27000 Information Security Management Systems Foundation Professional Certifications Sample Questions Sample Questions 1. is one of the industry standards/best practices in Service Management and Quality
ISO/IEC 20000 Part 1 the next edition. Lynda Cooper project editor for ISO20000 part 1
ISO/IEC 20000 Part 1 the next edition Lynda Cooper project editor for ISO20000 part 1 Agenda The ISO20000 series Why has it changed Changes ITIL3 impact New requirements Changed requirements How to prepare
AN OVERVIEW OF INFORMATION SECURITY STANDARDS
AN OVERVIEW OF INFORMATION SECURITY STANDARDS February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced
Preparation Guide. EXIN IT Service Management Associate Bridge based on ISO/IEC 20000
Preparation Guide EXIN IT Service Management Associate Bridge based on ISO/IEC 20000 Edition January 2014 Copyright 2014 EXIN All rights reserved. No part of this publication may be published, reproduced,
SC7-ISO20000 Alignment issues Aligning ITIL to existing ISO JTC1- SC7 Software Engineering Standards
SC7-ISO20000 Alignment issues Aligning ITIL to existing ISO JTC1- SC7 Software Engineering Standards Dr. A.April ETS University Table of Contents Objectives Audience Current clash An ITIL overview ISO
Benchmark of controls over IT activities. 2011 Report. ABC Ltd
www.pwc.com/cy Benchmark of controls over IT activities 2011 Report ABC Ltd... 2012 Scope and approach We wish to provide you with our IT Benchmarking report over IT activities at ABC Ltd (the Company)
ISO/IEC 27001:2013 webinar
ISO/IEC 27001:2013 webinar 11 June 2014 Dr. Mike Nash Gamma Secure Systems Limited UK Head of Delegation, ISO/IEC JTC 1/SC 27 Introducing ISO/IEC 27001:2013 and ISO/IEC 27002:2013 New versions of the Information
2008 by Bundesamt für Sicherheit in der Informationstechnik (BSI) Godesberger Allee 185-189, 53175 Bonn
2008 by Bundesamt für Sicherheit in der Informationstechnik (BSI) Godesberger Allee 185-189, 53175 Bonn Contents Contents 1 Introduction 1.1 Version History 1.2 Objective 1.3 Target group 1.4 Application
Tutorial: Towards better managed Grids. IT Service Management best practices based on ITIL
Tutorial: Towards better managed Grids. IT Service Management best practices based on ITIL EGI Technical Forum 2011, Lyon (France) September 22, 2011 Dr. Thomas Schaaf www.gslm.eu EMERGENCE TECH LTD. The
Fall June S o f t w a r e I m p r o v e m e n t G r o u p ( S I G )
June 2014 4 A lightweight, flexible evaluation framework to measure the ISO 27002 information security controls Karin Huijben Master Computing Science Radboud University, Nijmegen, The Netherlands Software
Information Security Management Systems
Information Security Management Systems Øivind Høiem CISA, CRISC, ISO27001 Lead Implementer Senior Advisor Information Security UNINETT, the Norwegian NREN About Øivind Senior Adviser at the HE sector
Certified Information Security Manager (CISM)
Certified Information Security Manager (CISM) Course Introduction Course Introduction Domain 01 - Information Security Governance Lesson 1: Information Security Governance Overview Information Security
2008 by Bundesamt für Sicherheit in der Informationstechnik (BSI) Godesberger Allee 185-189, 53175 Bonn
2008 by Bundesamt für Sicherheit in der Informationstechnik (BSI) Godesberger Allee 185-189, 53175 Bonn Contents Contents 1 Introduction 5 1.1 Version history 5 1.2 Aims 5 1.3 Target group 6 1.4 Application
Course: Information Security Management in e-governance. Day 1. Session 3: Models and Frameworks for Information Security Management
Course: Information Security Management in e-governance Day 1 Session 3: Models and Frameworks for Information Security Management Agenda Introduction to Enterprise Security framework Overview of security
Preparation Guide. EXIN IT Service Management Associate based on ISO/IEC 20000
Preparation Guide EXIN IT Service Management Associate based on ISO/IEC 20000 Edition January 2014 Copyright 2014 EXIN All rights reserved. No part of this publication may be published, reproduced, copied
Domenico Raguseo. IT Governance e Business Technology (approfondimenti su ITIL)
IT Governance e Business Technology (approfondimenti su ITIL) Domenico Raguseo Italy Client Technical Professional Manager SW Europe Service Management Solution Architect Leader http://www.linkedin.com/in/dragus
