The tag has no usage guidance.

learn more… | top users | synonyms

15
votes
3answers
837 views

Should a penetration tester have training in ISO 27001/ITIL etc?

I recently got offered a promotion but as part of the package I've been requested to do ISO 27001, ITIL, ARPA and other kinds of training. I've previously avoided this sort of training as I felt it ...
11
votes
5answers
1k views

ISO27000 implementation - Where do you get the standardization material?

In implementing ISO27000 (ISO27001&27002) I am wondering where I can download and review the standard? I wish to start implementing it but I am a bit stumped on where to start. Some sites offer ...
6
votes
3answers
11k views

What is the difference between ISO 27001 and ISO 27002?

What is the difference between ISO 27001 and ISO 27002? Are they related to each other or not?
5
votes
2answers
1k views

ISO 27001 - procedures templates for ISMS at small companies? [closed]

Is anybody use publicly available (or relatively cheap) templates of procedures for ISO 27001 for build own information security management system capable to be conform standard. Any recommendation? ...
4
votes
1answer
216 views

Does ISO 27000 certification increase the risk of being attacked?

I asked my client (a bank) why they don't certify themselves against ISO 27000 standards. The answer was that if they certified, it would increase the risk of being attacked. Does that make any ...
4
votes
1answer
205 views

How do Software Development Processes, OWASP CLASP & MS SDL, and Security Standards fit together?

How do these three concepts fit together: The Software Development Process (SDP) indicates the different phases of creating an application. Well known processes are waterfall, spiral, agile, extreme ...
3
votes
1answer
31 views

Is it possible for one Division of an organization to be certified ISO 27001?

Is it possible for an entity or a division part of an organization to be certified ISO 27001, specifically the Division Information Security Management System?
2
votes
5answers
3k views

Questions about in-scope information assets for an ISO27001 ISMS

I am in the process of writing a Scope for the information assets - in preparation for writing an ISO27001 compliant ISMS. I am confused as to if a VPN network is considered to be in Scope? as well ...
2
votes
3answers
2k views

Security Assessment vs. Risk Analysis

What the real difference between IT Security Assessment based on ISO 27001 (or in general other international standard) and qualitative risk analysis? In some way the approach is much similar - ...
2
votes
2answers
798 views

ISO 27001 failure to comply

Say a small company just earned an ISO 27001 accreditation. What happens if during one of the audits it is found that the company didn't follow the ISMS? Is there a certain warning process that ...
2
votes
1answer
59 views

Outsourced software development ISO27002 definition

In ISO27002 section 14.2.7 it sets out the requirements for outsourced software development. By Outsourced software development are they referring to bespoke software or does this also include ...
1
vote
2answers
355 views

What could be the scope of ISO 27000 standards?

If a company wants to certify against some of ISO 27000-series standards (let's say ISO 27001 and ISO 27005), what could possibly be certified? I mean, is it IT processes in general in the ...
1
vote
2answers
315 views

What is ISO27000 (27001) and how to achieve it? [duplicate]

I have recently came across ISO 27000. Basically what I learnt is that it is used for audit purpose in organizations. Can you tell what exactly it is, if I am wrong? What tools are available for ISO ...
1
vote
2answers
265 views

Compliance with an industry recognized framework - ISO27k

I've been asked to figure out how to get our company to comply with an "Industry Recognized [Security] Framework" where '“Industry Recognized Framework” means a global industry recognized information ...
1
vote
1answer
49 views

What is the relation between ANSI and ISO regarding ISO 27000?

So in one answer I was told that ANSI is a governing body (the only one in the world) for ISO 27000? I think I got something wrong, because I don't see ANSI mentioned anywhere when I read about ...
1
vote
1answer
158 views

what is an internal iso 27001 technical auditor? [closed]

i have been recently hired by an ISO 27001 certified company as an " internal ISO technical auditor". My employer told me that my job is described as follow: this job is created because of the need ...
1
vote
1answer
11 views

Does the use or the implementation of PDCA or Deming cycle in the Information Security Management System mandatory?

To comply with ISO 27001, does the Information Security Management System ought to implement the PDCA process ? or ISMS can choose another management method? PDCA process is the Plan Do Check and ...
0
votes
1answer
190 views

Link to download the ISO 27002 clauses [closed]

Which link is authentic to download ISO 27002 clauses. I am not seeing a web page / PDF for the list of 133 controls to go through
-1
votes
1answer
391 views

How secure are the new TLDs ( .us, .io, …) and do they compare to .com? [closed]

The introduction of the new top level domains (TLDs) such as .music, .books, etc. will increase the number of people and organisations adding and removing entries into the root DNS servers (.) for ...
-2
votes
2answers
516 views

which certification course should I choose? [closed]

The company I'm working in propose among others the following courses related to security ISO 27001 Lead Auditor ISO 27001 Lead Implementer Certified Certified Information Systems Security ...
-3
votes
1answer
66 views

why ISO is 27001 & 9001, why there are no other numbers [closed]

I am fond of asking question why example protocols eg 802.1 n for wireless 80 is 1980 & 2 is February since standardization of protocol is was done at Feb 1980 thats how it arrived at 802 now ...