UCISA Information Security Management Toolkit
Total Page:16
File Type:pdf, Size:1020Kb
UCISA Information Security Management Toolkit Edition 1.0 Volume 1 UCISA UCISA is the Universities and Colleges Information Systems Association. UCISA is a membership organisation representing almost all the higher education institutions in the UK. It exists to promote best practice and to act as a representative and lobbying body. Copyright This publication is licensed under the Creative Commons Attribution-NonCommercial 4.0 International licence. Subject to the source being appropriately acknowledged and the licence terms preserved, it may be copied in whole or in part and incorporated into another document or shared as part of information given, except for use for commercial gain. The publication also contains resources from institutions; where this material is copied or otherwise reused, both UCISA and the institution concerned should be acknowledged. Disclaimer The information contained herein is believed to be correct at the time of issue, but no liability can be accepted for any inaccuracies. The reader is reminded that changes may have taken place since issue, particularly in rapidly changing areas, such as internet addressing, and consequently URLs and email addresses should be used with caution. UCISA cannot accept any responsibility for any loss or damage resulting from the use of the material contained herein. Availability The UCISA Information Security Management Toolkit is freely available to download for non-commercial use from www.ucisa.ac.uk/ismt Further printed copies of this document may be obtained from UCISA. I am very pleased to present the UCISA Information Security Management Toolkit, a new resource that has been created from within our community in order to offer guidance and advice on information security management (ISM); to enable colleagues from across the sector to demonstrate locally why ISM is important and to help universities and colleges implement their own information security management systems. I consider this publication to be a significant addition to the suite of materials that UCISA provides to the sector, and I hope that you find it useful within your institution. John Cartwright, Director of Computing Services, University of Liverpool UCISA Chair Cyber security is an increasingly business critical issue for universities. Universities operate on the trust of students, staff and partners to manage information safely and securely. Furthermore, universities produce research of great value which can be a target for a variety of economic and political reasons. The UCISA Information Security Management Toolkit is an important guide for security practitioners working toward implementing proportionate risk based controls in complex institutions. Paul Clark, Director of Policy, Universities UK Contents Introduction 11 The structure of this document 12 Definitions and standards 12 Route map for using the UCISA Information Security Management Toolkit 13 Resources 14 Reading list 14 1 What is information security 15 1.1 The purpose of information security 15 1.2 Context 15 1.3 Legal and contractual requirements 16 1.4 What is information security management? 16 Summary 16 Resources 17 Reading list 17 2 Information security governance 19 2.1 What is information security governance? 19 2.2 What does information security governance look like? 19 2.3 Identifying stakeholders and interested parties 20 2.4 Oversight and audit 20 2.5 Identifying and securing adequate resources 20 2.6 Example governance structure 21 2.7 Selling an ISMS to top management 21 2.7.1 For all organisations 21 2.7.2 For research intensive organisations 22 2.7.3 Preparing a briefing 22 2.7.4 Preparing a business case 22 Summary 23 Resources 23 Reading list 23 3 Drivers 25 3.1 Overview 25 3.2 Identifying drivers 25 3.3 Identifying requirements 27 3.4 Continual monitoring of drivers 27 Summary 27 Resources 28 Reading list 28 4 Scoping 29 4.1 Introduction 29 4.2 Different scopes 29 4.3 How to define the scope of an ISMS 30 4.3.1 Identify what needs to be protected 30 4.3.2 Understand the organisation 30 4.3.3 Ensure endorsement of scope 30 4.3.4 Monitor and review 30 4.4 Outsourcing and third parties 31 4.4.1 Scoping considerations for cloud and outsourcing services 31 4.4.2 Scope and third party contracts 31 4.4.3 Questions when outsourcing IT or using a cloud provider 32 4.4.4 Example: third parties and PCI DSS 32 4.4.5 Example: outsourced scope in an HE environment 32 Summary 33 Resources 34 Reading list 34 5 Risk assessment 35 5.1 Information risk management 35 5.2 Define information risk measurement criteria 36 5.3 Information asset identification and profiling 36 5.4 Threat identification and assessment 37 5.5 Identify and assess vulnerabilities 37 5.6 Scoring information risk impact assessment 37 5.6.1 Quantitative vs. qualitative information risk assessment 37 5.7 Process 38 5.8 Information risk treatment 38 5.9 Information risk register 39 Summary 39 Resources 40 Reading list 40 6 Controls 41 6.1 What is a control? 