178
votes
Does an ISO27001 audit require users to reveal their passwords?
Absolutely not!
ISO 27001 requires management of passwords and requires having password policies. Someone in your company is interpreting this as needing to inspect all passwords in the clear to ...
- 132k
71
votes
Accepted
Does an ISO27001 audit require users to reveal their passwords?
This is not true. Besides the fact that a sysadmin should be able to change your password when needed, it is probably in breach of the very controls they claim to be enforcing.
It is their job to ...
- 7,859
46
votes
Does an ISO27001 audit require users to reveal their passwords?
What ISO27001 says about passwords
From (https://advisera.com/27001academy/blog/2015/07/27/how-to-handle-access-control-according-to-iso-27001/) there is a summary about user passwords:
User ...
- 637
31
votes
Accepted
How to start with an Information Security Program?
I'll give it a shot.
In a nutshell, the language is CYA in case you get breached or hacked and have access to their data, they can tell their customers "Acme said they had a security program and ...
- 461
17
votes
What is a similar security standard to ISO 27001 with more focus on IT security?
ISO27k is about the 'management of security', not about security itself. Auditors will be concerned by what you are doing to respond to the risks you have identified, if you are really doing what you'...
- 13.1k
17
votes
Does an ISO27001 audit require users to reveal their passwords?
This is against ISMS. I am ISO27001 audit certified and it is definitely is not there. You have two groups of passwords:
Personal: none of their concerns
Enterprise: ISMS forces administrators to ...
- 271
16
votes
Accepted
Password expiration and compliance (ISO, NIST, PCI, etc)
The current version of PCI DSS is 3.2.1*, and in section 8.2.4 it requires users to change their passwords every 90 days. Section 8.2.5 requires that passwords must not be the same as any of the four ...
- 34.7k
13
votes
Does an ISO27001 audit require users to reveal their passwords?
This might be the audit of "do not share your password with anybody"-policy, but there is never ever a reason to hand out your password. To ensure password policy is enforced they might just force new ...
- 251
13
votes
How do I decide which security framework is most suited to my organization?
There are 3 main considerations when deciding to choose a framework:
What are your stakeholders expecting from you?
Why are you choosing a framework? I.E. What outcomes are you looking for?
Which ...
- 132k
9
votes
Accepted
Can a business with a single employee gain ISO27001 certification?
The short answer is that, yes, an individual can get ISO 27001 certification. As the old joke goes, you can ISO 27001 certify a chair...
All the details you wish to know you really need to ask an ...
- 132k
8
votes
Does an ISO27001 audit require users to reveal their passwords?
You may find this question on ServerFault of some use: https://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants?s=1|2.3233
I would agree ...
- 3,661
7
votes
About SSD secure disposal for conforming to iso27001
ISO 27001 does not mandate a specific way SSDs should be destroyed, it just requires that the process is consistently applied after it has been approved by the business risk owners.
That being said, ...
- 1,224
6
votes
Is the ISO/IEC 27001 standard incompatible with free/open source software?
"Access to program source code shall be restricted." does not mean that nobody should be able to access the source code but that it is defined who can access and change the code. The main point is not ...
- 208k
5
votes
Password expiration and compliance (ISO, NIST, PCI, etc)
To answer your Questions first, from an ISO 27001 perspective, it does not prescribe what should be your Expiration duration, neither does it specify how many old Passwords you should retain.
...
5
votes
Accepted
Starting with ISO 27001 - what to buy?
There are several dependencies between the standards in the ISO2700X series also called the "ISMS family of standards" that are not clear from the beginning - so your question is absolutely justified.
...
- 8,021
4
votes
What standard alternative to ISO 27001 can be used for a small business?
"OK, we can't achieve this standard, so let's look for a standard that we can achieve without much work"
is pretty much the opposite of a security-aware organization's mindset, though I'd agree (...
- 6,284
3
votes
Does an ISO27001 audit require users to reveal their passwords?
Controversial answer time...
Number of times I've been 27001 audited: 3 I think, I don't really keep count myself.
Number of times 27001 (or 9000 for that matter) has require impressing and reviewing ...
- 270
3
votes
ISO 27001 structure and granularity of the content
Purchase the standard ISO 27001 & ISO 27002. If you want to certify to ISO 27001, you should at least have the standard so that you know what to do.
ISO 27002 5.1.1 answers your question on what ...
- 101
3
votes
How to start with an Information Security Program?
Legal and contractual language is always complex and some times daunting to read that is why we sometimes gloss over the terms and conditions pages
of products
For your question of where to begin
...
- 31
3
votes
How to start with an Information Security Program?
I responded to a lot of these. One thing jumps out:
ACME will ensure that the Info Security Program is materially
equivalent to Customer’s own information security standards in
place from time ...
- 7,575
3
votes
Expressing the risk of not having a security policy (e.g. ISO 27002, chapter 5)
As an optimist I would say: you are looking at this half-right.
You are right about the fact, that not having a security policy creates risks.
You are not right about that this does not include ...
- 8,021
3
votes
Accepted
Controlling windows server on Amazon Web Services
First of all: ISO/IEC 27001 is the norm that specifies the requirements for the establishing, implementation, maintenance and continuous improvement of an information security management system. ...
- 8,021
3
votes
Accepted
How to maintain and enforce an approved list of software?
There are really two questions here. If you're looking at how to actually enforce the use of approved software only, you need to application whitelisting (using something like AppLocker) to only allow ...
- 16.6k
2
votes
ISO27001 Risk Assessment Methodology
No you do not need to rate each control area on C.I. & A. One score for the overall state of the control item in the organization is sufficient. A single score in each area also reduces confusion. ...
- 5,185
2
votes
ISO 27001, Skype, online CRM... compatible?
Whoever has said that you cannot use some specific technology because of ISO27001 probably has some other vested interest - possibly even just laziness. The standard does not mandate what you can and ...
- 7,152
2
votes
Development of ISO27001 ISMS before production
Information security should be considered in every aspect of the organization's design, development, and implementation. If the organization isn't fully stood up, it's the perfect time to prime the ...
- 5,185
2
votes
Does an ISO27001 audit require users to reveal their passwords?
Of course it is not, as other answers pointed out. Your first efforts should go into changing the requester's mind.
If you are, despite your efforts, somehow forced to provide your password - get ...
- 9,096
2
votes
Accepted
ISO 27001: salary changes to employees without notification
I do not believe this is a specific control requirement; in fact, the general guidance of most any regulatory standard is often less concerned with specific data points and details such as this. They ...
- 765
2
votes
Accepted
Expressing the risk of not having a security policy (e.g. ISO 27002, chapter 5)
This question has two type of answers. One, that directly addresses it. The second, questions the question itself.
Let's discuss them one by one.
To answer your question, organizational risks to its ...
- 99
2
votes
ISO 27001 and copying code from stackoverflow
I can hardly imagine an example or direct copy-paste from SO. I do see SO as a nice source for high quality code samples, and I have often used portions of code from SO answers, but then I have always ...
- 26.9k
Only top scored, non community-wiki answers of a minimum length are eligible