15

The ISO 27000 series of standards are a compilation of international standards all related to information security. The difference is that the ISO 27001 standard has an organizational focus and details requirements against which an organization’s Information Security Management System (ISMS) can be audited. ISO 27002 on the other hand is more focused on the ...


14

While it may not be the hardcore technical pentesting you are used to, it will definitely aid you in understanding processes and security controls within a company. This may help you to bring your findings in an understandable way to the business and IT management. Obviously it also means you could do more than just pentesting as you could also write a ...


11

The official route for documentation is through ISO:IEC - and papers cost 134 Swiss Francs each. Various bodies have guidance papers, for example ISACA provide a range of ISO27001 material on topics such as implementing ISMS, aligning Cobit, ITIL and ISO27001 - but you have to be an ISACA member (if you need to, ask me how :-) Alternatively, you can engage ...


8

ISO 27001 establishes requirements. If an organization wants to certify its Information Security Management System (ISMS) it needs to comply with all requirements in ISO 27001. On the other hand, ISO 27002 are best practices that are not mandatory. That means that an organization does not need to comply with ISO 27002 but can use it as inspiration to ...


7

27000 itself is free, but the other standards in the family cost money, I'm afraid. They can be purchased as a printed book or ebook directly from the ISO and the IEC themselves, at http://www.iso.org/iso/home/store.htm or from http://webstore.iec.ch/ It's also usually available from your local countries standards body. For Norway that is Standards Norway,...


6

I do not see an increased risk of attack due to being an ISO certified organization. ANSI (The governing standards body) does not release ISO certified organizations business names. There are organizations that offer you the ability to look up an ISO 27001 certified organization but those organizations have elected to register voluntarily. I would ...


5

An IT security assessment is a type of risk assessment. Here's the usual process: Identify the scope of the assessment, and the information assets that are important to the target. Perform an analysis of the technical security of the target, e.g. via network attacks, physical penetration, etc. If in scope, perform an analysis of the security policies that ...


4

An asset is whatever your company considers that have value for its business. Information asset is every asset related to information, that in theory, could be anything from people, technology, physical sites, devices, documents, etc. Choosing a correct scope for ISO 27001 can be difficult. If you broaden it too much, it will be difficult to implement the ...


4

The security of DNS is independent of the particular name hierarchy, as typical DNS-related attacks happen at the resolver instead of at the authoritative server. Furthermore, DNS without DNSSEC is not assumed to be secure any more than telnet is assumed to be a safe remote shell protocol. Security must be layered on elsewhere, such as in TLS. But to ...


4

There are several dependencies between the standards in the ISO2700X series also called the "ISMS family of standards" that are not clear from the beginning - so your question is absolutely justified. Fortunately there is a Figure for that: Source: ISO/IEC 27000:2016 What every single standard does can be somewhat inferred from their names. So here's a ...


3

Of the ISO 27000 range of documents, only 27001 is a certifiable standard. The others in the range are guidance and advisory documents. The first step of ISO 27001 implementation is defining the scope. In my experience it would be unusual to have "IT Processes" as a scope - it's usually defined by business area. So for example the Operations part of the ...


3

ISO27000 has little to do with penetration testing. It's a collection of ISMS (Information Security Management Systems) standards that provide a list of controls which an organization should implement as it enables (or should enable) proper security governance. It's more on a conceptual level and provides more a set of rules which can be used to create ...


3

First, you should know that the ISO27000 family of standards isn't specific about IT. Depending on the scope you define in the beginning, your risk analysis could also cover various activities of your company. Of course, as the focus is on managing the security of your information, there are a lot of recommended controls that are indeed about IT. That said, ...


3

This question is subjective because it really does depend on the direction you want to go. My advice would be to go for the CISSP because it is a very broad and it would give you a survey of the different areas of security. ISO27001 is a standard and very focused around certain areas, you wouldn't lean that much. Plus, it's really, really boring. Not that ...


3

I could not find anything about this particular ISO 97001 on the ISO website or any other related sites. But I saw you placed a tag ISO 27000 and that you mentioned ISMS, so I suppose you are talking about ISO 27001 which is Information Security Management System. Normally, with all ISO certification, once you are accredited the certificate, scheduled ...