IT Governance: The benefits of an Information Security Management System
IT Governance: The benefits of an Information Security Management System Katerina Cai, CISSP Hewlett-Packard 2004 Hewlett-Packard Development Company, L.P. The information contained herein is subject to
ISMS Implementation Guide
atsec information security corporation 9130 Jollyville Road, Suite 260 Austin, TX 78759 Tel: 512-615-7300 Fax: 512-615-7301 www.atsec.com ISMS Implementation Guide atsec information security ISMS Implementation
Dokument Nr. 521.dw Ausgabe Februar 2013, Rev. 01. . Seite 1 von 11. 521d Seite 1 von 11
Eidgenössisches Departement für Wirtschaft, Bildung und Forschung WBF Staatssekretariat für Wirtschaft SECO Schweizerische Akkreditierungsstelle SAS Checkliste für die harmonisierte Umsetzung der Anforderungen
List of courses offered by Marc Taillefer
ISO/IEC 20000 Foundation (IS20F.EN) List of courses offered by Marc Taillefer Designed to provide knowledge of what an IT service management system is and the minimum requirements that service providers
Governance and Management of Information Security
Governance and Management of Information Security Øivind Høiem, CISA CRISC Senior Advisor Information Security UNINETT, the Norwegian NREN About Øivind Senior Adviser at the HE sector secretary for information
Information Security Standards by Dr. David Brewer Gamma Secure Systems Limited Diamond House, 149 Frimley Road Camberley, Surrey, GU15 2PS +44 1276
Information Security Standards by Dr. David Brewer Gamma Secure Systems Limited Diamond House, 149 Frimley Road Camberley, Surrey, GU15 2PS +44 1276 702500 dbrewer@gammassl.co.uk Agenda Background and
Hong Kong Information Security Group TRAINING AGENDA
TRAINING AGENDA THE ITIL FOUNDATION CERTIFICATE IN IT SEVICE MANAGEMENT The purpose of the ITIL Foundation certificate in IT Service Management is to certify that the candidate has gained knowledge of
The new 27000 Family of Standards & ISO/IEC 27001
ISO/IEC 27000 Family of Standards by Dr. Angelika Plate 07-09 June 2011, Beirut, Lebanon June 2011 The new 27000 Family of Standards & ISO/IEC 27001 June 2011 ISO/IEC 27000 Family of Standards 2 The new
How To Understand The Differences Between The 2005 And 2011 Editions Of Itil 20000
A Guide to the new ISO/IEC 20000-1 The differences between the 2005 and the 2011 editions A Guide to the new ISO/IEC 20000-1 The differences between the 2005 and the 2011 editions Lynda Cooper First published
Build yourself a risk assessment tool
1 Build yourself a risk assessment tool The plan: 25 min theory 20 min practice 5 min questions Vlado Luknar CISSP, CISM, CISA, CSSLP, BSI ISO 27001 Lead Implementer di-sec.com Do you need your own tool?
Details for the structure and content of the ETR for Site Certification. Version 1.0
Details for the structure and content of the ETR for Site Certification Version 1.0 Bundesamt für Sicherheit in der Informationstechnik Postfach 20 03 63 53133 Bonn Tel.: +49 22899 9582-111 E-Mail: zerti@bsi.bund.de
EXIN Foundation in IT Service Management based on ISO/IEC 20000
Preparation Guide EXIN Foundation in IT Service Management based on ISO/IEC 20000 Edition June 2015 Copyright 2015 EXIN All rights reserved. No part of this publication may be published, reproduced, copied
A Structured Comparison of Security Standards
A Structured Comparison of Security Standards Kristian Beckers 1, Isabelle Côté 3, Stefan Fenz 2, Denis Hatebur 1,3, and Maritta Heisel 1 1 paluno - The Ruhr Institute for Software Technology - University
Certifying Information Security Management Systems
Certifying Information Security Management Systems Certifying Information Security Management Systems by Fiona Pattinson CISSP, CSDP July 2007 A brief discussion of the role of an information security
Practical implementation of ISO 27001 / 27002
Practical implementation of ISO 27001 / 27002 Lecture #2 Security in Organizations 2011 Eric Verheul 1 Main literature for this lecture: 1. ISO 27001 and ISO 27002 Literature 2. How to Achieve 27001 Certification,
Standardising privacy and security for the cloud
Standardising privacy and security for the cloud Chris Mitchell Royal Holloway, University of London www.chrismitchell.net 1 Acknowledgements Like to thank organisers of event for inviting me to contribute.
