Die ISO/IEC Familie. Dr. Ingrid Schaumüller-Bichl OCG,

Transkript

1 Die O/IEC Familie Dr. OCG,

2 Inhalt Standards who is who? O/IEC Familie und Freunde Ausgewählte Standards O/IEC Kennzahlen O/IEC Risikomanagement O/IEC MS in kritischen Infrastrukturen O/IEC Cloud Computing Security Folie 2

3 Standardisierung: Österreich und die Welt O Austrian Standards Institute (früher ÖNORM) O/IEC JTC1 Information Technology ON-K 001 Komitee 001 Informationsverarbeitung JTC1/SC27 IT Security Techniques WG 1: Requirements, security services and guidelines WG 2: Security techniques and mechanisms WG 3: Security evaluation criteria WG 4: Security controls and services WG 5: Identity management and privacy technologies AG Arbeitsgruppe IT-Sicherheit Folie 3

4 Standardisierung: Who is who? Proposal stage NPI NP New Project Initiated New Project Approved Preparatory stage WD Working Draft Committee stage CD Committee Draft Enquiry stage D Draft International Standard Approval stage FD Final Draft International Standard Publication stage International Standard Folie 4

5 International harmonized stage codes STAGE 00 Preliminary stage 10 Proposal stage 20 Preparatory stage 30 Committee stage 40 Enquiry stage 50 Approval stage 60 Publication stage 90 Review stage SUBSTAGE 00 Registration Proposal for new project received Proposal for new project registered New project registered in TC/SC work programme 20 Start of main action Proposal for new project under review New project ballot initiated Working draft (WD) study initiated Committee draft (CD) CD study/ballot registered initiated D registered FD registered for formal approval International Standard under publication D ballot initiated: 5 months 60 Completion of main action Close of review Close of voting Close of comment period Close of voting/ comment period Close of voting FD ballot initiated: 2 Close of voting. months. Proof returned by Proof sent to secretariat secretariat International Standard under periodical review International Standard published Close of review 90 Decision Substages 92 Repeat an earlier phase Proposal returned to submitter for further definition CD referred back to Working Group Full report circulated: D referred back to TC or SC FD referred back to TC or SC International Standard to be revised Repeat current phase Abandon Full report circulated: decision for new D ballot International Standard confirmed Proposal for new project abandoned New project rejected Project deleted Project deleted Project deleted Project deleted 99 Proceed Approval to ballot proposal for new project New project approved WD approved for registration as CD CD approved for registration as D Full report circulated: D approved for registration as FD FD approved for publication Withdrawal of International Standard proposed by TC or SC 95 Withdrawal stage Withdrawal ballot initiated Close of voting Decision not to withdraw International Standard Withdrawal of International Folie Standard 5

6 To be or not to be. standardized? Durch Standardisierung werden Merkmale zur allgemeingültigen Richtlinie erhoben, z.b.: Standardisierung von Papierformaten (z.b. DIN A4), Steckern, Bauteilen, Werkzeugen, usw. Standardisierung von Kommunikationsprotokollen (z.b. HTTP) Auch: gemeinsamen Sprache, gemeinsamen Uhrzeit, Maße für Temperatur, Geschwindigkeit, etc. klare Vorgaben Vereinheitlichung, Harmonisierung national und international Erarbeitung und Abstimmung durch internationales Expertengremium Vorteile: Standard liefert belastbares Fundament zur Orientierung Standard-Vorgaben sind hinsichtlich Sinnhaftigkeit und Effektivitätspotenzial erprobt Nachteile und potenzielle Schwierigkeiten: Standards können keine spezifischen Eigenschaften/Anforderungen von einzelnen Organisationen berücksichtigen Gefahr, dass Bemühungen zur Standard-Erfüllung vieles andere überschatten und unreflektiert bleiben ("Warum tun wir das?" "Weil es so in der Norm steht.") Folie 6

7 Die O/IEC Familie Vocabulary standard Overview and vocabulary Requirement Standards MS requirements Requirements for bodies providing audit and certification of MS Supporting standards (Guidelines Standards) , 27014, Sector-specific guideline standards 27010, 27011, TR 27015, 27017, Folie 7