3

I've rarely found more knowledge to be a detrimental thing. It may not be super useful, but it may help in some rare scenarios.


3

Purchase the standard ISO 27001 & ISO 27002. If you want to certify to ISO 27001, you should at least have the standard so that you know what to do. ISO 27002 5.1.1 answers your question on what the standards committee suggest you consider. Regarding the first link, you do not need to provide this level of detail unless it is required by the standard. ...


3

You are looking for the ISO/IEC 27034-1:2011. The target audience is: The following audiences will benefit from ISO/IEC 27034 while carrying out their designated organizational roles: a) managers; b) provisioning and operation teams; c) acquisition personnel; d) suppliers; and e) auditors To understand what this norm is actually for, read ...


2

This is confusing, perhaps partly explaining why the new 27001:2013 doesn't talk about assets in the main body any more. (Although of course effective asset management is an important security control and as such is discussed in Annex A.8 of 27001 and the corresponding Section 8 of 27002.) You are right that information assets are, by definition, ...


2

Though I am not a expert on ISO27k standard following is how information asset is defined taken from FREE ISO27k Toolkit Information wherever it is handled or stored (e.g., in computers, file cabinets, desktops, fax machines, Xerox, printer, verbal communication etc.) needs to be suitably and appropriately protected from unauthorized access, modification, ...


2

There are many security related certifications that are more technical than management related. These are some: CompTIA Security+ GIAC Security Essentials Certified Ethical Hacker (CEH) Security+ is a more "neutral" security cert in that it is vendor agnostic, unlike something like a VMware or Cisco certification. It focuses on cryptography and a broad ...


2

Not of much benefit. I am a PenTester with both ITIL and ISO 27k certifications. While ITIL has hardly to do anything directly with information security and is very generic but can be effective in putting a process for faster incident response and change control. ISO 27k exists as standard and very broad guidelines for processes to be followed by any ...


2

You may like to look through the following: http://www.27000.org/iso-27001.htm http://en.wikipedia.org/wiki/ISO/IEC_27001 To my knowledge, most ISO standard documents are not freely obtainable and have to be purchased from the ISO store (http://www.iso.org/iso/home/store.htm) or from the ISO member of one's own country, e.g. DIN in Germany. (For an ...


2

In the scope of IT security, quantitative risk analysis is done by developing a rigorous mathematical model to represent the desired definition of the risk or some aspect of the risk. The security (of a network, for example) is assessed using the developed model. An example of this approach is risk analysis of enterprise networks using quantitative ...


2

Because this is a client requirement and not an internal motivation to naturally "grow into" a security program, this is not a trivial task because you have time constraints (One would assume). Assuming, then, that you need 3rd party verification of your alignment to a framework, you are going to need to find a qualified, certified person in the framework ...


2

I think you're responsibilities is to verify on on-going basis if your company is adhering to the ISO27001. So basically your third point describes what you will be doing: reviews. Basically you are an auditor, which indeed means you are NOT part of the IT department, but the audit department. This is to ensure independence and objectiveness as no-one of ...


2

Something like this from the ISO27k Forum? I found a whole bunch of paid-for templates too. As requested. From the linked site: The FREE ISO27k Toolkit consists of a collection of ISMS-related materials contributed by members of the ISO27k Forum, either individually or through collaborative working groups organized on the Forum. We are very grateful for ...


2

ANSI stands for American National Standards Institute ISO stands for International Organization for Standardization ANSI is the American representative of the ISO body. So, yes, ISO is the umbrella, but in the US, ANSI is the representative.


2

Yes, that is possible. ISO27001 requires you to define the scope of the certification, so you could restrict the scope to that one specific division. Of course, any smart auditor would check what relations that division has with other divisions and which risks and controls are related to that.


2

Taken from the book, CyberWar, CyberTerror, CyberCrime and CyberActivism, 2nd Edition ISO/IEC 27003 (the ISMS default-suggested by ISO 27001), provides practical guidance for implementing a security management system based on ISO/IEC 27001:2005 by introducing a comprehensive methodology of applying the PDCA cycle to cybersecurity. This standard ...


Only top voted, non community-wiki answers of a minimum length are eligible