The CMDB at the Center of the Universe
The CMDB at the Center of the Universe Reg Harbeck CA Wednesday, February 27 Session 5331 Purpose Clarify origin of CMDB concept and what it is Understand difference and equivalence between CMDB and Asset
Exam : EX0-100. Title : ITIL Foundation Certificate in IT Service Management. Ver : 08.01.06
Exam : EX0-100 Title : ITIL Foundation Certificate in IT Service Management Ver : 08.01.06 QUESTION 1 The successful diagnosis of a problem results in a Known Error. On the basis of this Known Error a
INFORMATION SYSTEMS. Revised: August 2013
Revised: August 2013 INFORMATION SYSTEMS In November 2011, The University of North Carolina Information Technology Security Council [ITSC] recommended the adoption of ISO/IEC 27002 Information technology
CYBERSECURITY SLAs: MANANGING REQUIREMENTS AT ARM S LENGTH
CYBERSECURITY SLAs: MANANGING REQUIREMENTS AT ARM S LENGTH Matthew J. Butkovic, CISSP Carnegie Mellon University, The Software Engineering Institute, CERT Samuel A. Merrell, CISSP Carnegie Mellon University,
ITIL V3 and ISO/IEC 20000
For IT Service Management ITIL V3 and ISO/IEC 20000 Jenny Dugmore and Sharon Taylor Alignment White Paper March 2008 ITIL V3 and ISO/IEC 20000 Background For some years the close relationship between ITIL
Information Security ISO Standards. Feb 11, 2015. Glen Bruce Director, Enterprise Risk Security & Privacy
Information Security ISO Standards Feb 11, 2015 Glen Bruce Director, Enterprise Risk Security & Privacy Agenda 1. Introduction Information security risks and requirements 2. Information Security Management
ITIL: What is it? How does ITIL link to COBIT and ISO 17799?
ITIL: What is it? How does ITIL link to COBIT and ISO 17799? 1 What is ITIL? The IT Infrastructure Library A set of books comprising an IT service management Best Practices framework An industry of products,
Entschuldigen Sie mich, I did not understand, parlez-vous IT Методы обеспечения защиты?
Entschuldigen Sie mich, I did not understand, parlez-vous IT Методы обеспечения защиты? World Standards Day 2015 ILNAS 2015-10-14 Cédric Mauny, Vice-Chairman of Luxembourg National Committee ISO/IEC JTC1
ITIL Service Lifecycle Stream
ITIL Lifecycle Stream Syllabus at a Glance Strategy Design Transition Operation Continual Improvement Introduction to service strategy Introduction to service design Introduction to service transition
Information Management Advice 35: Implementing Information Security Part 1: A Step by Step Approach to your Agency Project
Information Management Advice 35: Implementing Information Security Part 1: A Step by Step Approach to your Agency Project Introduction This Advice provides an overview of the steps agencies need to take
COBIT 5 For Cyber Security Governance and Management. Nasser El-Hout Managing Director Service Management Centre of Excellence (SMCE)
COBIT 5 For Cyber Security Governance and Management Nasser El-Hout Managing Director Service Management Centre of Excellence (SMCE) Cybersecurity Governance using COBIT5 Cyber Defence Summit Riyadh, KSA
Introduction to ITIL for Project Managers
CSC NORTH AMERICAN PUBLIC SECTOR Introduction to ITIL for Project Managers May Chantilly Luncheon Linda Budiman, PMP ITILv2 & ITILv3 Process Architect ITIL Service Manager, CobiT certified 5/13/2008 8:08:45
Information Security Management Systems
Information Security Management Systems Information Security Management Systems Conformity Assessment Scheme ISO/IEC 27001:2005 (JIS Q 27001:2006) ITMangement Center Japan Information Processing Development
Understanding Management Systems Concepts
Understanding Management Systems Concepts Boğaç ÖZGEN Lead Auditor 1 管 理 计 划 初 始 化 做 实 施 检 查 控 制 过 程 行 动 改 善 活 动 系 统 监 视 2 Management (PLAN) Planning and Organizing (DO) Implementing and realization of
Sicherheit durch Open Source?! Markus Hennig CTO, Astaro
