HERVÉ SCHAUER CONSULTANTS Cabinet de Consultants en Sécurité Informatique depuis 1989 Spécialisé sur Unix, Windows, TCP/IP et Internet Information Security Certifications Persons / Organizations ENISA workshop What can we achieve with information security certification? Athens, november 28, 2006 Hervé Schauer <Herve.Schauer@hsc.fr> Slides will be available at www.hsc.fr
Hervé Schauer Consultants 2 / 7 Information security consulting since 1989 15 consultants Leading company for security training in french Certifications achieved by consultants : CISSP (ISC2), GIAC GCFA (SANS), ProCSSI (INSECA), BS7799 Lead Auditor (BSI, BVQI), ISO 27001 Lead Auditor (LSTI) HSC provides ISO 27001 Lead Auditor training Certification is done independently by a certification body : LSTI, to comply with ISO 17024 HSC works as ISO 27001 certification auditor for several certification bodies In several european countries
Security certifications for persons 1/3 HSC provide technical security training since 1989 In 2003 and 2004 HSC tried to adopt existing personnel certifications in security, not binded to a product or vendor CISM & CISA from ISACA Not technical, not for resell CEH/CHFI from EC-Council Very low technical level to our experience OPSA, OPST, OPSE from ISECOM Seemed the best after first analysis, but difficult negotiation, very low technical level for first grade to our experience GIAC from SANS Huge investment before starting by attending all existing courses, 60% of the money for them & 40% for HSC, technical level Ok 3 / 7
Security certifications for persons 2/3 CISSP from ISC2 4 / 7 80% of the money for them and 20% for HSC SCNP/SCNA from SecurityCertified (Ascendant Learning) Business model Ok Not easy to sell in France No update of course material ProCSSI from INSECA No training TICSA from TrueSecure Not a reliable company for certification ISO 27001 Lead Auditor Not owned by anyone Based upon ISO 27001, ISO 19011 and ISO 27006 standards, and guides ISO 27002 (ISO 17799), ISO 27004, ISO 27005,...
Security certifications for persons Most "non-profit organizations" providing security certifications for persons are pure profit companies Not claiming the truth does not bring confidence in them Also true for colateral activities such as auditors registrars All existing models have training and certification provided by the same company 3/3 5 / 7
Security certifications for organizations ISO 27001 is attainable to small businesses and any kind of organizations ISO27001 brings to every certified organization a minimum security level True with ISO 17021 and ISO 27006 certification process ISO 27001 implies continuous improvement ISO 27001 is the only way to stop proliferation and costs of information security audits (SoX, Basel II, banking regularory authority, public sector regulatory authority, ITIL/ISO 20000, privacy, etc) ISO 27001 popular in some countries, not popular in others In France, 4 published ISO 27001 certificates 57 in Germany, 42 in Italy, 38 in Spain,... 6 / 7
Conclusion Information security certifications for persons are necessary ENISA shall have a role to promote something complete, not binded to a particular company, with separate training and certification ISO27001 is the easiest way to improve information security in organizations EC should promote ISO 27001 certification of organizations as a requirement in calls for offers EC must request ISO 27001 certification as mandatory for organizations using EU funding, and organizations using personal data, eventually with privacy extensions Questions? Herve.Schauer@hsc.fr www.hsc.fr 7 / 7