
👉 9 STEPS OUTLINE for ISO 27001 implementation and getting certified

🧵 This thread provides a skeleton plan for your ISO 27001 project.

Before we kick off, I'll take 3 tweets to illustrate the benefits, and explain the structure of #iso27001 ... 

#infosec #cybersecurity


Benefits of ISO 27001 certification are:

1) Easier sales of your product/service in B2B markets 💶

2) Raised #infosec maturity – from incident driven to continual improvement 📈

3) Increased #CyberResilience 🦾

4) Improved accountability and responsibility 🕊️

#cybersecurity


#iso27001 consists of 2 parts:

1) a PROCESS to manage information security risks, called the Information Security Management System (or ISMS)

2) a list of CONTROLS to mitigate (or control) the risks you've identified, called "Annex A"

#infosec #cybersecurity #isms


The #ISMS risk mgt process looks like this:

1) Identify and Analyse Risks
2) Select and Implement Controls
3) Monitor execution of Controls
4) Evaluate effectiveness
5) Re-analyse Risks and Adjust Controls

👉 NEXT: Start implementing ...

#infosec #cybersecurity #iso27001


👉 STEP 1: Get senior management on board.

#iso27001 places responsibility on top mgt to:

• Show leadership and commitment
• Set information security objectives
• Implement #infosec policies
• Define roles and responsibilities
• Provide resources and support



👉 STEP 2: Establish the context of the ISMS.

Identify:

• Macro-environmental factors
• Strategy and culture
• Strengths and weaknesses
• Stakeholders
• Laws and regulations
• Business processes

... and define the Scope of your #isms.

#infosec #cybersecurity #iso27001


👉 STEP 3: Initiate the ISMS process.

1) Establish the Information Security Team;

2) Have regular team meetings;

3) Iterate through the risk mgt process to  achieve continuous improvement.

#infosec #cybersecurity #iso27001


👉 STEP 4: Identify Information Assets.

1) Create an Asset Inventory;

2) Identify the impact of compromise of each asset;

3) Classify information assets by required Confidentiality, Integrity and Availability;

4) Label assets accordingly.

#infosec #cybersecurity #iso27001


👉 STEP 5: Analyse Risks and Select Treatment.

1) Identify Risks for loss of Confidentiality, Integrity and Availability;

2) Appoint risk owners;

3) Calculate Risk Scores as Probability x Impact to set priorities;

4) Choose to Control, Transfer, Avoid or Accept the risk.



👉 STEP 6: Select and Implement Controls.

1) Identify all controls from Annex A necessary for the chosen risk treatment;

2) Draft a 'Statement of Applicability' for the Annex A controls;

3) Plan the implementation ('risk treatment plan').

#infosec #cybersecurity #iso27001


👉 STEP 7: Document the ISMS activities.

• Write #infosec policies
• Record risk analyses and treatment decisions
• Register incidents and non-conformities
• Collect log files, measurements, and evaluation reports
• Plan implementation, evaluations, and audits.

#iso27001


👉 STEP 8: Conduct Management Reviews.

Review:

• Status of actions
• External and Internal Changes
• Feedback from Stakeholders
• Risk assessment results and Treatment plans
• Effectiveness of the ISMS
• Decisions on changes and improvements.

#cybersecurity #iso27001


👉 STEP 9: Get Certified. 💯

• Stage 1:  Document review
• Stage 2:  Records of activities, observations and interviews
• Audit report:  Observations, Minor and Major non-conformities
• Period of 90 days to resolve issues

The #iso27001 Certificate is valid for 3 years.


I hope this thread will give you a head start on your path to #iso27001 certification. 

Contact me with any questions you may have. 
Stay safe and secure! – @richardk

#cybersecurity #infosec

Here’s the unrolled version of this thread:

https://typefully.com/iso27diy/B7dws0P

9 STEPS OUTLINE for ISO 27001

Configuration Management is now a separate control in #iso27002. This is what you must do to comply … 🧵 👉

#ConfigMgt #cybersecurity #infosec #iso27001

Previously, configuration was only mentioned in subcontrols of Operating procedures, Logging and monitoring, and Requirements specification. 

Development and maintenance of configuration profiles was audited against the 'Security in development and support' control, ...
#infosec

... which caused awkward discussions when auditing #managedIT/ #managedservices providers for #iso27001, as they did not consider themselves developers at all.