Sicherheit durch Open Source?! Markus Hennig CTO, Astaro Open Source? Sicherheit Open Source Page 2 Open Source! Sicherheit Open Source Page 3 Open Source the most famous Sicherheit Open Source Page 4
1. Verzeichnis der ITIL V3 Service Strategy Prozesse
1. Verzeichnis der ITIL V3 Service Strategy Prozesse Service Strategy Service Portfolio Financial Conception of IT Strategy IT Financial Organization Maintenance of the Service Portfolio IT Budgeting Demand
Criticism of Implementation of ITSM & ISO20000 in IT Banking Industry. Presented by: Agus Sutiawan, MIT, CISA, CISM, ITIL, BSMR3
Criticism of Implementation of ITSM & ISO20000 in IT Banking Industry Presented by: Agus Sutiawan, MIT, CISA, CISM, ITIL, BSMR3 Outline What is IT Service Management What is ISO 20000 Step by step implementation
Agile Information Security Management in Software R&D
Agile Information Security Management in Software R&D Rational and WebSphere User Group Finland Seminar 29.01.2008 Reijo Savola Network and Information Security Research Coordinator VTT Technical Research
CMS Policy for Configuration Management
Chief Information Officer Centers for Medicare & Medicaid Services CMS Policy for Configuration April 2012 Document Number: CMS-CIO-POL-MGT01-01 TABLE OF CONTENTS 1. PURPOSE...1 2. BACKGROUND...1 3. CONFIGURATION
Recent Advances in Automatic Control, Information and Communications
Proposal of the improvement of actual ITIL version based on comparative IT Service Management methodologies and standards The implementation of IT Service Management frameworks and standards Anel Tanovic*,
Domain 5 Information Security Governance and Risk Management
Domain 5 Information Security Governance and Risk Management Security Frameworks CobiT (Control Objectives for Information and related Technology), developed by Information Systems Audit and Control Association
Information Security Awareness Training
Information Security Awareness Training Presenter: William F. Slater, III M.S., MBA, PMP, CISSP, CISA, ISO 27002 1 Agenda Why are we doing this? Objectives What is Information Security? What is Information
Service management: what standards can do for business the example of FitSM. 2015 Cloud Security Alliance - All Rights Reserved.
Service management: what standards can do for business the example of FitSM Owen Appleton Managing Director, Emergence Tech Limited Dr. Thomas Schaaf FedSM Project Director, Ludwig-Maximilians-Universität
An Overview of ISO/IEC 27000 family of Information Security Management System Standards
What is ISO/IEC 27001? The ISO/IEC 27001 standard, published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), is known as Information
Information security. daniel.dresner@ncc.co.uk 2005 PROVIDING PERSONAL AND PROFESSIONAL DEVLOMENT FOR IT LEADERS
Information security daniel.dresner@ncc.co.uk 2005 PROVIDING PERSONAL AND PROFESSIONAL DEVLOMENT FOR IT LEADERS The National Computing Centre 2008 You can t undisclose a disclosure 1 ISO 9001 Act Quality
Information Security Development Trends
Information Security Development Trends E. von Solms a Prof J.H.P Eloff b b a Department Computer Science and Information Systems, University of South Africa, Pretoria, SA, vsolme@unisa.ac.za Department
Information Security Management Systems. Chief Operating Officer, Director of Strategy and Business Development, Chief Information Security Officer
Information Security Management Systems Chief Operating Officer, Director of Strategy and Business Development, Chief Information Security Officer atsec information security, 2013 ISO/IEC 27001 and related
Preparation Guide. Side entry to the EXIN Expert in IT Service Management based on ISO/IEC 20000
Preparation Guide Side entry to the EXIN Expert in IT Service Management based on ISO/IEC 20000 Edition June 2015 Copyright 2015 EXIN All rights reserved. No part of this publication may be published,
