BCS Certification in Information Security Management Principles - Revision history

Simon: /* 3. Information Security Framework */ Added detail

2022-03-01T18:15:32Z

3. Information Security Framework: Added detail

← Older revision		Revision as of 18:15, 1 March 2022
Line 217:		Line 217:
	# corrective action;		# corrective action;
	# review.		# review.

			Make an effort not to destroy evidence so that it can be used in court.

	==== Legal framework ====		==== Legal framework ====
			Laws vary by country. Laws that might matter:
			* intellectual property rights;
			* protection of organisational records;
			* data protection;
			* privacy of personal information;
			* computer misuse prevention;
			* regulation of cryptography.

	==== Security standards and procedures ====		==== Security standards and procedures ====
			Standards provide interoperability.

	=== 4. Security Life Cycles ===		=== 4. Security Life Cycles ===

Simon: /* 3. Information Security Framework */ Added detail

2022-02-20T22:07:24Z

3. Information Security Framework: Added detail

← Older revision		Revision as of 22:07, 20 February 2022
Line 193:		Line 193:

	==== Organisational policy, standards and procedures ====		==== Organisational policy, standards and procedures ====
			Policies, standards and procedures are to tell people what to do.
			* Policy = a high level statement of an organisation's values, goals and objectives and the approach to achieving them. Does not say ''how'' to achieve it.
			* Standard = a description of what needs to be done in a measurable way. Compliance is mandatory. Supports the policy. Says how to do it.
			* Procedure = a set of detailed working instructions describing what, when, how and who. Obligatory. Supports the policy and standard.
			* Guidelines = provide advice, direction and best practice. Not mandatory.

	==== Information security governance ====		==== Information security governance ====
			Policies, standards and procedures should be reviewed occasionally.

	==== Information assurance programme implementation ====		==== Information assurance programme implementation ====
			Plan to put in a realistic framework. Present it as a positive benefit. Ensure it has a sound business case. Show good information assurance gives commercial advantage. Use an ''information security strategy'' and an ''information assurance architecture''.

	==== Security incident management ====		==== Security incident management ====
			Security incidents '''will''' happen. It's not ''if'', it's ''how often''. The incidents may relate to the confidentiality, the integrity or the availability of the information. Have plans in place to deal with them ''before'' it happens. Over half of incident response plans fail when first tested. So plan, then test the plan.

			* security incident response plan = a set of instructions to respond to and recover from an information security incident.
			** Incident Response Team (IRT) = people identified and trained in advance to follow the plan. Empowered and senior.

			There are five steps in incident management:
			# reporting;
			# investigation;
			# assessment;
			# corrective action;
			# review.

	==== ~~Legal~~ framework ====		==== Legal framework ====

	==== Security standards and procedures ====		==== Security standards and procedures ====

Simon: /* 3. Information Security Framework */ Created section

2022-02-20T18:07:50Z

3. Information Security Framework: Created section

← Older revision		Revision as of 18:07, 20 February 2022
Line 171:		Line 171:

	=== 3. Information Security Framework ===		=== 3. Information Security Framework ===
			An information security framework describes the required control mechanisms and their implementation. Or something like that.

			==== Organisation and responsibilities ====
			Organise the information assurance. Someone has to be in charge. Someone has to be responsible. People need to know what to do. You need an Information Security Manager; they may have a team. It may be in Corporate Compliance or IT or central Facilities. Common roles are:
			* Chief Information Security Officer (CISO)
			* Chief Risk Officer (CRO)
			* Senior Responsible Owner (SRO)
			* Chief Information Officer (CIO)
			* Senior Information Risk Owner (SIRO)
			* Chief Finance Officer) CFO

			The Information Assurance role may include implementation, or not. It may be an audit function.

			Good practice:
			* There should be board level representation of information asset assurance.
			* People who have delegated authority for management information security need to have defined responsibilities and to be managed.
			* Information assets need to have an owner responsible for their confidentiality, integrity and availaility.
			* Legislation or regulations may determine how information must be stored.
			* Information security staff will require ongoing CPD.
			* The organisation should develop a culture of good information security practice. (Easy to say...)

