A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.
175

Absolutely not! ISO 27001 requires management of passwords and requires having password policies. Someone in your company is interpreting this as needing to inspect all passwords in the clear to ensure that they meet the password policy. But this is a terrible way of doing this audit. Technology should be in place to force people to comply with password ...


68

This is not true. Besides the fact that a sysadmin should be able to change your password when needed, it is probably in breach of the very controls they claim to be enforcing. It is their job to ensure that controls are in place around passwords, but it is the users responsibility to keep their passwords confidential. Any shared admin passwords should be ...


44

What ISO27001 says about passwords From (https://advisera.com/27001academy/blog/2015/07/27/how-to-handle-access-control-according-to-iso-27001/) there is a summary about user passwords: User responsibilities (subsection A.9.3) This is a very short subsection (with one control only) that requires you to define how the users will keep their ...


31

I'll give it a shot. In a nutshell, the language is CYA in case you get breached or hacked and have access to their data, they can tell their customers "Acme said they had a security program and was protected so this is their fault". In that case if you end up being the cause of them losing data, they can blame you. That being said, its pretty ...


23

One of ISO 27001 requirements is management of access control to company's IT resources. If you just install Ubuntu on your laptop, all the access control will be managed by you directly, instead of your company. So when, for example, your manager will want to fire you, then your IT department won't be able to block your local laptop account in a convenient ...


20

ISO 27001 does not specify which protocols should be used and how they should be used, it specifies how an organization should structure its information security apparatus. An ISO 27001 certified organization must have policies in place and procedures to make sure the policies are adhered to. ISO 27001 also has a scope which is defined by the organization ...


17

ISO27k is about the 'management of security', not about security itself. Auditors will be concerned by what you are doing to respond to the risks you have identified, if you are really doing what you're saying, what do you do when something deviates from what has been specified or to new risks, and how do you evaluate the efficiency of your measures. So ...


17

This is against ISMS. I am ISO27001 audit certified and it is definitely is not there. You have two groups of passwords: Personal: none of their concerns Enterprise: ISMS forces administrators to implement password policies, force you to change your password to meet their policies AND the auditor has to check the policy and how it is implemented/forced


15

Certification companies like SGS, TÜV Rheinland or BSI are accredited by accreditation entities to issue ISO 27001 certificates. For example, SGS and BSI are accredited by UKAS and TÜV Rheinland is accredited by DAR. Accreditation entities perform audits of the certification companies they accredit in order to guarantee that they conform to their ...


13

This might be the audit of "do not share your password with anybody"-policy, but there is never ever a reason to hand out your password. To ensure password policy is enforced they might just force new passwords within the rules of policy.


12

The current version of PCI DSS is 3.2, and in section 8.2.4 it requires users to change their passwords every 90 days. Section 8.2.5 requires that passwords must not be the same as any of the four previous passwords (note that it does not prescribe how this is to be accomplished; the standard does not specifically state the "storage of hashes" is required.) ...


9

The answer to your question depends on a number of factors including, "Who are your clients" - Different companies will want different levels of assurance, for example a bank sending financial data will (hopefully) want more assurance than a coffee shop sharing menus. "What data are you processing for your clients" - Again this will affect the answer, if ...


8

The ISO 27001 is* about documenting what you do, how you do it, and what controls you have in place to audit that things are the way they are supposed to be. That means that the typical laptop installs is very, very standardized with known templates (how you do it). The PCs are likely to be installed in an Active Directory with GPO enforced and monitoring in ...


8

You may find this question on ServerFault of some use: https://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants?s=1|2.3233 I would agree with other comments here that suggest that if this is what they 'require', it is better they reset all passwords to something they chose, and pass that ...


7

ISO 27001 does not mandate a specific way SSDs should be destroyed, it just requires that the process is consistently applied after it has been approved by the business risk owners. That being said, depending on the size of your business and the volume of devices you might consider the following: Make use of a secure disposal service Use a SSD shredder - ...


6

I do not see an increased risk of attack due to being an ISO certified organization. ANSI (The governing standards body) does not release ISO certified organizations business names. There are organizations that offer you the ability to look up an ISO 27001 certified organization but those organizations have elected to register voluntarily. I would ...