8 Die O/IEC Familie und die Freunde Vocabulary standard Overview and vocabulary RequIrement Standards MS requirements Requirements for bodies providing audit and certification of MS Supporting standards (Guidelines Standards) , 27014, Sector-specific guideline standards 27010, 27011, TR 27015, 27017, Control-specific guideline standards 2703x, 2704x Folie 8

9 O/IEC Familie - die engsten Verwandten Overview and vocabulary (rev) MS requirements (rev) Code of practice for information security management ab 27002:2013 Code of practice for information security controls (rev) MS implementation guidelines Measurements MS risk management Requirements for bodies providing audit and certification of MS Guidelines for MS auditing Guidelines for auditors of MS controls TR The Use and Application of O/IEC for Sector/Service- Specific Third-Party Accredited Certifications Guidance on the integrated implementation of O/IEC and O/IEC Governance of information security Organisational economics TR WD publiziert Folie 9

10 O/IEC Familie - die engsten Verwandten Overview and vocabulary (rev) MS requirements (rev) Code of practice for information security management ab 27002:2013 Code of practice for information security controls (rev) MS implementation guidelines Measurements MS risk management Requirements for bodies providing audit and certification of MS Guidelines for MS auditing Guidelines for auditors of MS controls TR The Use and Application of O/IEC for Sector/Service- Specific Third-Party Accredited Certifications Guidance on the integrated implementation of O/IEC and O/IEC Governance of information security Organisational economics TR WD publiziert Folie 10

11 O/IEC Information security management - Measurement If you can t measure it, you cant t manage it. messbare Ziele definieren in definierten Zeitabständen messen Sind wir heute sicherer als früher? Sind wir sicherer als andere? Sind wir sicher genug? gemessen wird: Effektivität von MS gemäß O/IEC Umsetzung der Kontrollziele gemäß O/IEC 27001, Folie 11

12 O/IEC Kennzahlen- Modell Folie 12

13 O/IEC Beispiel für Kennzahlen Folie 13

14 O/IEC Information security risk management unterstützt RA/RM lt. O/IEC Information Security Risk Management, nicht generelles Risikomanagement (vgl. dazu O 31000) Definiert Prozesse und Inhalte: Beschreibung des IRM Prozesses, Methodik, Vorgehensweise Beispiele zur Risikoanayse Bedrohungs- und Schwachstellenlisten Folie 14

15 Der RM-Prozess nach O/IEC Folie 15

16 O/IEC Familie - sektorspezifische Standards Information security management for inter-sector & interorganisational communications M guidelines for telecommunications organizations based on O/IEC Publiziert MS for financial sector TR Code of practice for information security controls for cloud computing services based on O/IEC Code of practice for PII protection in public clouds acting as PII processors Information security management guidelines based on O/IEC for process control systems specific to the energy utility industry TS/ TR Folie 16

17 O/IEC Familie - sektorspezifische Standards Information security management for inter-sector & interorganisational communications M guidelines for telecommunications organizations based on O/IEC Publiziert MS for financial sector TR Code of practice for information security controls for cloud computing services based on O/IEC Code of practice for PII protection in public clouds acting as PII processors Information security management guidelines based on O/IEC for process control systems specific to the energy utility industry TS/ TR Folie 17

18 O/IEC Familie - sektorspezifische Standards Grundkonzept: O/IEC und sind generisch gehalten grundsätzlich für alle Branchen und Institutionen geeignet This International Standard covers all types of organizations (e.g. commercial enterprises, government agencies, non-profit organizations). In einigen Branchen gibt es zusätzlich spezifische Anforderungen O/IEC bleibt gleich, O/IEC wird erweitert entweder Ergänzung von Controls, oder neue, zusätzliche Controls Folie 18

19 O/IEC Information security management for inter-sector & interorganisational communications Ziel guidelines for implementing information security management within information sharing communities Anwendungsgebiet applicable to all forms of exchange and sharing of sensitive information, both public and private, nationally and internationally, within the same industry or market sector or between sectors. applicable to information exchanges and sharing relating to the provision, maintenance and protection of an organization s or nation state s critical infrastructure. Folie 19