 #ITservices #ConfigMgt #infosec #cybersecurity

#iso27002 now fully recognises the importance of #ConfigMgt, which is especially relevant to the use of #cloudservices, where misconfiguration can cause vulnerabilities leading to massive data breaches.

#cybersecurity #infosec #databreach

To comply with #iso27002 A 8.9 you must:

1) Define configuration templates
2) Implement processes and tools to enforce configs
3) Review configuration templates periodically
4) Implement #ConfigMgt

... for hardware, software, services and networks.

#cybersecurity #infosec

When reviewing configuration templates, consider:

- changes in the threat landscape
- newly identified vulnerabilities
- changes in software and hardware.

... also see the thread about #threatintel: https://twitter.com/iso27diy/status/1500790423408627716

#iso27002 #ConfigMgt must include:

a) roles and responsibilities definition
b) monitoring configuration changes
c) change log reviews
d) comparing actual configs with templates
e) addressing deviations.

Note that configuration info must be stored securely!

#infosec #iso27001

When establishing configuration templates:

- minimize identities with privileged access
- disable redundant and vulnerable id's 
- disable unneeded functions
- restrict access to superuser tools
- sync clocks
- change defaults
- set auto log off after time-out.

#ConfigMgt

I hope this thread helps you prepare your #ConfigMgt for the transition to the new #iso27001 coming later this year. 

Contact me with any questions you may have. 
Stay safe and secure! – @richardk

#cybersecurity #infosec

Here’s the unrolled version of this thread: https://typefully.com/iso27diy/CdiidyO

Configuration Management in ISO 27002:2022

ISO 27002 now specifically covers Cloud Security. This is what you must do to comply … 🧵 👉

#cloudsecurity #cloudcomputing #cybersecurity #infosec #iso27001 #iso27002

While the previous version of #iso27001 #iso27002 only mentions cloud services once, in a sub-control of the Supplier relationships chapter (A 15.1.3), the 2022 version now has a dedicated control 'Information security for use of cloud services'.

#cloudsecurity #cloudcomputing

Control 5.23 brings together relevant security mgt aspects from previous controls for services and supply chain mgt, systems requirements specification, ‘application services on public networks’, and adds some detail inspired by privacy regulation.

#cloudsecurity #privacy #gdpr

Also, items from ISO 27017 and 27018 – standards dealing with public cloud services and PII processing – have been incorporated in the new control 5.23 Information security for use of cloud services.

#cloudsecurity #cloudcomputing #cybersecurity #infosec #iso27001 #privacy #gdpr

These are the main actions you need to take:

1) Define policies for the selection, use and termination of cloud services;

2) Review cloud service agreements;

3) Perform risk assessments for the use of cloud services.

👉️ Next: requirements for Policies and Agreements ...

The #iso27002 implementation guidance for Control 5.23 specifies requirements for Cloud service policies and Agreements with cloud service providers.

#iso27002 main points for Cloud service policies (1/3):

- security requirements and selection criteria
- usage scope
- integration with and between services
- change mgt 
- termination procedures
- roles and responsibilities for the use of cloud services
...

#cloudsecurity

#iso27002 main points for Cloud service policies (2/3):

- division between security controls managed by the provider and managed by the organization
- assurance of security controls managed by the provider
- usage of security capabilities of the cloud service
...

#cloudsecurity

#iso27002 main points for Cloud service policies (3/3):

- procedures for monitoring, reviewing and evaluating information security risks wrt cloud service usage
- procedures for managing #infosec incidents.

👉️ Next: Cloud service Agreements ...

#cloudsecurity #cybersecurity

#iso27002 main points for Agreements with cloud service providers (1/2):

- usage of industry standards for #architecture and #infrastructure
- access controls meet organization's reqs.
- use of anti-malware
- specification of data storage locations
...

#cloudsecurity #infosec

#iso27002 main points for Agreements with cloud service providers (2/2):

- incident support
- #infosec when sub-contracting
- support for exiting the service
- #backups and backup mgt
- providing organization-owned data if requested
- advance notification of service changes.

