The tag has no wiki summary.

learn more… | top users | synonyms

5
votes
1answer
50 views

How do Software Development Processes, OWASP CLASP & MS SDL, and Security Standards fit together?

How do these three concepts fit together: The Software Development Process (SDP) indicates the different phases of creating an application. Well known processes are waterfall, spiral, agile, extreme ...
1
vote
1answer
31 views

What is the relation between ANSI and ISO regarding ISO 27000?

So in one answer I was told that ANSI is a governing body (the only one in the world) for ISO 27000? I think I got something wrong, because I don't see ANSI mentioned anywhere when I read about ...
0
votes
2answers
82 views

What could be the scope of ISO 27000 standards?

If a company wants to certify against some of ISO 27000-series standards (let's say ISO 27001 and ISO 27005), what could possibly be certified? I mean, is it IT processes in general in the ...
3
votes
1answer
114 views

Does ISO 27000 certification increase the risk of being attacked?

I asked my client (a bank) why they don't certify themselves against ISO 27000 standards. The answer was that if they certified, it would increase the risk of being attacked. Does that make any ...
2
votes
1answer
29 views

Outsourced software development ISO27002 definition

In ISO27002 section 14.2.7 it sets out the requirements for outsourced software development. By Outsourced software development are they referring to bespoke software or does this also include ...
4
votes
2answers
2k views

What is the difference between ISO 27001 and ISO 27002?

What is the difference between ISO 27001 and ISO 27002? Are they related to each other or not?
1
vote
1answer
94 views

what is an internal iso 27001 technical auditor? [closed]

i have been recently hired by an ISO 27001 certified company as an " internal ISO technical auditor". My employer told me that my job is described as follow: this job is created because of the need ...
5
votes
2answers
636 views

ISO 27001 - procedures templates for ISMS at small companies? [closed]

Is anybody use publicly available (or relatively cheap) templates of procedures for ISO 27001 for build own information security management system capable to be conform standard. Any recommendation? ...
2
votes
2answers
182 views

What is ISO27000 (27001) how to achieve it [duplicate]

I have recently came across ISO 27000. Basically what I learnt is that it is used for audit purpose in organizations. Can you tell what exactly it is, if I am wrong. What all tools are available for ...
1
vote
2answers
165 views

Compliance with an industry recognized framework - ISO27k

I've been asked to figure out how to get our company to comply with an "Industry Recognized [Security] Framework" where '“Industry Recognized Framework” means a global industry recognized information ...
1
vote
4answers
2k views

Questions about in-scope information assets for an ISO27001 ISMS

I am in the process of writing a Scope for the information assets - in preparation for writing an ISO27001 compliant ISMS. I am confused as to if a VPN network is considered to be in Scope? as well ...
-1
votes
1answer
299 views

How secure are the new TLDs ( .us, .io, …) and do they compare to .com? [closed]

The introduction of the new top level domains (TLDs) such as .music, .books, etc. will increase the number of people and organisations adding and removing entries into the root DNS servers (.) for ...
2
votes
1answer
480 views

ISO 27001 failure to comply

Say a small company just earned an ISO 27001 accreditation. What happens if during one of the audits it is found that the company didn't follow the ISMS? Is there a certain warning process that ...
-2
votes
2answers
268 views

which certification course should I choose? [closed]

The company I'm working in propose among others the following courses related to security ISO 27001 Lead Auditor ISO 27001 Lead Implementer Certified Certified Information Systems Security ...
11
votes
2answers
598 views

Should a penetration tester have training in ISO 27001/ITIL etc?

I recently got offered a promotion but as part of the package I've been requested to do ISO 27001, ITIL, ARPA and other kinds of training. I've previously avoided this sort of training as I felt it ...
2
votes
3answers
971 views

Security Assessment vs. Risk Analysis

What the real difference between IT Security Assessment based on ISO 27001 (or in general other international standard) and qualitative risk analysis? In some way the approach is much similar - ...
11
votes
5answers
1k views

ISO27000 implementation - Where do you get the standardization material?

In implementing ISO27000 (ISO27001&27002) I am wondering where I can download and review the standard? I wish to start implementing it but I am a bit stumped on where to start. Some sites offer ...