Frameworks for IT Management
Frameworks for IT Management Copyright protected. Use is for Single Users only via a VHP Approved License. For information and printed versions please see www.vanharen.net 18 ITIL - the IT Infrastructure
ETSI TS 102 042: Electronic Signatures and Infrastructures (ESI): Policy
Abbreviations AIS BGBl BNetzA BSI CC CEM CSP DAR DATech DIN EAL ETR ETSI ISO IT ITSEC ITSEF ITSEM JIL PP SF SigG SigV SOF Anwendungshinweise und Interpretationen zum Schema [Guidance and Interpretations
How small and medium-sized enterprises can formulate an information security management system
How small and medium-sized enterprises can formulate an information security management system Royal Holloway Information Security Thesis Series Information security for SMEs Vadim Gordas, MSc (RHUL) and
NIST National Institute of Standards and Technology
NIST National Institute of Standards and Technology Lets look at SP800-30 Risk Management Guide for Information Technology Systems (September 2012) What follows are the NIST SP800-30 slides, which are
ISO/IEC 27001:2013 Thema Änderungen der Kontrollen der ISO/IEC 27001:2013 im Vergleich zur Fassung aus 2005 Datum 20.01.2014
ISO/IEC 27001:2013 Thema Änderungen der Kontrollen der ISO/IEC 27001:2013 im Vergleich zur Fassung aus 2005 Datum 20.01.2014 Legende: gering mittel hoch Änderungsgrad A.5 Information security policies
Method- and Tool-Support for a Customer-Integrated Assembly Process
Overview Reasons for Customer-Integrated Assembly Application Overview Methodical Approaches Shopfloor Information Concept The Contribution is based on work and results achieved in the project MUSKIM Methoden-
Free ITIL v.3. Foundation. Exam Sample Paper 4. You have 1 hour to complete all 40 Questions. You must get 26 or more correct to pass
Free ITIL v.3. Foundation Exam Sample Paper 4 You have 1 hour to complete all 40 Questions You must get 26 or more correct to pass Compliments of Advance ITSM www.advanceitsm.com 1 A Service is not very
Tutorial on Service Level Management in e- Infrastructures State of the Art and Future Challenges. The FedSMProject Thomas Schaaf & Owen Appleton
Tutorial on Service Level Management in e- Infrastructures State of the Art and Future Challenges The FedSMProject Thomas Schaaf & Owen Appleton Contents IntroducCon Background: why ITSM in e- Infrastructure?
1 What does the 'Service V model' represent? a) A strategy for the successful completion of all service management projects
1 What does the 'Service V model' represent? a) A strategy for the successful completion of all service management projects b) The path to Service Delivery and Service Support for efficient and effective
Improving Residual Risk Management Through the Use of Security Metrics
Improving Residual Risk Management Through the Use of Security Metrics Every investment in security should be effective in reducing risk, but how do you measure it? Jonathan Pagett and Siaw-Lynn Ng introduce
ITIL QUALIFICATION SCHEME & ROLE-BASED TRAINING MATRIX WHITE PAPER
& ROLE-BASED TRAINING MATRIX WHITE PAPER PRESENTED BY: PUBLISHED: MAY 1, 2014 VERSION: 4 LISA SCHWARTZ AND DONNA KNAPP, ITSM ACADEMY SECTION PAGE Overview 2 Path to ITIL Expert Certification 3-5 Complementary
Enterprise Security Management. IT risks put business at risk.
Enterprise Security Management. IT risks put business at risk. Risk management and IT. More than just security products and services. Today, many different business processes would hardly be conceivable
Introduction: ITIL Version 3 and the ITIL Process Map V3
Introduction: ITIL Version 3 and the ITIL Process Map V3 IT Process Maps www.it-processmaps.com IT Process Know-How out of a Box IT Process Maps GbR, 2009-2 - Contents HISTORY OF ITIL... 4 The Beginnings...