I hope this thread will help in preparing your #cloudsecurity management for the transition to the new ISO 27001 later this year. Contact me with any #iso27001 #iso27002 questions you may have. Stay safe and secure! – @richardk

#cloudcomputing #cybersecurity #infosec

Here’s the unrolled version of this thread: https://typefully.com/iso27diy/847jTdl

#cloudsecurity #cloudcomputing #cybersecurity #infosec #iso27001 #iso27002

Cloud Security in ISO 27002:2022

Threat Intelligence has been added to ISO 27002. This is what you must do to comply … 🧵 👉 

#threatintel #cybersecurity #infosec #iso27001 #iso27002

ISO 27002 requirements for #threatintel:

1) Set objectives for the production of threat intelligence;

2) Select relevant sources to collect threat information from;

3) Analyse information about threats (current and emerging) in the context of the organization;

…

#infosec

4) Feed the result into the #infosec risk management process;

5) Identify actions to prevent and reduce impact;

6) Configure prevention and detection systems based on the results of the analysis;

…

#threatintel #cybersecurity #infosec #iso27001

7) Use threat analysis results as input for security testing;

8) Communicate about relevant threats and risk/impact reducing actions;

9) Exchange #threatintel with other organizations.

👉 Next: How to demonstrate this in audits …

#cybersecurity #infosec #iso27001

Prove ISO 27002 compliant #threatintel with, for example:

- policies for threat intelligence collection, analysis and communication;

- policies for using threat analysis results in #infosec risk mgt;

- subscriptions to relevant sources like feeds, alert services & reports;

…

…

- minutes of threat analysis sessions and risk management meetings that include the results of threat analyses;

- configuration instructions for systems to prevent and detect the identified threats;

- action plans for the prevention and reduction of threat impact;

…

…

- threat awareness communication and communication about risk/impact reducing actions;

- exchanges of #threatintel with other organizations, e.g. through publications, or participation in special interest groups, forums and seminars.

#cybersecurity #infosec #iso27001

Keep in mind that ISO 27002 control 5.7's purpose is to promote risk mitigation through threat awareness. Information should be provided in an understandable format, so that people can act quickly and effectively.

#threatintel #cybersecurity #infosec #iso27001

Your are also required to consider #threatintel at 3 levels:

1) strategic: hi-level info about types of attackers and attacks

2) tactical: info about attack methods, tools and technologies

3) operational: info about specific attacks and how to identify them.

#cybersecurity

All in all, ISO 27002:2022 A 5.7 brings together #threatintel elements that were previously spread over controls related to network applications, secure systems engineering, mobile devices and wifi usage, #infosec policies, and special interest groups – and expands upon them.

If you're #iso27001 certified, basic #threatintel should already be in place. Efforts should go into further structuring the process of collection, analysis and communication. Have this reflected in relevant policies and connect it with the main #infosec risk mgt process.

I hope this threat will help in preparing for the transition to the new ISO 27001 later this year. Contact me with any #iso27001 #iso27002 questions you may have. Stay safe and secure!

#threatintel #cybersecurity #infosec

You can read the unrolled version of this thread here: https://typefully.com/iso27diy/BYe8VrP

Threat intelligence in ISO 27002:2022

🧵 ISO 27002 thread: How to maintain compliance with the 2022 version 

#iso27001 #iso27002 #infosec #ISMS #cybersecurity

First of all, ISO 27002 offers implementation guidance for the controls listed in Annex A of the main standard, ISO 27001. 

Since you cannot get certification for following the guidance, your existing ISO 27001 certification is not directly effected.

In fact, until a new version of ISO 27001 is published, you are still required in your Statement of Applicability to refer to the 2013 version control set, as listed in Annex A. 

The new version of ISO 27001 is expected end of Q2 2022, or even October, according to some sources.

For organizations already holding an ISO 27001 certificate, ISO usually allows a two-year transition period for the revision of the Information Security Management System. It is sensible though, to start preparing for the transition early, to avoid late stage panic.

You can start this transition process by purchasing the updated standard (of course), and conduct a fit/gap analyses against your current controls implementation. 

https://www.iso.org/standard/75652.html

You can also begin updating your information security policies to reflect the new guidelines.

Pay special attention to new controls Threat intelligence, Data masking and Configuration management, as auditors will surely check if you have picked up on this sufficiently!

