Wikipedia

Information security management

Information security management (ISM) defines and manages controls that an organization needs to implement to ensure that it is sensibly protecting the confidentiality, availability, and integrity of assets from threats and vulnerabilities. The core of ISM includes information risk management, a process that involves the assessment of the risks an organization must deal with in the management and protection of assets, as well as the dissemination of the risks to all appropriate stakeholders.[1] This requires proper asset identification and valuation steps, including evaluating the value of confidentiality, integrity, availability, and replacement of assets.[2] As part of information security management, an organization may implement an information security management system and other best practices found in the ISO/IEC 27001, ISO/IEC 27002, and ISO/IEC 27035 standards on information security.[3][4]

Risk management and mitigation

edit

Managing information security in essence means managing and mitigating the various threats and vulnerabilities to assets, while at the same time balancing the management effort expended on potential threats and vulnerabilities by gauging the probability of them actually occurring.[1][5][6] A meteorite crashing into a server room is certainly a threat, for example, but an information security officer will likely put little effort into preparing for such a threat. Just as people don't have to start preparing for the end of the world just because of the existence of a global seed bank.[7]

After appropriate asset identification and valuation have occurred,[2] risk management and mitigation of risks to those assets involves the analysis of the following issues:[5][6][8]

  • Threats: Unwanted events that could cause the deliberate or accidental loss, damage, or misuse of information assets
  • Vulnerabilities: How susceptible information assets and associated controls are to exploitation by one or more threats
  • Impact and likelihood: The magnitude of potential damage to information assets from threats and vulnerabilities and how serious of a risk they pose to the assets; cost–benefit analysis may also be part of the impact assessment or separate from it
  • Mitigation: The proposed method(s) for minimizing the impact and likelihood of potential threats and vulnerabilities

Once a threat and/or vulnerability has been identified and assessed as having sufficient impact/likelihood on information assets, a mitigation plan can be enacted. The mitigation method is chosen largely depends on which of the seven information technology (IT) domains the threat and/or vulnerability resides in. The threat of user apathy toward security policies (the user domain) will require a much different mitigation plan than the one used to limit the threat of unauthorized probing and scanning of a network (the LAN-to-WAN domain).[8]

Information security management system

edit

An information security management system (ISMS) represents the collation of all the interrelated/interacting information security elements of an organization so as to ensure policies, procedures, and objectives can be created, implemented, communicated, and evaluated to better guarantee the organization's overall information security. This system is typically influenced by an organization's needs, objectives, security requirements, size, and processes.[9] An ISMS includes and lends to risk management and mitigation strategies. Additionally, an organization's adoption of an ISMS indicates that it is systematically identifying, assessing, and managing information security risks and "will be capable of successfully addressing information confidentiality, integrity, and availability requirements."[10] However, the human factors associated with ISMS development, implementation, and practice (the user domain[8]) must also be considered to best ensure the ISMS' ultimate success.[11]

Implementation and education strategy components

edit

Implementing an effective information security management (including risk management and mitigation) requires a management strategy that takes note of the following:[12]

  • Upper-level management must strongly support information security initiatives, allowing information security officers the opportunity "to obtain the resources necessary to have a fully functional and effective education program" and, by extension, information security management system.
  • Information security strategy and training must be integrated into and communicated through departmental strategies to ensure all personnel is positively affected by the organization's information security plan.
  • A privacy training and awareness "risk assessment" can help an organization identify critical gaps in stakeholder knowledge and attitude towards security.
  • Proper evaluation methods for "measuring the overall effectiveness of the training and awareness program" ensure policies, procedures, and training materials remain relevant.
  • Policies and procedures that are appropriately developed, implemented, communicated, and enforced "mitigate risk and ensure not only risk reduction, but also ongoing compliance with applicable laws, regulations, standards, and policies."
  • Milestones and timelines for all aspects of information security management help ensure future success.

Without sufficient budgetary considerations for all the above—in addition to the money allotted to standard regulatory, IT, privacy, and security issues—an information security management plan/system can not fully succeed.