20 O/IEC Information security management for inter-sector & interorganisational communications Herausforderungen: O/IEC und sind grundsätzlich firmenintern zu sehen, Informationsaustausch mit anderen Firmen wird nur kurz angesprochen, i.a. bilateral hier: Austausch sensitiver Informationen firmenübergreifend oder auch branchenübergreifend Information darf nur an beabsichtigte Empfänger gehen Schutz der Vertraulichkeit muss gewährleistet bleiben Für den Empfänger: Einschätzung, ob die Information korrekt, genau und vertrauenswürdig ist ( Trust ) sichere, effiziente Kommunikationskanäle, Prioritätensetzung möglich MS for the information sharing community Folie 20

21 O/IEC Information security management for inter-sector & interorganisational communications Konformität zu O/IEC 27001: Interpretation der Anforderungen aus O/IEC erforderlich Scope and boundaries: unternehmensübergreifend ( relevant organisation ist die information sharing community ) aber nur Teile der einzelnen Organisationen sind betroffen Folie 21

22 Folie 22

23 Erweiterung von Controls Bsp. Folie 23

24 Neue Controls Bspp. Neues Control Objective: 7.3 Information exchanges protection Folie 24

25 Neue Controls Bspp. Neues Control Objective: 7.3 Information exchanges protection Controls: Information dissemination limited, based on pre-defined dissemination markings z.b.: controll electronic copy and paste, prevent screen shots, prevent printing and export Information disclaimers listing any special requirements to follow by the recipients Information credibility indicate originator s degree of confidence Information sensitivity reduction Info, ob sich die Sensitivität einer Information nach Eintritt einer Ereignisses oder einer gewissen Zeitspanne reduziert Folie 25

26 Neue Controls Bspp. Neues Control Objective: 7.3 Information exchanges protection Controls: Anonymous source protection remove any source identification information when anonymity is requested Anonymous recipient protection With the approval of the originator, members of a community should be able to receive communications without revealing their own identities Onwards release authority information should not be distributed beyond the information sharing community without formal approval from the originator. Folie 26

27 O/IEC Familie - sektorspezifische Standards Information security management for inter-sector & interorganisational communications M guidelines for telecommunications organizations based on O/IEC Publiziert MS for financial sector TR Code of practice for information security controls for cloud computing services based on O/IEC Code of practice for PII protection in public clouds acting as PII processors Information security management guidelines based on O/IEC for process control systems specific to the energy utility industry TS/ TR Folie 27

28 O/IEC Code of practice for information security controls for cloud computing services based on O/IEC Aufbau Erweiterung der O/IEC Controls, aber: Struktur schon angepasst an O/IEC neu: clauses 5 18 control objectives controls control implementation guidance other information sector specific guidance Unterscheidung zwischen - cloud service customer und - cloud service provider Work in progress Änderungen möglich! Folie 28

29 O/IEC Code of practice for information security controls for cloud computing services based on O/IEC Aufbau Unterscheidung zwischen - cloud service customer und - cloud service provider Type 1: separate guidance für service customer and service provider Type 2: guidance für service customer or service provider Type 3: same guidance für service customer and service provider Folie 29

30 O/IEC Code of practice for information security controls for cloud computing services based on O/IEC Beispiel Folie 30

31 und die Freunde Guidelines for information and communication technology readiness for business continuity publiziert Guidelines for cybersecurity Network security Application security Information security incident management Information security for supplier relationships Guidelines for identification, collection, acquisition and preservation of digital evidence Specification for digital redaction Selection, deployment and operations of intrusion detection systems (IDPS) Storage security Digital evidence Health informatics Information security management in health using O/IEC Health informatics -- Audit trails for electronic health records Folie 31

32 Informationssicherheit in der OCG Arbeitskreise IT-Sicherheit IT-Governance Forum Privacy Forum e Government Forum ebusiness Veranstaltungen OCG Horizonte OCG Impulse Talk am Campus Konferenzen Workshops Ausbildung Zertifizierung ECDL ECDL IT-Security O/IEC Seite 32

33 OCG Arbeitskreis IT-Sicherheit seit 1993 ca 80 Mitglieder Sicherheitsexperten aus Wirtschaft, Wissenschaft, öff. Verwaltung Vorträge und Workshops zu aktuellen Sicherheitsthemen Young Researchers Day Kontakt: Folie 33

34 Danke für Ihre Aufmerksamkeit! Folie 34