Advisory services
Consultations
Network and technology policies
Network and technology service docs
Using Jisc community

Network and technology service docs
Domain name registration
How to sign up
Janet Support Manual
Janet CSIRT
Back-up services
eduroam
Backup Web Hosting
Certificate Service
Connection timeline
Eligibility
Janet 3G Buyer's Guide
Janet 3G eduroam interoperablity authentication methods
Janet Mail Services
Janet Network Charges
Janet Reach
Janet Videoconferencing Feedback results
Primary connections
Supporting Business Continuity
Business and Community Engagement (BCE) using Janet
Cost
Interconnect connections
Connecting student accommodation
Customer-owned routing equipment
Obtaining a Janet IP Address Range
Terms for the Provision of the Janet Service
Upgrading your existing bandwidth and Janet router
Fault reporting
IP address assignment
Janet Aurora
Janet Netsight
Janet txt
Routers
Network set-up
Guest access
Network time service
Training
Contact
Primary Nameserver Service
Secondary Nameserver Service
Vscene

Janet CSIRT
About CSIRT
Technical advice
Reporting abuse
Security advice

Security advice
Backups
Computers and the Law
Copyright infringement notices
Dealing with Computer Crime
Effective incident response
Host infected with malware
ISO Information Security Standards
Introduction to Firewalls
Logging network activity
Malware
Passwords: Threats and Counter-Measures
Penetration Testing
Port and address scanning
Protecting Sensitive Information: Workshop Report
System Administrators Charter
The Janet security contact
Unusual traffic
Using passwords
Vulnerable service
Security matters - technical guide

ISO Information Security Standards

The International Standards Organisation (ISO) maintains a number of different standards in the area of Information Security. Although the standards are not written to directly address the information security issues of research and education organisations they are nonetheless a useful source of information about good practice. External bodies concerned about information security (for example organisations sharing commercially sensitive or personal data, and regulators) often express requirements or questions in terms of the ISO standards.

Research and education organisations are therefore advised to at least be familiar with how their information security activities relate to the standards (the UCISA Information Security Toolkit may be helpful here); some may choose to base their activities around the standards or, perhaps, to seek certification of their Information Security Management System (ISMS) against ISO/IEC 27001:2005. Certification demonstrates that an independent third party has examined the organisation’s ISMS and verified that it conforms to the standard. Certification by an assessor accredited by the relevant national body (e.g. the UK Accreditation Service) may be a requirement of some grants or information sharing agreements.

This factsheet introduces the main ISO standards likely to be relevant to research and education organisations. The standards are available for purchase in both paper and electronic form from ISO or the British Standards Institute (BSI); some libraries have site licences covering ISO or BSI products. The standards are reviewed approximately every five years: revised versions of ISO27001 and ISO27002 are expected to be published in October 2013.

ISO27001 “Information security management systems – Requirements” is the core standard defining what ISO considers that an Information Security Management System (ISMS) should contain. The standard specifies a cyclic process of four steps:

Plan: define the scope of the ISMS, identify information assets and assess risks to their security, select controls to address these risks and obtain management authorisation to implement them;
Do: implement controls to manage the significant risks, including awareness and training programmes and incident detection and response processes;
Check: measure the effect of those controls and review whether the risks have changed;
Act: make necessary changes to the controls, the risk assessment process or the ISMS;
repeat.

An ISMS can be audited against this standard and certified as meeting its requirements.

Other standards in the ISO27xxx series provide assistance with particular aspects of an Information Security Management System. These include:

ISO27002 “Code of practice for information security management” is a comprehensive list of areas in which information security risks are likely to arise, for example if responsibilities for security are not included in job descriptions, if computers are not secure against physical or network attack or if the organisation does not have an incident response plan. For each risk the standard suggests controls that may be appropriate to address it. The standard can be used on its own, to highlight areas of risk that the organisation may not have considered, but is best used as input to the risk assessment stage in an ISO27001 ISMS. All risks in ISO27002 should be considered, but it is perfectly acceptable for a risk assessment process to conclude that some of them are currently too low to require or justify treatment measures, or that the organisation’s environment requires that different controls to address them.

ISO27011 “Information security management guidelines for telecommunications organizations” supplements ISO27002 by providing a list of information security risks particularly likely to arise in the telecommunications sector. Guidance on the use of cloud computing services is being developed as ISO27017 and 27018.

ISO27005 “Information security risk management” discusses how to perform the risk assessment/management process. An alternative approach is described by the US Government’s Risk Management Guide for information technology systems (Special Publication 800-30).

ISO27035 “Information security incident management” describes an approach to managing information security incidents. An alternative approach is described by the US Government’s Computer Security Incident Handling Guide (Special Publication 800-61)

ISO27000 provides an overview and standard vocabulary for information security.