Relevant standards

edit

Standards that are available to assist organizations with implementing the appropriate programs and controls to mitigate threats and vulnerabilities include the ISO/IEC 27000 family of standards, the ITIL framework, the COBIT framework, and O-ISM3 2.0. The ISO/IEC 27000 family represents some of the most well-known standards governing information security management and their ISMS is based on global expert opinion. They lay out the requirements for best "establishing, implementing, deploying, monitoring, reviewing, maintaining, updating, and improving information security management systems."[3][4] ITIL acts as a collection of concepts, policies, and best practices for the effective management of information technology infrastructure, service, and security, differing from ISO/IEC 27001 in only a few ways.[13][14] COBIT, developed by ISACA, is a framework for helping information security personnel develop and implement strategies for information management and governance while minimizing negative impacts and controlling information security and risk management,[4][13][15] and O-ISM3 2.0 is The Open Group's technology-neutral information security model for enterprise.[16]

See also

edit

References

edit
  1. ^ a b Campbell, T. (2016). "Chapter 1: Evolution of a Profession". Practical Information Security Management: A Complete Guide to Planning and Implementation. APress. pp. 1–14. ISBN 9781484216859.
  2. ^ a b Tipton, H.F.; Krause, M. (2003). Information Security Management Handbook (5th ed.). CRC Press. pp. 810–11. ISBN 9780203325438.
  3. ^ a b Humphreys, E. (2016). "Chapter 2: ISO/IEC 27001 ISMS Family". Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House. pp. 11–26. ISBN 9781608079315.
  4. ^ a b c Campbell, T. (2016). "Chapter 6: Standards, Frameworks, Guidelines, and Legislation". Practical Information Security Management: A Complete Guide to Planning and Implementation. APress. pp. 71–94. ISBN 9781484216859.
  5. ^ a b Watts, S. (21 June 2017). "IT Security Vulnerability vs Threat vs Risk: What's the Difference?". BMC Blogs. BMC Software, Inc. Retrieved 16 June 2018.
  6. ^ a b Campbell, T. (2016). "Chapter 4: Organizational Security". Practical Information Security Management: A Complete Guide to Planning and Implementation. APress. pp. 43–61. ISBN 9781484216859.
  7. ^ Lundgren, Björn; Möller, Niklas (2019). "Defining Information Security". Science and Engineering Ethics. 25 (2): 419–441. doi:10.1007/s11948-017-9992-1. ISSN 1353-3452. PMC 6450831. PMID 29143269.
  8. ^ a b c Kim, D.; Solomon, M.G. (2016). "Chapter 1: Information Systems Security". Fundamentals of Information Systems Security. Jones & Bartlett Learning. pp. 2–46. ISBN 9781284128239.
  9. ^ Terroza, A.K.S. (12 May 2015). "Information Security Management System (ISMS) Overview" (PDF). The Institute of Internal Auditors. Archived from the original (PDF) on 7 August 2016. Retrieved 16 June 2018.
  10. ^ "Need: The Need for ISMS". Threat and Risk Management. European Union Agency for Network and Information Security. Retrieved 16 June 2018.
  11. ^ Alavi, R.; Islam, S.; Mouratidis, H. (2014). "A Conceptual Framework to Analyze Human Factors of Information Security Management System (ISMS) in Organizations". Human Aspects of Information Security, Privacy, and Trust. Lecture Notes in Computer Science. Vol. 8533. pp. 297–305. doi:10.1007/978-3-319-07620-1_26. ISBN 978-3-319-07619-5. {{cite book}}: |journal= ignored (help)
  12. ^ Tipton, H.F.; Krause, M. (2010). Information Security Management Handbook. Vol. 3 (6th ed.). CRC Press. pp. 100–02. ISBN 9781420090956.
  13. ^ a b Kim, D.; Solomon, M.G. (2016). Fundamentals of Information Systems Security. Jones & Bartlett Learning. p. 225. ISBN 9781284128239.
  14. ^ Leal, R. (7 March 2016). "ISO 27001 vs. ITIL: Similarities and differences". The ISO 27001 & ISO 22301 Blog. Advisera Expert Solutions Ltd. Retrieved 16 June 2018.
  15. ^ White, S.K. (22 December 2017). "What is COBIT? A framework for alignment and governance". CIO. IDG Communications, Inc. Retrieved 16 June 2018.
  16. ^ "Open Information Security Management Maturity Model (O-ISM3), Version 2.0". The Open Group. 21 September 2017. Retrieved 16 June 2018.
edit
Retrieved from "https://en.wikipedia.org/w/index.php?title=Information_security_management&oldid=1229070245"