Group Open Information Security Management Maturity Model O-ISM3

1. Auflage 2011
ISBN: 978-90-8753-911-5
Verlag: Van Haren Publishing
Format: PDF
Kopierschutz: Adobe DRM (»Systemvoraussetzungen)

E-Book, Englisch, 153 Seiten, WEB PDF

The O-ISM3 standard focuses on the common processes of information security. It is technology-neutral, very practical and considers the business aspect in depth. This means that practitioners can use O-ISM3 with a wide variety of protection techniques used in the marketplace. In addition it supports common frameworks such as ISO 9000, ISO 27000, COBIT and ITIL. Covers: risk management, security controls, security management and how to translate business drivers into security objectives and targets

Autoren/Hrsg.

Group, The Open

Inhaltsverzeichnis

1;Preface;10
2;Trademarks;13
3;Acknowledgements;14
4;Referenced documents;15
5;Chapter 1 Introduction;20
5.1;1.1 Positioning security management;20
5.2;1.2 Key characteristics of ISM3;21
5.3;1.3 Potential for certification;23
5.4;1.4 Summary;24
6;Chapter 2 Concepts – processes, capability, and maturity;26
6.1;2.1 Defining the key terms;26
6.1.1;2.1.1 Tying these key terms together;26
6.2;2.2 Capability levels;27
6.3;2.3 Maturity levels;27
6.3.1;2.3.1 Maturity levels and RoI;28
6.4;2.4 Processes;29
6.4.1;2.4.1 Levels;29
6.4.1.1;2.4.1.1 Generic Processes;29
6.4.1.2;2.4.1.2 Strategic-Specific Processes;30
6.4.1.3;2.4.1.3 Tactical-Specific Processes;30
6.4.1.4;2.4.1.4 Operational-Specific Processes;31
6.4.2;2.4.2 Selecting your set of processes;31
6.4.3;2.4.3 Process definition;32
6.4.4;2.4.4 Process roles and responsibilities;34
6.4.5;2.4.5 Process metrics definition;38
6.4.6;2.4.6 Process metrics specification;39
6.4.7;2.4.7 Process metrics operational use;42
7;Chapter 3 ISM3 in a business context;46
7.1;3.1 Business context;46
7.2;3.2 Security-in-context model;47
7.3;3.3 Operational approach;48
7.4;3.4 Operational definitions;48
7.5;3.5 ISM3 definition – security-in-context;49
7.6;3.6 Business objectives, security objectives, and securitytargets;49
7.6.1;3.6.1 Business objectives;49
7.6.2;3.6.2 Security objectives;50
7.6.3;3.6.3 Security targets;52
7.6.4;3.6.4 Examples;52
7.7;3.7 ISM3 interpretation of incidents, success, and failure;59
8;Chapter 4 ISM3 process model;62
8.1;4.1 Security management – ISM3 basics;62
8.2;4.2 Generic Processes;65
8.2.1;4.2.1 GP-1: Knowledge Management;65
8.2.2;4.2.2 GP-2: ISMS and Business Audit;67
8.2.3;4.2.3 Implementing ISM3;68
8.2.3.1;4.2.3.1 GP3 - ISM Design and Evolution;68
8.3;4.3 Specific processes – strategic management;70
8.3.1;4.3.1 SSP-1: Report to Stakeholders;70
8.3.2;4.3.2 SSP-2: Coordination;71
8.3.3;4.3.3 SSP-4: Define Division of Duties Rules;72
8.3.4;4.3.4 SSP-6: Allocate Resources for Information Security;73
8.4;4.4 Specific processes – tactical management;73
8.4.1;4.4.1 TSP-1: Report to Strategic Management;73
8.4.2;4.4.2 TSP-2: Manage Allocated Resources;74
8.4.3;4.4.3 TSP-3: Define Security Targets and Security Objective;75
