Beruflich Dokumente
Kultur Dokumente
techniques to minimize the number of successful cyber security attacks. These guides provide general
outlines as well as specific techniques for implementing cyber security. For certain specific
standards, cyber security certification by an accredited body can be obtained. There are many
advantages to obtaining certification including the ability to get cyber security insurance.
History
Cyber security standards have been created recently because sensitive information is now frequently
stored on computers that are attached to the Internet. Also many tasks that were once done by hand are
carried out by computer; therefore there is a need for Information Assurance (IA) and security. Cyber
security is important in order to guard against identity theft. Businesses also have a need for cyber
security because they need to protect their trade secrets, proprietary information, and personally
identifiable information (PII) of their customers or employees. The government also has the need to
secure its information. This is particularly critical since some terrorism acts are organized and facilitated
by using the Internet.(citation needed) One of the most widely used security standards today is ISO/IEC
27002 which started in 1995. This standard consists of two basic parts. BS 7799 part 1 and BS 7799 part
2 both of which were created by (British Standards Institute) BSI. Recently this standard has become ISO
27001. The National Institute of Standards and Technology (NIST) has released several special
publications addressing cyber security. Three of these special papers are very relevant to cyber security:
the 800-12 titled “Computer Security Handbook;” 800-14 titled “Generally Accepted Principles and
Practices for Securing Information Technology;” and the 800-26 titled “Security Self-Assessment Guide
for Information Technology Systems”. The International Society of Automation (ISA) developed cyber
security standards for industrial automation control systems (IACS) that are broadly applicable across
manufacturing industries. The series of ISA industrial cyber security standards are known as ISA-99 and
are being expanded to address new areas of concern.
ISO 27002
Main article: ISO/IEC 27002
ISO 27002 incorporates both parts of the BS 7799 standard. Sometimes ISO/IEC 27002 is referred to
as BS 7799 part 1 and sometimes it refers to part 1 and part 2. BS 7799 part 1 provides an outline for
cyber security policy; whereas BS 7799 part 2 provides a certification. The outline is a high level guide to
cyber security. It is most beneficial for an organization to obtain a certification to be recognized as
compliant with the standard. The certification once obtained lasts three years and is periodically checked
by the BSI to ensure an organization continues to be compliant throughout that three year period. ISO
27001 (ISMS) replaces BS 7799 part 2, but since it is backward compatible any organization working
toward BS 7799part 2 can easily transition to the ISO 27001 certification process. There is also a
transitional audit available to make it easier once an organization is BS 7799 part 2-certified for the
organization to become ISO 27001-certified. ISO/IEC 27002 states that information security is
characterized by integrity, confidentiality, and availability. The ISO/IEC 27002 standard is arranged into
eleven control areas; security policy, organizing information security, asset management, human
resources security, physical and environmental security, communication and operations, access controls,
information systems acquisition/development/maintenance, incident handling, business continuity
management, compliance
In the 1990s, the Information Security Forum (ISF) published a comprehensive list of best practices for
information security, published as the Standard of Good Practice (SoGP). The ISF continues to update
the SoGP every two years; the latest version was published in February 2007.
Originally the Standard of Good Practice was a private document available only to ISF members, but the
ISF has since made the full document available to the general public at no cost.
Among other programs, the ISF offers its member organizations a comprehensive benchmarking program
based on the SoGP.
[edit]NERC
The North American Electric Reliability Corporation (NERC) has created many standards. The most
widely recognized is NERC 1300 which is a modification/update of NERC 1200. The newest version of
NERC 1300 is called CIP-002-1 through CIP-009-2 (CIP=Critical Infrastructure Protection). These
standards are used to secure bulk electric systems although NERC has created standards within other
areas. The bulk electric system standards also provide network security administration while still
supporting best practice industry processes. [2]
[edit]NIST
1. Special publication 800-12 provides a broad overview of computer security and control
areas. It also emphasizes the importance of the security controls and ways to implement them.
Initially this document was aimed at the federal government although most practices in this
document can be applied to the private sector as well. Specifically it was written for those people
in the federal government responsible for handling sensitive systems. [3]
2. Special publication 800-14 describes common security principles that are used. It
provides a high level description of what should be incorporated within a computer security
policy. It describes what can be done to improve existing security as well as how to develop a
new security practice. Eight principles and fourteen practices are described within this
document. [4]
3. Special publication 800-26 provides advice on how to manage IT security. This document
emphasizes the importance of self assessments as well as risk assessments. [5]
4. Special publication 800-37, updated in 2010 provides a new risk approach: "Guide for
Applying the Risk Management Framework to Federal Information Systems"
5. Special publication 800-53 "Guide for Assessing the Security Controls in Federal
Information Systems" specifically addresses the 174 security controls that be applied to a system
to make it "more secure."
ISO 15408
Main article: Common Criteria
This standard develops what is called the “Common Criteria”. It allows many different software
applications to be integrated and tested in a secure way.
RFC 2196
RFC 2196 is memorandum published by Internet Engineering Task Force for developing security policies
and procedures for information systems connected on the Internet. The RFC 2196 provides a general and
broad overview of information security including network security, incident response or security policies.
The document is very practical and focusing on day-to-day operations.
ISA-99
ISA99 is the Industrial Automation and Control System Security Committee of the Instrumentation,
Systems, and Automation Society (ISA). The committee is developing a multi-part control system
standard and has released several standards and technical reports.