Solved

Design a network compliant with ISO 27001 ???

Posted on 2006-10-25
2
341 Views
Last Modified: 2010-04-11
Hi Experts,

I need to design a network with couple of servers with WAN, LAN, PSTN with compliant with ISO 27001.
What are the guide lines for this ?? Please pull me some resources.

Please advice !

Thanks a lot !
0
Comment
Question by:NetMaxtor
2 Comments
 
LVL 18

Accepted Solution

by:
PowerIT earned 500 total points
ID: 17802123
Hi,

ISO 27001 is about "Information Security Management Systems Requirements" (ISMS)
Then there is ISO 17799 which is the "Code of Practice for information security management". This is a best practice and will be renamed to ISO 27002 in the future.
Both originate from BS-7999.
27001 used to be part 2 and 27002 used to be part one.
A little confusing eh?
Let me clarify:
ISO 27001 is a process approach to implement the controls defined in ISO 17799 (27002).
So you will need both. The process is as following:
1) Define an information security policy
2) Define scope of the information security management system
3) Perform a security risk assessment
4) Manage the identified risk
5) Select controls to be implemented and applied (ISO 17799)
6) Prepare an SoA (a "statement of applicability")

You can buy the ISO standard documents here:
https://eshop.bsi-global.com/ProductListing.aspx?cat=InformationTechnology%2fInformationSecurity
But, don't try to take this to the letter and implement all.
For the auditors, you do not need to implement every control. You have to keep it pragmatic and look at your business.
And then be able to document why you have exceptions.
Also: start small. Implementing this is typically a 3 years project.
So start with the basic and a simple policy. Next year go further etc ...
Auditors understand this. They will start with the basics and request more advanced controls and process for the next year.
Keep it practical, no user or manager will read a policy of 300 pages ...

For a quick start, SANS has a free checklist here: http://www.sans.org/score/checklists/ISO_17799_2005.doc

Also see:
- http://www.iso27001security.com/
- http://www.17799.com/ (a discussion forum)

J.
0
 

Author Comment

by:NetMaxtor
ID: 17802152
Thanks a lot !
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Accessing SQL Server Instance from outside the network 29 140
Service Specific Account vs 'Administrator' 5 41
save browser passwords 11 70
Need extreme network security for home 16 83
This article outlines the process to identify and resolve account lockout in an Active Directory environment.
The next five years are sure to bring developments that are just astonishing, and we will continue to try to find the balance between connectivity and security. Here are five major technological developments from the last five years and some predict…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question