8.4.4;4.4.4 TSP-4: Service Level Management;76
8.4.5;4.4.5 TSP-6: Security Architecture;77
8.4.6;4.4.6 TSP-13: Insurance Management;78
8.4.7;4.4.7 Personnel Security;78
8.4.7.1;4.4.7.1 TSP-7: Background Checks;78
8.4.7.2;4.4.7.2 TSP-8: Personnel Security;79
8.4.7.3;4.4.7.3 TSP-9: Security Personnel Training;80
8.4.7.4;4.4.7.4 TSP-10: Disciplinary Process;80
8.4.7.5;4.4.7.5 TSP-11: Security Awareness;81
8.4.8;4.4.8 TSP-14: Information Operations;82
8.5;4.5 Specific processes – operational management;83
8.5.1;4.5.1 OSP-1: Report to Tactical Management;83
8.5.2;4.5.2 OSP-2: Security Procurement;84
8.5.3;4.5.3 Lifecycle Control;84
8.5.3.1;4.5.3.1 OSP-3: Inventory Management;85
8.5.3.2;4.5.3.2 OSP-4: Information Systems IT Managed Domain Change Control;86
8.5.3.3;4.5.3.3 OSP-5: IT Managed Domain Patching;87
8.5.3.4;4.5.3.4 OSP-6: IT Managed Domain Clearing;88
8.5.3.5;4.5.3.5 OSP-7: IT Managed Domain Hardening;89
8.5.3.6;4.5.3.6 OSP-8: Software Development Lifecycle Control;90
8.5.3.7;4.5.3.7 OSP-9: Security Measures Change Control;91
8.5.3.8;4.5.3.8 OSP-16: Segmentation and Filtering Management;92
8.5.3.9;4.5.3.9 OSP-17: Malware Protection Management;93
8.5.4;4.5.2 Access and Environmental Control;94
8.5.4.1;4.5.4.1 OSP-11: Access Control;94
8.5.4.2;4.5.4.2 OSP-12: User Registration;96
8.5.4.3;4.5.4.3 OSP-14: Physical Environment Protection Management;97
8.5.5;4.5.5 Availability Control;97
8.5.5.1;4.5.5.1 OSP-10: Backup Management;98
8.5.5.2;4.5.5.2 OSP-15: Operations Continuity Management;99
8.5.5.3;4.5.5.3 OSP-26: Enhanced Reliability and Availability Management;100
8.5.5.4;4.5.5.4 OSP-27: Archiving Management;101
8.5.6;4.5.6 Testing and Auditing;102
8.5.6.1;4.5.6.1 OSP-19: Internal Technical Audit;102
8.5.6.2;4.5.6.2 OSP-20: Incident Emulation;104
8.5.6.3;4.5.6.3 OSP-21: Information Quality and Compliance Assessment;105
8.5.7;4.5.7 Monitoring;106
8.5.7.1;4.5.7.1 OSP-22: Alerts Monitoring;106
8.5.7.2;4.5.7.2 OSP-23: Internal Events Detection and Analysis;107
8.5.7.3;4.5.7.3 OSP-28: External Events Detection and Analysis;108
8.5.8;4.5.8 Incident Handling;109
8.5.8.1;4.5.8.1 OSP-24: Handing of Incidents and Near-incidents;109
8.5.8.2;4.5.8.2 OSP-25: Forensics;110
9;Chapter 5 Outsourcing;112
9.1;5.1 Introduction;112
9.2;5.2 Service Level Agreements;112
9.3;5.3 Guidelines;114
10;Chapter 6 Implementing ISM3;118
10.1;6.1 Top-down or bottom-up;118
10.2;6.2 No one solution fits all;118
10.3;6.3 Selecting the processes to implement;118
10.4;6.4 Processes fundamental to any ISM3 implementation;119
10.5;6.5 Guidance on the role of key groups of ISM3 processes;120
10.6;6.6 Top-down implementation;121
10.7;6.7 Bottom-up implementation;122
10.8;6.8 Examples of ISM3 maturity levels;123
10.8.1;6.8.1 General;124
10.8.2;6.8.2 Strategic Management;124
10.8.3;6.8.3 Tactical Management;124
10.8.4;6.8.4 Operational Management;125
11;Appendix A Index of processes;128
12;Appendix B Terms and definitions;130
13;Appendix C ISM3 and ISO/IEC 27000;136
14;Glossary;140
15;Index;152