5

I only have auditing & review experience for ISO 27001 compliance but not for 31000, so my answer will focus on this one. To summarize, the answers are: Is the matching correct? Yes. Is it possible to use OSSTMM as a risk assessment methodology for ISO 27001/31000 ? It depends, see below. Any fundamental requirement that makes it impossible? No. ISO ...


5

Do you believe in ISO/IEC 27001? Do you accept that a company that is implementing and maintaining a management system based on ISO/IEC 27001 will have effective information security management processes? If you don't, then its pointless worrying about how we can trust certification bodies, like BSI. A lot of people don't understand the standard in the ...


5

"OK, we can't achieve this standard, so let's look for a standard that we can achieve without much work" is pretty much the opposite of a security-aware organization's mindset, though I'd agree (after 5 min of lecture) with the presumption that 27001 might be a bit much work – but then you'll have to just live without that certification. Instead of trying ...


5

"Access to program source code shall be restricted." does not mean that nobody should be able to access the source code but that it is defined who can access and change the code. The main point is not to have the source code secret but to prevent unauthorized and unaudited changes to the source code. And this is true for using open source too: one should ...


4

Ultimately it's down to trust. Who trusts you to audit against ISO27001? In the case of BSi, they've established themselves as part of the process (indeed BS7799 which was a BSi developed standard predated ISO27001 and IIRC got effectively turned into ISO27001 when it was first created). So as part of creating a standard you have to create and manage an ...


4

Most security folks are rather cynical about certifications. We get sold a LOT of certs, and we also validate that many of cert holding folks of the world aren't paying very close attention. (CCNA, you know default creds are bad!) My advice: Only get certs your employer pays for If compliance is a concern, go that route first Try not to go vendor specific ...


4

Usually ISO27k does not require specific methods to be implemented. It however requires specific documents (such as the perimeter and politic of the ISMS, a description of the risk analysis method, a Statement of Applicability, ...). You will never read "you have to implement a complete retention of logs for instant messages". The ISO27002 defines some of ...


4

There are several dependencies between the standards in the ISO2700X series also called the "ISMS family of standards" that are not clear from the beginning - so your question is absolutely justified. Fortunately there is a Figure for that: Source: ISO/IEC 27000:2016 What every single standard does can be somewhat inferred from their names. So here's a ...


3

Certification by accreditation bodies only occurs if you are indeed compliant within the scope you have set for your company. You can request ISO27001 auditors to perform a gap assessment and current state and they can do low or high level recommendations to improve your ISMS or assist with implementation. Note that depending on the amount of advise given to ...


3

ISO 27001 is a management standard and does not directly tell you what to do to be secure. Instead, it tells you how to make a tool called an Information Security Management System (ISMS); you then use the ISMS to figure out you what you need to do. So the answer to your question "should we log Skype" is "what does the ISMS tell us to do?". (P.S. Not to ...


3

This depends entirely on your company's policies and standards. ISO 27001 is a system for managing security, but it has few hard requirements for what the policies and standards actually say. I work for an ISO 27001 company that allows technical staff to do self installs of an alternative OS. There are certain technical requirements (company hardware, disk ...


3

Of the ISO 27000 range of documents, only 27001 is a certifiable standard. The others in the range are guidance and advisory documents. The first step of ISO 27001 implementation is defining the scope. In my experience it would be unusual to have "IT Processes" as a scope - it's usually defined by business area. So for example the Operations part of the ...


3

ISO27000 has little to do with penetration testing. It's a collection of ISMS (Information Security Management Systems) standards that provide a list of controls which an organization should implement as it enables (or should enable) proper security governance. It's more on a conceptual level and provides more a set of rules which can be used to create ...


3

In theory it is entirely possible that digitising paper documents could improve their overall security, but it depends on the specifics and how well protected/controlled the current environment is, and whether that will be improved once the new project is rolled out. If you're looking to make this case, you could look at your organisations current risk ...


Only top voted, non community-wiki answers of a minimum length are eligible