Our organisation is currently working towards ISO27001 accreditation and we use Skype. We are wondering whether it is a definite requirement to record and keep logs of all the instant messages sent and received?
Add a comment
|
3 Answers
Usually ISO27k does not require specific methods to be implemented. It however requires specific documents (such as the perimeter and politic of the ISMS, a description of the risk analysis method, a Statement of Applicability, ...). You will never read "you have to implement a complete retention of logs for instant messages".
The ISO27002 defines some of the best-practices for implementing ISO27001, maybe you will find here that this type of control is suggested. But again not mandatory.
What can (usually) happen to make this a requirement is:
- You stated in your documents that you do it
- You stated in your documents that you have to comply to the X regulatory which requires to keep these logs.
ISO27k is a framework that dictates how the management of security should go, not how the security should be implemented. However, it will ask to write descriptions of what you are doing and audits will verify that you do what you say you are doing.
ISO 27001 is a management standard and does not directly tell you what to do to be secure.
Instead, it tells you how to make a tool called an Information Security Management System (ISMS); you then use the ISMS to figure out you what you need to do.
So the answer to your question "should we log Skype" is "what does the ISMS tell us to do?".
(P.S. Not to be mean, but this is very fundamental. If you don't get this core idea, then you don't understand 27001 at all and you need to fix that first before worrying about details of controls.)
ISO/IEC 27001:2013 4.2 says you should define the needs and expectations of interested parties which could include associated legal/regulatory requirements and contractual obligations. In 6.1.2 you establish an information security risk assessment process that identifies/analyzes/evaluates/prioritizes your organization's information security risks based on the scope of your Information Security Management System, then in 6.1.3 you define/apply/document your risk treatment process.
As far as a practical example goes, say you perform a (required) risk assessment and determine that using public IM might expose your organization to privacy, security and legal liability risks because of the ability to exfiltrate personal information and download viruses/copyrighted information. If the identified risk level exceeds the risk acceptance criteria you define via 6.1.2, it would be a requirement to define/apply/document a risk treatment plan that addresses the risk. The risk treatment plan might involve authenticating, encrypting, auditing, logging and monitoring IM traffic.
Some areas where you might have logging requirements, including IM logging:
- A.12.4.1 - Event logging - includes recording user activities
- A.13.2.1 - Information transfer policies and procedures - retention and disposal guidelines for business correspondence including messages
- A.18.1.1 - Identification of applicable legislation and contractual requirements - you might be legally obligated to record communications such as if the communications are public record or to comply with contractual obligations.
