Baars / Hintzbergen / Smulders Foundations of Information Security Based on ISO27001 and ISO27002

1. Auflage 2010
ISBN: 978-90-8753-634-3
Verlag: Van Haren Publishing
Format: PDF
Kopierschutz: Adobe DRM (»Systemvoraussetzungen)

E-Book, Englisch, 166 Seiten

Reihe: Best Practice

Information security issues impact all organizations; however measures used to implement effective measures are often viewed as a businesses barrier costing a great deal of money. This practical title clearly explains the approaches that most organizations can consider and implement which helps turn Information Security management into an approachable, effective and well-understood tool. It covers:

The quality requirements an organization may have for information;

The risks associated with these quality requirements;

The countermeasures that are necessary to mitigate these risks;

Ensuring business continuity in the event of a disaster;

When and whether to report incidents outside the organization.

All information security concepts in this book are based on the ISO/IEC 27001 and ISO/IEC 27002 standards. But the text also refers to the other relevant international standards for information security.



The text is structures as follows:

Fundamental Principles of Security and Information security and Risk management.

Architecture, processes and information, needed for basic understanding of what information security is about.

Business Assets are discussed.

Measures that can be taken to protect information assets. (Physical measures, technical measures and finally the organizational measures. )

The book also contains many Case Studies which usefully demonstrate how theory translates into an operating environment

This book is primarily developed as a study book for anyone who wants to pass the ISFS (Information Security Foundation) exam of EXIN. In an appendix an ISFS model exam is given, with feedback to all multiple choice options, so that it can be used as a training for the ‘real’ ISFS exam.

Autoren/Hrsg.

Baars, Hans

Hintzbergen, Jule

Hintzbergen, Kees

Smulders, Andre

Inhaltsverzeichnis

1;Colophon;5
2;Preface;6
3;Acknowledgements;8
4;1. Introduction;14
5;2 Case study: Springbooks – an international bookstore;16
5.1;2.1 Introduction;16
5.2;2.2 Springbooks;17
6;3. Definitions;20
7;4. Information, security and architecture;22
7.1;4.1 Fundamental principles of security;22
7.2;4.2 Parkerian hexad;26
7.3;4.3 Due care and due diligence;28
7.4;4.4 Information;29
7.5;4.5 Information management;31
7.6;4.6 Secure information systems design;31
7.7;4.7 Operational processes and information;32
7.8;4.8 Information architecture;35
7.9;4.9 Summary;37
7.10;4.10 Springbooks;37
8;5. Security management;40
8.1;5.1 Security definitions;40
8.2;5.2 Assessing security risks;41
8.3;5.3 Mitigating security risks;42
8.4;5.4 Risk management;43
8.5;5.5 Risk analysis;44
8.6;5.6 Countermeasures to mitigate the risk;47
8.7;5.7 Types of threats;49
8.8;5.8 Types of damage;50
8.9;5.9 Types of risk strategies;51
8.10;5.10 Guidelines for implementing security measures;51
8.11;5.11 Springbooks;51
9;6. Business assets and information security incidents;54
9.1;6.1 Introduction;54
9.2;6.2 What are business assets?;54
9.3;6.3 Managing business assets;55
9.4;6.4 Classification of information;56
9.5;6.5 Managing information security incidents;57
9.6;6.6 Roles;60
9.7;6.7 Summary;60
9.8;6.8 Case study;61
10;7. Physical measures;62
10.1;7.1 Introduction;62
10.2;7.2 Physical security;62
10.3;7.3 Protection rings;63
10.4;7.4 The outer ring;63
10.5;7.5 The building;64
10.6;7.6 The working space;66
10.7;7.7 The object;68
10.8;7.8 Alarms;69
10.9;7.9 Fire protection;69
10.10;7.10 Summary;70
10.11;7.11 Springbooks;71
11;8 Technical measures (IT security);72
11.1;8.1 Introduction;72
11.2;8.2 Computerized information systems;72
11.3;8.3 Logical access control;72
11.4;8.4 Security requirements for information systems;75
11.5;8.5 Cryptography;76
11.6;8.6 Types of cryptographic systems;77
11.7;8.7 Security of system files;82
11.8;8.8 Information leaks;83
11.9;8.9 Cryptography policy;84
11.10;8.10 Summary;84
11.11;8.11 Case study;85
12;9. Organizational measures;86
12.1;9.1 Introduction;86
12.2;9.2 Security policy;86
12.3;9.3 Personnel;90
12.4;9.4 Business continuity management;92
12.5;9.5 Springbooks;97
13;10. Managing communication and operating processes;98
13.1;10.1 Operating procedures and responsibilities;98
13.2;10.2 Change management;98
13.3;10.3 Segregation of duties;99
13.4;10.4 Development, testing, acceptance and production;99
13.5;10.5 Management of services by a third party;100
13.6;10.6 Protection against malware, phishing and spam;101
13.7;10.7 Some definitions;103
13.8;10.8 Back-up and restore;109
13.9;10.9 Managing network security;110
13.10;10.10 Handling media;111
13.11;10.11 Mobile equipment;112
13.12;10.12 Exchanging information;113
13.13;10.13 Services for e-commerce;114
13.14;10.14 Publically available information;115
13.15;10.15 Summary;115
13.16;10.16 Case study;116
14;11 Law, regulations and standards;118
14.1;11.1 Introduction;118
14.2;11.2 Observance of statutory regulations;118
14.3;11.3 Compliance;119
14.4;11.4 Intellectual property rights (IPR);120
14.5;11.5 Protecting business documents;121
14.6;11.6 Protecting data and the confidentiality of personal data;122
14.7;11.7 Preventing abuse of IT facilities;122
14.8;11.8 Observing security policy and security standards;123
14.9;11.9 Monitoring measures;124
14.10;11.10 Information system audits;124
14.11;11.11 Protecting tools used for auditing information systems;124
14.12;11.12 Standards and standards organizations;125
14.13;11.13 Summary;126
14.14;11.14 Case study;127
15;Appendix A Glossary;128
16;Appendix B1 Sample exam Information Security Foundation based on ISO/IEC 27002;132
17;Appendix B2 Evaluation;143
18;Appendix B3 Answer key to the sample exam
;144
19;Appendix C About the authors;160
20;Index;162