Also expect to be queried on the connection between individual controls and risk analysis outcomes: ISO 27002 specifically mentions this as a use case for the newly introduced ‘control attributes’ – more info in this thread👇️ 

https://twitter.com/iso27diy/status/1496064223926882308

Here’s the unrolled version of this thread:
https://typefully.com/iso27diy/NdIG6UD

ISO 27002: How to maintain compliance with the 2022 version

🎇 New ISO 27002! What has changed? 

First impressions thread ...  

#iso27001 #iso27002 #infosec #ISMS #cybersecurity

Compared to the 2013 version, many of the existing controls were merged, bringing the number of controls down from 116 to 93. There are 11 new controls, none have been deleted. Excluding introductory matter and reference tables there are now 122 pages of control descriptions.

The controls are categorized into 4️⃣ chapters, corresponding with 'themes': organizational, people (concerning individuals), physical, and technological. 

This is an improvement in readability over the former 14 chapters, which ranged from the very broad to the oddly specific.

The controls are divided over the 4 themes as follows: 37 Organizational controls, 34 Technological controls, 14 Physical controls and 8 People controls.

🏷️ Each control has 5 associated attributes: 

1) Control type: preventive, detective, corrective
2) Information security properties: confidentiality, integrity, availability
3) Cybersecurity concepts: identify, protect, detect, respond, recover
...

4) Operational capabilities: 15 in all, e.g.: asset mgt, application security, identity and access mgt.
5) Security domains: governance and ecosystem, protection, defence and resilience.

ISO's Cybersecurity concepts map to the 5 functions of the NIST Cybersecurity Framework. This may be practical in establishing compliance across regions🇪🇺🇺🇸, and possibly for deploying NIST tooling in environments where security is managed in accordance with the ISO standard.

The Operational capabilities roughly map to business/IT functions and will be helpful when assigning responsibilities during implementation, or for GRC managers and auditors in larger organizations to locate relevant interlocutors for different risk controls.

I don't see much practical use yet for the tagging with 'Information security properties', as 85% of the controls mitigate Confidentiality, Integrity ànd Availability risks.

Same goes for 'Control type': 9 out of 10 controls are preventive, about 1 in 7 (also) deal with detection or correction.

Looking at the Security domains attribute: governance and ecosystem controls cover the compliance function and the risk management process in its context, that one's clear to me. Not so the reasons for tagging a control with Protection or Defence ...

... for instance, 5.33 Protection of records gets Defence, while 5.34 Privacy and protection of PII gets Protection. 

Controls tagged with Resilience are also a mixed bag, and a small one at that.

🗃️ ISO suggests using attributes for 'filtering and sorting' of controls in a spreadsheet or database – I'm working on this and will share it with you when ready! 💪

ISO proposes to add 'organization-specific guidance or attributes' to the controls in such a matrix. As an example, ISO suggests connecting risk treatment plans to controls. This will facilitate compliance auditing, as the application of every control should be risk-based.

🚀 On to the 🆕 controls! They are:

Threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, ...

... monitoring activities, web filtering and secure coding. 

Almost all of them are closely related to controls already present in the 2013 version, but data masking and threat intelligence are new additions, and configuration management was hardly mentioned in 2013.

📡 Threat intelligence is a material addition to the ISO 27001/27002 standard and will require additional activities in the risk management process. Of course, the threat landscape has changed considerably since 2013 and threat intelligence has become an industry of itself.

🔧 Configuration management is an important part of Cloud Security Posture Management (CSPM), a rapidly growing market segment of tooling for reducing configuration mistakes and compliance risks in SaaS and PaaS environments.

🎭️ Data masking is a technique often deployed to maintain confidentiality of sensitive personal data (PII), to lower privacy risks in the light of legal frameworks such as GDPR.

👨‍🏫 To conclude, the 27002:2022 improves on 2013 with ...
1) a more sensible chapter structure
2) a connection to the 5 functions of the NIST Framework
3) a proposed connection to Business and IT functions and security domains ...

4) the recognition that threat intelligence and configuration management have become essential in cybersecurity.

I hope this helps in making sense of the new ISO 27002. Will be following this up with related threads on specific chapters/controls and suggestions on the transition from the 2013 to the 2022 version.

Check the iso27diy.com website for additional resources!

Here is the unrolled version of this thread: https://typefully.com/u/iso27diy/t/tmI9PPX/