Hierarchical Security Management 2nd Security Workshop: Future Security January 16-17, 2007 Sophia Antipolis, France Johan D. Bakker MSc CISSP ISSAP Royal Dutch Telecom (KPN)
Agenda ISO 27001 Organizing security governance Hierarchical ISMS approach Future work Questions 1
ISO 27001 What ISO 27001 does: Provides a model and requirements Plan for establishing, implementing, Act Do operating, monitoring, reviewing, Check maintaining and improving an Information Security Management System (ISMS) 2
ISO 27001 What ISO 27001 doesn t do: Specify organizational requirements and structure for security governance and compliance reporting for a large and complex organization...that offers hundreds of products and services, with 16.000 employees, organized in a score of different departments within 5 different market or corporate segments. 3
Organizing security governance Policy Rules Means Corporate Security Policy CSP Compliance Framework #1.1 #1.2 #1.3 #2.1 Security Management Requirements Security Design principles and axioms Security Management Implementation Manual Baseline Security Controls #3 #4 #5 #2.2 Guidelines, templates, methods, tools #6 #7 Introduction into the CSPF Functional Security Policies Security Report Repository for Support Functions 4
Organizing security governance CISO / CFO Corporate Center Strategic MT MT Tactical Reporting Units (TRU).(5 TRU s) Tactical Operational Reporting Units (ORU) MT MT MT MT MT MT MT MT Operational 5
Organizing security governance Governance CISO / CFO Strategic MT MT.(5 TRU s) Tactical MT MT MT MT MT MT MT MT Operational 6
Organizing security governance Governance CISO / CFO Compliance reporting MT MT.(5 TRU s) MT MT MT MT MT MT MT MT 7
Hierarchical ISMS approach - What if. the same ISMS approach could be used for the operational, tactical and strategic level? Then, all levels could share the same vocabulary, document templates, concepts. To enable this, it is required to parameterize some concepts in the ISMS process, depending on the scope and abstraction level. 8
Hierarchical ISMS approach - Parameters to an ISMS What is in Scope of the ISMS? What is the Context of the ISMS? Related to what type of Assets? What Aspects of the assets is focussed on? What type of Risks are managed? What type of Controls are available? 9
Hierarchical ISMS approach - Parameter values Scope Context Security aspects Assets Risks Controls Strategic Tactical Operational (typical 27001) KPN Enterprise Market, legal, regulatory, societal developments, KPN Mission Enterprise impact, tactical level of compliance The KPN Brand(s) Enterprise risks CSP Framework, tactical ISMS s Tactical Reporting Unit Business developments, demand/supply chain, tactical scopes, CSP Business impact, operational level of compliance Products, services and processes Business risks SLA s, local policies operational ISMS s Product(s), service(s) or process(es) Cust. requirements, CSP and local policies and procedures Confidentiality, Integrity and Availability Typical Information assets Security risks ISO/IEC 17799:2005 controls 10
Hierarchical ISMS approach - Benefits Defined enterprise-wide governance approach Uniform dossier templates Shared vocabulary Solid bases for compliance reporting 11
Future work. Risk aggregation Compliance metrics Integration into a single management system Corporate Baseline - COSO II (SOx), ISO9001 & ISO27001 amended with ISO14000, ISO10002, SAS70, ITIL, etc. depending on the type of department 12
Questions 13