Open Information Security Management Maturity Model O-ISM3 (eBook)

Preface 10
Trademarks 13
Acknowledgements 14
Referenced documents 15
Chapter 1 Introduction 20
1.1 Positioning security management 20
1.2 Key characteristics of ISM3 21
1.3 Potential for certification 23
1.4 Summary 24
Chapter 2 Concepts – processes, capability, and maturity 26
2.1 Defining the key terms 26
2.1.1 Tying these key terms together 26
2.2 Capability levels 27
2.3 Maturity levels 27
2.3.1 Maturity levels and RoI 28
2.4 Processes 29
2.4.1 Levels 29
2.4.1.1 Generic Processes 29
2.4.1.2 Strategic-Specific Processes 30
2.4.1.3 Tactical-Specific Processes 30
2.4.1.4 Operational-Specific Processes 31
2.4.2 Selecting your set of processes 31
2.4.3 Process definition 32
2.4.4 Process roles and responsibilities 34
2.4.5 Process metrics definition 38
2.4.6 Process metrics specification 39
2.4.7 Process metrics operational use 42
Chapter 3 ISM3 in a business context 46
3.1 Business context 46
3.2 Security-in-context model 47
3.3 Operational approach 48
3.4 Operational definitions 48
3.5 ISM3 definition – security-in-context 49
3.6 Business objectives, security objectives, and securitytargets 49
3.6.1 Business objectives 49
3.6.2 Security objectives 50
3.6.3 Security targets 52
3.6.4 Examples 52
3.7 ISM3 interpretation of incidents, success, and failure 59
Chapter 4 ISM3 process model 62
4.1 Security management – ISM3 basics 62
4.2 Generic Processes 65
4.2.1 GP-1: Knowledge Management 65
4.2.2 GP-2: ISMS and Business Audit 67
4.2.3 Implementing ISM3 68
4.2.3.1 GP3 - ISM Design and Evolution 68
4.3 Specific processes – strategic management 70
4.3.1 SSP-1: Report to Stakeholders 70
4.3.2 SSP-2: Coordination 71
4.3.3 SSP-4: Define Division of Duties Rules 72
4.3.4 SSP-6: Allocate Resources for Information Security 73
4.4 Specific processes – tactical management 73
4.4.1 TSP-1: Report to Strategic Management 73
4.4.2 TSP-2: Manage Allocated Resources 74
4.4.3 TSP-3: Define Security Targets and Security Objective 75
4.4.4 TSP-4: Service Level Management 76
4.4.5 TSP-6: Security Architecture 77
4.4.6 TSP-13: Insurance Management 78
4.4.7 Personnel Security 78
4.4.7.1 TSP-7: Background Checks 78
4.4.7.2 TSP-8: Personnel Security 79
4.4.7.3 TSP-9: Security Personnel Training 80
4.4.7.4 TSP-10: Disciplinary Process 80
4.4.7.5 TSP-11: Security Awareness 81
4.4.8 TSP-14: Information Operations 82
4.5 Specific processes – operational management 83
4.5.1 OSP-1: Report to Tactical Management 83
4.5.2 OSP-2: Security Procurement 84
4.5.3 Lifecycle Control 84
4.5.3.1 OSP-3: Inventory Management 85
4.5.3.2 OSP-4: Information Systems IT Managed Domain Change Control 86
4.5.3.3 OSP-5: IT Managed Domain Patching 87
4.5.3.4 OSP-6: IT Managed Domain Clearing 88
4.5.3.5 OSP-7: IT Managed Domain Hardening 89
4.5.3.6 OSP-8: Software Development Lifecycle Control 90
4.5.3.7 OSP-9: Security Measures Change Control 91
4.5.3.8 OSP-16: Segmentation and Filtering Management 92
4.5.3.9 OSP-17: Malware Protection Management 93
4.5.2 Access and Environmental Control 94
4.5.4.1 OSP-11: Access Control 94
4.5.4.2 OSP-12: User Registration 96
4.5.4.3 OSP-14: Physical Environment Protection Management 97
4.5.5 Availability Control 97
4.5.5.1 OSP-10: Backup Management 98
4.5.5.2 OSP-15: Operations Continuity Management 99
4.5.5.3 OSP-26: Enhanced Reliability and Availability Management 100
4.5.5.4 OSP-27: Archiving Management 101
4.5.6 Testing and Auditing 102
4.5.6.1 OSP-19: Internal Technical Audit 102
4.5.6.2 OSP-20: Incident Emulation 104
4.5.6.3 OSP-21: Information Quality and Compliance Assessment 105
4.5.7 Monitoring 106
4.5.7.1 OSP-22: Alerts Monitoring 106
4.5.7.2 OSP-23: Internal Events Detection and Analysis 107
4.5.7.3 OSP-28: External Events Detection and Analysis 108
4.5.8 Incident Handling 109
4.5.8.1 OSP-24: Handing of Incidents and Near-incidents 109
4.5.8.2 OSP-25: Forensics 110
Chapter 5 Outsourcing 112
5.1 Introduction 112
5.2 Service Level Agreements 112
5.3 Guidelines 114
Chapter 6 Implementing ISM3 118
6.1 Top-down or bottom-up 118
6.2 No one solution fits all 118
6.3 Selecting the processes to implement 118
6.4 Processes fundamental to any ISM3 implementation 119
6.5 Guidance on the role of key groups of ISM3 processes 120
6.6 Top-down implementation 121
6.7 Bottom-up implementation 122
6.8 Examples of ISM3 maturity levels 123
6.8.1 General 124
6.8.2 Strategic Management 124
6.8.3 Tactical Management 124
6.8.4 Operational Management 125
Appendix A Index of processes 128
Appendix B Terms and definitions 130
Appendix C ISM3 and ISO/IEC 27000 136
Glossary 140
Index 152