Help on ISO-27000 SoA
This kind of question keeps coming up, many people are unclear about the Statement of Applicability on ISO-27000.
The SoA should outline the measures to be taken in order to reduce risks such as those mentioned in Annex A of the standard. These are based on 'Controls'.
But if you are using closed-source products such as those from Microsoft, are you giving up control? Things like validation checks and integrity controls are are 'internal'.
Well, its a bit of a word-play.
- SoA contains exclusions on controls that are not applicable because the organization doesn't deal with these problems (ie ecommerce)
- SoA contains exclusions on controls that pose a threat (and risks arise) but cannot be helped (ie A.12.2 Correct processing in applications) and no measures can be taken to reduce these risks.
With this, a record must be present in risk assessments, stating that the risk (even if it is above minimum accepted risk level) is accepted
The key to the SOA is SCOPE.
Surely compliance is binary?
Call me a dinosaur (that's OK, since its the weekend and dressed down to work in the garden) but ...
Surely COMPLIANCE is a binary measure, not a "level of" issue.
You are either in compliance or you are not.
As in you are either deal or alive.
Social Engineering and sufficency of awareness training
Someone asked:
If you have a good information security awareness amongst
the employees then it should not a problem what kind of attempts
are made by the social engineers and to glean information from
your employees.
Yes but as RSA demonstrated, it is a moving target.
You need to have it as a continuous process, educate new hires and educate on new techniques and variations that may be employed by the 'social engineers'. Fight psychology with psychology!
Orwell: a quarter of a century late
http://hdguru.com/is-your-new-hdtv-watching-you/7643/
well 28 years actually ...
So, the two-way tv sets of Orwell's novel have arrived, over a quarter of a century late!
George Orwell in Hampstead On the corner of Pond Street and South End Road, opposite the Royal Free Hospital. The bookshop has long gone. (Photo credit: Wikipedia)
It just goes to show. Science fiction things like the Star Trek communicator (Motorola flip phones) or the tricorder (some of the enhanced versions of the Newton) or the data Pad (the real world version has an extra 'i') we do pretty quickly, but if its a mainstream novel, the kind of thing that my old Eng Lit teacher would approve of (he snivelled at SF and cringed at its mention) then it seems three isn't the same enthusiasm about replicating its technology.
Related articles
- Books that Changed my Life: 1984 by George Orwell (caracaleo.com)
- Orwell's Nineteen Eighty-Four forecast for Hollywood remake (guardian.co.uk)
- Near-Future Fiction (madgeniusclub.com)
- Orwell vs. The U.S. House of Representatives (pubcit.typepad.com)
- And the privacy invasion award goes to ... (sgtreport.com)
- How to resist Big Brother 2.0 (blogs.reuters.com)
- Microsoft speaks on privacy following 'NUad' concerns (thenextweb.com)
- Glancee + Facebook = Orwell's Big Brother in Spades..... (tishgrier.wordpress.com)
About ISO 27001 Risk Statement and Controls
On the ISO27000 Forum list, someone asked:
I'm looking for Risk statement for each ISO 27k control; meaning
"what is the risk of not implementing a control".
That's a very ingenious way of looking at it!
One way of formulating the risk statement is from the control
objective mentioned in the standard.
Is there any other way out ?
Ingenious aside, I'd be very careful with an approach like this.
Risks and controlsare not, should not, be 1:1.
The 19 most maddening security questions | Security – InfoWorld
http://www.infoworld.com/d/security/the-19-most-maddening-security-questions-187983
An interesting list, since it covers issues of public structural security.
I recall reading that the greatest contribution to the health of individuals came about from good public sanitation and clean water, that is civic changes (presumably enabled by legislation) that affected the public in a structural manner.
What would be on your list?
A poster for drinking water security from the EPA (Photo credit: Wikipedia)
Related articles
- Companies slow to react to mobile security threat - InfoWorld (infoworld.com)
Naval War College uses Russian software for iPad course material
http://www.nextgov.com/nextgov/ng_20120305_6368.php
The Navy's premier institution for developing senior strategic and
operational leaders started issuing students Apple iPad tablet
computers equipped with GoodReader software in August 2010,
unaware that the mobile app was developed and maintained by
a Russian company, Good.iWare, until Nextgov reported it in February.
OK so its not news and OK I've posted about this before, but ...
Last week I was reading another report about malware and it stated that most malware yamma yamma yamma had it origins in the USA. No doubt you've seen reports to that effect with different slants.
So the question here is: Why should software produced in the country where there are more evil-minded programmers be superior to software produced in Russia?