41 6.2 Types of controls 41 6.3 Control sets 42 6.3.1 A note on the ISO/IEC 27001 Statement of Applicability 42 6.4 Implementing controls 42 6.5 Assessing and managing change 43 6.6 Documenting controls 43 Summary 44 Resources 44 Reading list 44 7 Information management 45 7.1 What is an information management scheme? 45 7.2 Classification 46 7.3 How many levels? 46 7.3.1 A note on special cases 46 7.3.2 Naming the classifications 47 7.4 Labelling 47 7.5 Handling 47 7.6 Example handling scheme 48 7.7 Documenting the scheme 48 7.7.1 Asset inventories 49 7.7.2 The information management policy and process 49 7.8 Information management as part of an organisation’s ISMS 49 Summary 49 Resources 50 Reading list 50 8 Roles and competencies 51 8.1 Who does information security? 51 8.2 Top management – decision makers 52 8.2.1 Competencies of top management 52 8.3 Asset owners 52 8.3.1 Competencies of asset owners 53 8.4 Dedicated information security roles 53 8.4.1 Competencies of information security professionals 54 8.4.2 Competencies of legal and compliance professionals 54 8.5 Other roles 54 8.5.1 Competencies of research leads 55 8.5.2 Competencies of contractors and third party organisations 55 8.5.3 Competencies of administrators 55 8.5.4 Competencies of all staff 55 8.6 Students 56 8.6.1 Competencies of students 56 Summary 56 Resources 56 Reading list 56 9 Awareness raising 57 9.1 Introduction 57 9.2 Awareness, education and training 57 9.3 Triggers for awareness activities 58 9.4 Foundations of an awareness programme 58 9.5 Identifying channels for an awareness programme 59 9.6 Identifying content for an awareness activity 59 9.7 Arguments for different audiences 60 9.8 Challenges 60 9.9 Evaluating the response 61 9.10 Evaluating the awareness programme 61 Summary 62 Resources 62 Reading list 62 10 Measurement 63 10.1 Why measure? 63 10.2 What is a useful measurement? 63 10.3 How to design a useful measurement 64 10.3.1 Designing measurements of ISMS processes and controls 64 10.3.2 Designing measurements of threat 64 10.4 Evaluating a measurement 64 10.5 How to use measurements 64 10.6 Reporting and interpretation 65 10.7 Examples of effective measurements 65 10.7.1 Measurements of information risk 65 10.7.2 Measurements of ISMS effectiveness 65 10.7.3 Measurements of control effectiveness 66 10.7.3.1 Types of incidents 66 10.7.3.2 Successful attacks vs attempted attacks 66 10.7.3.3 Measuring time to patch 66 10.7.4 Measurements which are controls 66 10.8 Examples of measurements which may be less helpful 66 10.8.1 Level of information security 66 10.8.2 Number of incidents handled 67 Summary 67 Resources 68 Reading list 68 11 When things go wrong: nonconformities and incidents 69 11.1 Introduction 69 11.2 Nonconformities 70 11.2.1 Identifying nonconformities 70 11.2.2 Dealing with nonconformities 70 11.3 Information security incidents 70 11.3.1 The incident response policy and plan 71 11.3.2 Responsibilities and authorities 71 11.3.3 Stages in incident response 71 11.3.4 Review 72 Summary 72 Resources 72 Reading list 72 12 Continual improvement 73 12.1 What is continual improvement? 73 12.2 Processes for improvement 73 12.3 Types of improvement 74 12.4 Steps in an improvement process 75 12.5 Sources of information and opportunities for improvement 75 12.6 Improvement as part of ISMS formalisation 77 12.6.1 Vision for improvement 77 12.6.2 Where are we now? 77 12.6.3 Planning and implementing (where do you want to be and how to get there) 77 12.7 Measurement 78 Summary 78 Resources 78 Reading list 78 13 Policies 79 Summary 79 Resources 80 Reading list 80 14 Conclusion 81 Overall summary 81 Annex – Example resources to accompany the Toolkit 85 Resources for Introduction 87 Different elements of an Information Security Management System – Cardiff University 88 Stages for implementing an Information Security Framework (ISF) programme – Cardiff University 89 Resources for Chapter 1 – What is information security? 91 Template for an information security strategy proposal 92 Resources for Chapter 2 – Information security governance 95 Template for an information security policy 96 Responsibilities overview: Information ownership and risk management – Cardiff University 97 Developing an information security policy – University of York, case study 98 Bringing information security strategy to senior management – UCL, case study 99 Key questions for top management 101 Example of a presentation to sell the concept of an ISMS to top management 104 Resources for Chapter 3 – Drivers 107 Incidental security improvements