Implementation of Information Security Management Standard

1
Implementation of Information Security
Management Standard

• Ljubomir Trajkovski, M.Sc. CMC
• Information Security Management Consultant
• TRAJKOVSKI PARTNERS CONSULTING
• Skopje, MACEDONIA
• Ljubomir.Trajkovski_at_TP-Consulting.EU

2
The Opening Message

• (Information) Security
• is
• EVERYONE business!

3
Presentation content ( tentavive)

• InfoSec -Current issue
• Definition of ISO Management Standards
• InfoSec what it is all about?
• OECD Culture of Security
• ISMS based on ISO 17799 ISO 27001
• ISO 27000 Family
• How to implement ISMS
• Risk Assessment
• Who is afraid of ISMS
• Closing message

4
Current issue

• Is a Standard LAW ?

5
Definition of ISO Management Standards

• best practices
• developed for professionals by professionals
• Compulsory ? NO !!!
• Type of Standards
• Guidelines ( best practices )
• Specifications (metrics)

6
Value and Authority of ISO

• Rule
• gt 80 of National Members have to vote YES
  for awarding the title
• ISO Standard to the proposed best practice

7
Information Security

• Whats it all about?
• Who care ?
• What for?
• What if we do nothing?

8
ISO 17799 ISO 27001

• Information Security MANAGEMENT System
• ISO 17799 ISMS Guidelines
• 11 Security Control Areas-SCA
• ISO 27001
• Measurable target/evidence for all above
  mentioned SCAs

9
ISO 27000 Family
10
Plan-Do-Check-Act PDCA
11
Security Control Areas - SCAs
1. Security Policy
2. Organization of Information Security
3. Asset Management
4. Human Resources Security
5. Physical and Environmental Security
6. Communications and Operations Management
7. Access Control
8. Information Systems Acquisition, Development
and Maintenance
9. Incident Management
10. Business Continuity Management
11. Compliance
12
Implementation Roadmap
13
Implementation Roadmap-2
14
ISMS Implementation Primer
15
Risk Assessment (?)
16
Who will believe you ?
17
Who is afraid of ISMS ? (yet)

• There are ???????? Companies and Organizations in
  the World !
• There are lt 2.000 ISMS 27001 Certified Companies
  and Organization
• What about other ??????? 2.000 Companies and
  Organizations?

18
Closing Message

• (Information) Security
• is
• EVERYONE business!

19
JFK

• Dear citizen,
• dont ask what InfoSec can do for you
• but ask yourself
• what YOU CAN DO
• for YOURS (Information) Security!

20
At the end

• Lets do what we have to do !
• Thanks for your patience
• Ljubomir Trajkovski
• Ljubomir.Trajkovski_at_TP-Consulting.EU
• 389 75 279 025