			==== Organisational policy, standards and procedures ====




			==== Information security governance ====

			==== Information assurance programme implementation ====

			==== Security incident management ====

			==== Legal framework ====

			==== Security standards and procedures ====

	~~xcxx~~
	=== 4. Security Life Cycles ===		=== 4. Security Life Cycles ===

Simon: /* 2. Information Risk */ Added detail

2022-02-16T20:02:49Z

2. Information Risk: Added detail

@@ Line 109: / Line 109: @@
 * transfer or share (e.g. insurance) = outsource to specialists.
 * accept or tolerate = live with low risks; decide treatment costs more than the risk.
 === 3.  Information Security Framework ===

Simon: /* 2. Information Risk */ Added detail

2022-02-15T20:45:19Z

2. Information Risk: Added detail

@@ Line 95: / Line 95: @@
 ==== Risk Management ====
 Terms: risk identification; risk evaluation; risk analysis; risk treatment.
 === 3.  Information Security Framework ===

Simon: /* 2. Information Risk */

2022-02-15T20:04:44Z

2. Information Risk

← Older revision		Revision as of 20:04, 15 February 2022
Line 94:		Line 94:

	==== Risk Management ====		==== Risk Management ====
			Terms: risk identification; risk evaluation; risk analysis; risk treatment.

	=== 3. Information Security Framework ===		=== 3. Information Security Framework ===

Simon: /* 2. Information Risk */ formatting

2022-02-13T22:02:12Z

2. Information Risk: formatting

← Older revision		Revision as of 22:02, 13 February 2022
Line 53:		Line 53:
	=== 2. Information Risk ===		=== 2. Information Risk ===
	We want assurance about our information, so we want '''information assurance'''. Information assurance is about the '''management of information risk'''.		We want assurance about our information, so we want '''information assurance'''. Information assurance is about the '''management of information risk'''.
	This chapter covers the component parts of risk: '''threats''', '''vulnerabilities''' and '''impact'''. Combining '''threat''' with '''likelihood ''or'' probability''' gives '''risk'''.		This chapter covers the component parts of risk: '''threats''', '''vulnerabilities''' and '''impact'''. Combining '''threat''' with '''likelihood '''''or''''' probability''' gives '''risk'''.

	Threat = an event causing undesirable consequences.		Threat = an event causing undesirable consequences.

	==== Information-related Threat categories ====		==== Information-related Threat categories ====
	~~'''~~Physical threats~~'''~~. Theft, vandalism and accidents.		<u>Physical threats</u>. Theft, vandalism and accidents.

	~~'''~~Outages and failures~~'''~~. Loss of power or people. Hard drive and other hardware failure. Human error.		<u>Outages and failures</u>. Loss of power or people. Hard drive and other hardware failure. Human error.

	~~'''~~Hacking and abuse~~'''~~. Social engineering, espionage, identity theft, viruses, ransomware, denial of service attacks (DoS), distributed denial of service attacks (DDoS), eavesdropping. Cyber terrorism and sabotage.		<u>Hacking and abuse</u>. Social engineering, espionage, identity theft, viruses, ransomware, denial of service attacks (DoS), distributed denial of service attacks (DDoS), eavesdropping. Cyber terrorism and sabotage.

	~~'''~~Legal and contractual threats~~'''~~. Failure to meet obligations. Breaches of the Data Protection Act (DPA) or General Data Protection Regulations (GDPR).		<u>Legal and contractual threats</u>. Failure to meet obligations. Breaches of the Data Protection Act (DPA) or General Data Protection Regulations (GDPR).

	~~'''~~Accidents and disasters~~'''~~. Flood, landslide, earthquake, tsunami. Chemical leaks, explosions.		<u>Accidents and disasters</u>. Flood, landslide, earthquake, tsunami. Chemical leaks, explosions.

	==== Vulnerabilities and vulnerability classification ====		==== Vulnerabilities and vulnerability classification ====
	Vulnerability = a weakness. E.g. a password on a Post-It or poor software design. A 'threat' is said to 'take advantage of a vulnerability' ''or'' 'exploit a vulnerability'.		Vulnerability = a weakness. E.g. a password on a Post-It or poor software design. A 'threat' is said to 'take advantage of a vulnerability' ''or'' 'exploit a vulnerability'.

	~~'''~~General vulnerabilities~~'''~~. Weaknesses in software design, hardware, buildings, people, processes and procedures.		<u>General vulnerabilities</u>. Weaknesses in software design, hardware, buildings, people, processes and procedures.

	~~'''~~Information-specific vulnerabilities~~'''~~. Unsecured computers and devices. Un-patched software and operating systems. Unsecured network boundary devices. Unsecured web servers and email servers. <br>		<u>Information-specific vulnerabilities</u>. Unsecured computers and devices. Un-patched software and operating systems. Unsecured network boundary devices. Unsecured web servers and email servers. <br>
	:Unlocked filing cabinets. <br>		:Unlocked filing cabinets. <br>
	:Mobile 'phone leakage. <br>		:Mobile 'phone leakage. <br>
Line 79:		Line 79:
	:Internet of Things (IoT) interception and attack. <br>		:Internet of Things (IoT) interception and attack. <br>
	:Bring Your Own Devices (BYOD) vulnerabilities.		:Bring Your Own Devices (BYOD) vulnerabilities.

