The largest hack happened to Yahoo in 2013; can you imagine the effects of 3 billion accounts being hacked? That is approximately 10 times the current U.S. population. The second biggest hack is the attack against Marriot, which affected 500 million accounts. The Marriott hack hits especially close to home for me because I use the hotel often and am a top-status traveler. The hackers not only have the personal information of 500 million accounts, but also several credit card numbers. Marriott has yet to acknowledge the issue or provide warning to customers to change their credit card numbers.
If you review this list of hacks, you’ll likely agree that the issue is something we should all be concerned about. Take Yahoo, for example. The company first had 3 billion accounts hacked and then another 500 million a year later. It appears that Yahoo’s IT security team couldn’t measure up to the hackers, or that top management didn’t provide the impetus and focus inside the organization. We believe there are numerous other hacks that aren’t making the news because they have happened to manufacturing and design organizations and aren’t affecting the general public.
Cybersecurity is important, but organizations need to implement information security as well. Information security is the larger issue that contains cybersecurity as one of its elements. See the diagram below, displaying information security and its relationship to cybersecurity.
This guidance makes it clear that implementing an IT guidance standard such as ISO 27001 is really not an option but a requirement for publicly traded companies.
In clause 6.2, ISO 27001 requires organizations to identify the information security objectives and develop plans to achieve them. Under clause 8.0—Operations, the standard requires the organization to implement the plans developed in clauses 6.1 and 6.2, conduct regular information security assessments (clause 8.2), and implement the information security risk treatment plan created, as required by clause 6.1.3.
Annex A of ISO 27001 is broken down into 14 areas of control categories, which collectively present 132 individual controls. The expectation is that each of the areas are considered and covered. If it is not, the reason why must be justified. The assessment, the risk treatment plan, and then the implementation must cover each of these areas. This is also where the National Institute of Standards and Technology (NIST) programs can integrate with ISO 27001. NIST is a nonregulatory agency of the U.S. Dept. of Commerce.
NIST’s Special Publication 800-53 provides a catalog of security controls for all U.S. federal information systems except those related to national security. The NIST standards are quickly becoming mandatory requirements in order for manufacturers to supply to the federal government. U.S. law specifies a minimum for information security requirements for information systems used by the federal government. This in turn refers to Special Publication 800-53 as the mandatory minimum controls that federal agencies must implement.
Clause 5.0 of ISO 27001 explains that top management is accountable for information security, and that the information security processes must be integrated into the organization’s business processes—in other words, the “process approach or the process map.” As expected, the objectives, the progress toward objectives, the effectiveness of the controls, and other metrics are reviewed during the management or business reviews that are led by top management. It is crucial that top management understand its important role in governing information security and cybersecurity.
An organization’s understanding of the risks related to information security and cybersecurity must start with company leadership. The U.S. Securities and Exchange Commission has made it very clear that if you are a publicly traded company, then you will need to develop policies and procedures that deal with cybersecurity risk. A good place to start is ISO 27001 with its well-defined requirements and process methodology. Additionally, ISO 27001 integrates well with the organization’s quality management system.
The company board needs to get involved and provide oversight and responsibilities to this effort. The U.S. Securities and Exchange Commission guidance has asked for a description of how the board administers the risk oversight. ISO 27001 requires both internal and external audits. Like the Sarbanes-Oxley Act, the system should be regularly tested by the assessors who test the process. Also, vulnerability and penetrating tests with hired external parties need to become regular practices for organizations. Organizations should not only be focusing on external parties but also focus on internal attacks and the general availability of information. That’s where ISO 27001 management systems can play a critical role.
Implementing ISO 27001 and getting a third-party certificate isn’t enough. Cybersecurity and information security require continual monitoring and upgrades of the organization’s defense. Technology is constantly changing and requires IT security teams to constantly update processes and technologies.
As a place to start, Omnex recommends that top management, along with the company’s board of directors, be provided with an executive overview of this issue. Join Quality Digest and Chad Kymal, Omnex’s founder and CTO, in the webinar, “Cyber-Insecurity? How to Secure Your System Against a Hack Attack—ISO/IEC 27001” to learn how to implement a robust cybersecurity and information security program. Register here.
Insightful read on the why and what of Information Security.. and the lack of it..