My ISSAP and ISSMP certificates were finally received today!
It is because the original delivery in February is missing and I forgot they didn’t come until late August this year, even though I passed the exams last year (2018/11/6 and 2018/11/14 respectively).
I can’t believe it that I should have forgotten this important thing:)
It’s about time to put them on my wall!!😄😄😄🏆🏆🏆
As a CISO, you decide to implement Information security management systems and to be certified as compliant with ISO 27001 standard, in which actions to address risks and opportunities are required. You realize this requirement is about risk management and start evaluating risk management frameworks to meet the requirement. To implement a risk management program, which of the following least meets the requirement?
A. NIST FARM Framework (Frame, Assess, Respond, and Monitor)
B. ISO 27002
C. ISO 27005
D. ISO 31000
ISO 27001: Information security management systems – Requirements
ISO 27002: Code of practice for information security controls
ISO 27001 is a set of requirements for an information security management system (ISMS). An organization must meet ISO 27001 requirements to be certified.
Risk management is required to meet clause 6.1, actions to address risks and opportunities. Clause 6.1.3, information security risk treatment, further specifies a list of security controls as Annex A that must be implemented.
ISO 27001 Annex A is directly derived from ISO 27002 that provides guidelines to implement them.
The following is a general problem-solving process:
Your company as a Taiwan-based public company decides to start the business of selling toys online and shipping globally. To penetrate the market in the US, your company set up a branch company in the United States. The governance model is centralized; only the decisions that must be compliant with local laws and regulations are delegated to the local branch. The local data retention policy of the US branch is different from the local laws and regulations. As a security professional for the local branch, which of the following is the best action?
A. Review the local data retention policy
B. Suggest the local branch follow the policy of headquarters
C. Request corrective actions to be compliant with the local laws and regulations
D. Revise the local policy to meet the requirements of the local laws and regulations
How to Unite Enterprise and Project Risk Management
IMO, information security is a specialized discipline or subdiscipline of risk management.
As a security professional, the following three posts are worth reading in terms of risk management:
Your company decides to start the business of selling toys online and shipping globally. The E-Commerce system that supports the new business will be developed in-house. The development decides to use the relational database as the data persistence solution for transactions. One team member is tasked to design the database. Which of the following is least likely to happen?
A. Assign one and only one primary key in each table
B. Keep the attributes related to the primary key and move unrelated ones to other tables
C. Use multiple attributes as the primary key in a relation
D. Avoid foreign key references the primary key in the master table to enforce integrity
Risk is the effect of uncertainty on objectives.
Source: ISO 31000
Before an organization is attempting to conduct risk analysis, what should they identify first?
A. Threat sources and threat events
B. Exploitable weaknesses/deficiencies
C. Impacts or consequences of concern and critical assets
D. Any of the above can go first
According to ISO 3100, risk assessment includes three steps, risk identification, risk analysis, and risk evaluation.
Risk analysis is the process to estimate the likelihood and impact of risk so that the risk level or exposure can be determined. BIA as a process to assess the business impact, it can be treated as part of the risk analysis when we are talking about risk management.
BIA is also one of the most crucial processes in the discipline of business continuity management. So, it depends on how you integrate the two disciplines, RM and BCM, to position BIA.
Threat modeling is highly related to software. However, it’s mentioned in Domain 1 of the CISSP exam outline and many people think it applies to other contexts as well.
Personally, I treat it as the specific risk management practice in the context of software solutions, including the environment they operate, say, servers and network.
Threat modeling includes identifying threats/risks, categorizing them using STRIDE, analyzing using DREAD, evaluating, and handling them. The threat modeling approach used by Microsoft is the most well-known. There are some other approaches.
In summary, the basic idea of risk management is simple and abstract, it should apply to different contexts which use an extended and specific risk management approach based on the general risk management framework.
The pair of ISO 31000 and ISO 27005 is a good example. The NIST FARM addressing risk at organization tier, mission/business process tier, and information system tier is another good example.