=>What ISO 17799 is and is not -- Information security is defined as the preservation of confidentiality, integrity, and availability. It is achieved by implementing controls, which may be policies, practices, procedures, organizational structures, or software functions. (ISO 17799). ISO 17799 offers guidelines for safeguarding information assets by providing a list of information security controls. The standard contains 127 controls from 10 areas, which are listed later in this paper. Controls can be designated as organization-level or application-level controls. Organization-level controls apply to the security perimeter in which an organization operates and are needed for effective web application security. Application-level controls apply to individual web applications. ISO 17799 suggests what security controls to include in a security program, but does not specify how to develop or administer them. It is not a technical standard, nor is it driven by specific technology. It does not provide a scoring mechanism or other methods for evaluation. However, it is said to be compatible with the Equipment Assurance Level (EAL) scoring of the Common Criteria, ISO 15408 (Bisson, St. Germain; Carlson, 2001). ISO 17799 recommends that the selection of controls an organization employs be determined by: a) a risk assessment, b) legal, statutory, regulatory, and contractual requirements, and c) an organization’s particular set of principles, objectives, and requirements for information processing. Although the standard places a very strong emphasis on the need for a risk assessment, it does not provide guidelines for conducting a risk assessment. However, COBRA is a software tool (unofficially) associated with ISO 17799 and is used to facilitate conducting risk assessments (C&A Security Risk Analysis Group, 2003). ISO 17799 also does not provide security guidelines for specific legislation. Instead, it provides guidelines on safeguarding organizational records, which may be required as evidence in legal proceedings.
Posted on: Tue, 24 Sep 2013 05:32:18 +0000
Trending Topics
Recently Viewed Topics
© 2015