Author: Ivan Stuer
Cybercrime is prevalent these days. By now, everyone should be aware of it. But why are so few sites resistant to DDoS attacks, for example? When do people realize that information security is a must? Usually when it’s too late. That’s why there are a number of laws and standards: to help people realize, for example, the importance of privacy. Also for the government.
As the author of this booklet says, it is quite feasible to fill a whole library on the subject. His goal is to give security consultants some tools for setting up an ISMS (Integrated Security Management System).
The booklet dates from 2015, so before the change in European privacy legislation to GDPR. Security consultants are replaced by Data Protection Officers, who will need even more specialized knowledge.
What remained?
The legislative framework of privacy makes a number of proposed actions from ISO 27001 and ISO 27002, on which it is based, mandatory. There is now more emphasis on securing the entirety of processes, rather than the components. Business continuity management is also becoming increasingly important as a framework on which information security can be hung within the ISMS. (See also the future version of The Business Continuity Institute’s Good Practice Guidelines, which is building on that topic.) It also seems that the ISMS under development should strive for an overarching integration of all security disciplines.
It’s also not a bad idea to look beyond one’s own field and see what other standards/frameworks like COSOS and COBIT have to offer. A good general knowledge of project management and other management disciplines is also recommended.
Towards the end of the booklet, the author focuses on the CLOUD and the services that can be used there. Then he provides a step-by-step plan for developing an information security policy.
Although some terms like ISMS, ITIL, and other light technical jargon are used, the booklet is suitable for non-ICT professionals. The booklet is thus enlightening for a prospective security consultant as it touches on some areas of focus that he/she will need to delve into.