The Future of Best Practices in IT Service Management - ITIL Version 3 Explained
The Future of Best Practices in IT Service Management - ITIL Version 3 Explained Reg Harbeck CA Monday, August 13, 2007 Session 1455 ITIL V3: The Processes Governance Processes: Service Measurement Service
Foundation Bridge in IT Service Management (ITSM) according to ISO/IEC 20000. Specification Sheet. ISO/IEC 20000 Foundation Bridge TÜV SÜD Akademie
Foundation Bridge in IT Service Management (ITSM) according to ISO/IEC 20000 Specification Sheet TÜV SÜD Akademie Issue: 2.0 Date: 25 October 2012 Table of Contents 1 Reading aid... 4 2 ISO/IEC 20000 -
Business Continuity Management
GENERALLY ACCESSIBLE Business Continuity Management Field Report from an Audit Point of View ISACA Swiss Chapter - After Hour Seminar 28 August 2006 - Urs Voigt - Group Internal Audit Disasters Happen
EUROPEAN WORKSHOP ON INDUSTRIAL COMPUTER SYSTEMS
EUROPEAN WORKSHOP ON INDUSTRIAL COMPUTER SYSTEMS TECHNICAL COMMITTEE 7 RELIABILITY, SAFETY & SECURITY Document Number: WP 5016 V1 Plenary O Category: Workplan O Subgroup Curr O Minutes O FM O Technical
itsmf USA Problem Management Community of Interest
itsmf USA Problem Management Community of Interest How to Assess and Improve Your Problem Management Process Moderator John Clipp Speaker Ted Gaughan Problem Management SIG President ITSM Practice Lead
JTC 1/SC 27Security Techniques - Översikt arbetsgrupper och standarder
JTC 1/SC 27Security Techniques - Översikt arbetsgrupper och standarder WG 1 Information security management systems WG 2 Cryptography and security mechanisms WG 3 Security evaulation criteria WG 4 Security
By. Mr. Chomnaphas Tangsook Business Director BSI Group ( Thailand) Co., Ltd
BS 25999 Business Continuity Management By. Mr. Chomnaphas Tangsook Business Director BSI Group ( Thailand) Co., Ltd 1 Contents slide BSI British Standards 2006 BS 25999(Business Continuity) 2002 BS 15000
Key-Words: - The improved model of ITIL 2011 framework, new process model, Cabinet Office, final upgrade of ITIL, Service Portfolio Management.
Proposal of the improvement of actual ITIL version based on comparative IT Service Management methodologies and standards The improved model of ITIL 2011 framework Anel Tanovic*, Fahrudin Orucevic** *Department
How To Manage A Service Transition
SERVICE TRANSITION Service Transition Development and improvement of capabilities for transitioning new and changed services into operations SOURCE: ITIL Service Transition Publication, p. 6 Service Transition
Security Controls What Works. Southside Virginia Community College: Security Awareness
Security Controls What Works Southside Virginia Community College: Security Awareness Session Overview Identification of Information Security Drivers Identification of Regulations and Acts Introduction
Which statement about Emergency Change Advisory Board (ECAB) is CORRECT?
ITIL Foundation mock exam 4 1. Which of the following is NOT a purpose of Service Transition? A) To ensure that a service can be managed, operated and supported B) To provide training and certification
Service Asset & Configuration Management PinkVERIFY
-11-G-001 General Criteria Does the tool use ITIL 2011 Edition process terms and align to ITIL 2011 Edition workflows and process integrations? -11-G-002 Does the tool have security controls in place to
ITIL: Continual Service Improvement
Management of IT Environment (9) Riadenie IT prostredia ITIL: Continual Service Improvement Karol Furdík Department of Cybernetics and AI, FEI TU Košice 1 Outline } CSI - Continual Service Improvement
Was muss ein Unternehmen im Griff haben, wenn es IT einsetzt? Jimmy Heschl
Was muss ein Unternehmen im Griff haben, wenn es IT einsetzt? COBIT is a registered trademark of the Information Systems Audit and Control Association (ISACA ). This product includes COBIT 5, used by permission
Governance For Compliance The Convergence of Central and Distributed IT Compliance Presented to VASCAN Conference 2009
Governance For Compliance The Convergence of Central and Distributed IT Compliance Presented to VASCAN Conference 2009 JASON C. RICHARDS CHIEF INFORMATION SECURITY OFFICER VIRGINIA COMMUNITY COLLEGE SYSTEM
Name: Lynda Cooper Date: November 24th. Revising ISO/IEC 20000 to fit the future of service management
Name: Lynda Cooper Date: November 24th Revising ISO/IEC 20000 to fit the future of service management Agenda Brief overview of ISO20000 Changes Why and How What Your views and how you can influence the
Security metrics to improve information security management
Security metrics to improve information security management Igli TASHI, Solange GHERNAOUTIHÉLIE HEC Business School University of Lausanne Switzerland Abstract The concept of security metrics is a very
Feature. How to Maximize Evidential Weight of Electronically Stored Information Recommendations of BS 10008
Feature Haris Hamidovic, CIA, ISMS IA, ITIL, IT Project+, is chief information security officer at Microcredit Foundation EKI Sarajevo, Bosnia and Herzegovina. Prior to his current assignment, Hamidovic