			==== Assets ====
			An <u>asset</u> can be tangible or intangible. '''Impacts''' usually apply to assets.

			==== Likelihood ''or'' probability ====
			Can be assessed <u>quantitatively</u> or <u>qualitatively</u>.

			==== Risk ====
			<u>Risk</u> = the <u>impact</u> ''or'' <u>consequence</u> of a <u>vulnerability</u> being <u>exploited</u> by a <u>threat</u>. <br>
			<u>Threat evaluation</u> = the <u>impact</u> ''or'' <u>consequence</u> times the <u>likelihood</u> or <u>probability</u>. <br>

			===== Calculating overall risk =====
			A <u>Business Impact Analysis</u> (BIA) = determining the impact on one or more assets for each threat.

			==== Risk Management ====

	=== 3. Information Security Framework ===		=== 3. Information Security Framework ===

Simon: /* 2. Information Risk */ Added detail

2022-02-13T19:51:21Z

2. Information Risk: Added detail

@@ Line 57: / Line 57: @@
 Threat = an event causing undesirable consequences.
-==== Threat categories ====
+==== Information-related Threat categories ====
 === 3.  Information Security Framework ===

Simon: Added 'Course Content' and started Chapter 2.

2022-02-10T20:05:37Z

Added 'Course Content' and started Chapter 2.

← Older revision		Revision as of 20:05, 10 February 2022
Line 1:		Line 1:
	= BCS Certification in Information Security Management Principles =		BCS Certification in Information Security Management Principles

	BCS CISMP. The BCS (British Computer Society) Certification in Information Security Management Principles. A five day course. A 248 page text book.		= About =
			BCS CISMP. The BCS (British Computer Society) Certification in Information Security Management Principles. <br>
			A five day course. <br>
			A 248 page text book.

	~~The text book is ''Information Security Management Principles Third Edition''~~.		= Concepts =
			CIA. Confidentiality, Integrity, Availability.

	~~== Concepts ==~~
	~~CIA. Confidentiality, Integrity, Availability.~~

			= Course Text Book =

			== Title ==
			The text book is ''Information Security Management Principles Third Edition''.

	== Book Chapters ==		== Book Chapters ==
Line 46:		Line 52:

	=== 2. Information Risk ===		=== 2. Information Risk ===
			We want assurance about our information, so we want '''information assurance'''. Information assurance is about the '''management of information risk'''.
			This chapter covers the component parts of risk: '''threats''', '''vulnerabilities''' and '''impact'''. Combining '''threat''' with '''likelihood ''or'' probability''' gives '''risk'''.

			Threat = an event causing undesirable consequences.

			==== Threat categories ====



	~~xcxx~~
	=== 3. Information Security Framework ===		=== 3. Information Security Framework ===

Line 59:		Line 72:
	=== 6. Technical Security Controls ===		=== 6. Technical Security Controls ===

	xcxx		xcxx=
	=== 7. Physical and Environmental Security ===		=== 7. Physical and Environmental Security ===

Line 67:		Line 80:
	xcxx		xcxx
	=== 9. Other Technical Aspects ===		=== 9. Other Technical Aspects ===
			xcxx

	~~xcxx~~		= Course Outline =

			The need for Information Security
			Information Security Management System (ISMS) concepts & definitions
			Information risk management
			Corporate governance
			Organisational responsibilities
			Policies, standards & procedures
			ISO/IEC 27002, 27001 & 13335
			Information security controls
			Incident management
			Legal framework - personal data, DPA, CMA, IPR & copyright, HR & employment issues
			Cryptographic models
			Data Communications & networks
			Physical security
			Auditing & gap analysis
			Training & raising awareness
			Business continuity
			Security investigations & forensics



	[[Category: Security]]		[[Category: Security]]

Simon: /* Book Chapters */ chapter 1.

2022-02-09T21:37:02Z

Book Chapters: chapter 1.

← Older revision		Revision as of 21:37, 9 February 2022
Line 12:		Line 12:

	=== 1. Information Security Principles ===		=== 1. Information Security Principles ===
			Confidentiality, integrity and availability. <br>
	Confidentiality = no unauthorised disclosure of information. <br>		Confidentiality = no unauthorised disclosure of information. <br>
	Integrity = information is accurate and complete. <br>		Integrity = information is accurate and complete. <br>
Line 39:		Line 40:
	Compliance = meeting the requirements. <br>		Compliance = meeting the requirements. <br>

			ISMS = Information Security Management System. A one stop shop for the organisation's information assurance. <br>
			Information Security = preserving the CIA of information. <br>
			Information Assurance = the confidence the information will be confidential, have integrity and be available.