YASS (Yet Another Security Standard)
By Davey Winder in Editorial
Posted in Security on
News has just reached me that the Information Security Forum (ISF) has just launched the 2007 version of its international Standard of Good Practise for Information Security to help companies implement good practise in information security and mitigate information risks.
As someone who earns at least part of his living writing about security best practise, I am all in favour of anything that can help companies get it right in the face of increasingly complex legislative and corporate governance requirements. I am also all too well aware that it can be something of a deep pockets minefield with organisations charging an arm, leg and three quarters of your bottom just to get your hands on their ’standard’ documentation. Which is why I was pleased to see that the ISF has made its Standard of Good Practise documentation freely available for download.
Kim Aarenstrup, Chairman of the ISF and Group Head of Information Security at the A.P. Moller - Maersk Group explains that “our aim is to raise awareness of information security and improve policies, standards and procedures; and to help organisations undertake risk analysis, develop best practise controls and measure their effectiveness.”
Cool. We can all applaud that then.
The ISF standard draws on the practical experiences of over 300 leading international organisations including many of the Fortune 100 companies, and reflects the latest thinking on information security through workshops, face-to-face meetings and interviews, as well as the results of the ISF’s in-depth research and its comprehensive information security benchmarking tool - the Information Security Status Survey. It also has the benefit of a decade of previous versions bringing a certain maturity to the table which is essential when talking about best practise in any field, but doubly so with security.
Split into six key areas, the Standard provides key objectives and a clear overview of the practical measures and activities that need to be carried out to keep information risks under control. The key areas being:
security management
critical business applications
computer installations
networks
systems development
end user environment
But why should you bother, especially if you are already up to your eyeballs in Sarbanes-Oxley, PCI/DSS and the EU Directive on Data Protection while trying to meet ISO/IEC 27002 or COBIT v4.1? Simple, because if you comply with the ISF Standard the chances are that you will find complying with everything else a damn site easier. That’s what following best practise does
Not yet rated
Loading ...Make a comment
Tag cloud
Archives
- June 2010
- May 2010
- April 2010
- March 2010
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
- August 2006
Most commented posts
- 80 percent of viruses love Windows 7
165 comments
- Has Microsoft gone mental?
- Has the US Army declared war on Windows 7?
- Cuil frozen out: market share drops to next to nothing
- Xbox 360 FAIL
- The 24GB RAM Desktop is born
- Use old version of Windows instead of Linux, says teacher
- Microsoft reveals time-based licensing model
- How Marblecake Hacked Time
- Nexus Two - The Next Generation
Highest Rated Blog Posts
- Why ecommerce fails (100%)
- Google Chrome stands alone at PWN2OWN (100%)
- Betting on Hubdub technology (100%)
- Has Google gone insane as GMail goes back to beta? (100%)
- Chinese whispers as government implicated in UK hack attacks (100%)
- Crimeware toolkit targets 10,000 trusted sites (100%)
- Black Hat risk to migrating VMs (100%)
- Tough on cyber crime, tough on the causes of cyber crime (100%)
- Firefox 3, Beta 4, Enhancements 900, Tested 5 (100%)
- Has the US Army declared war on Windows 7? (100%)
