ISO 27000 Series

The title firstly chosen forISO-27000-Series this post was: What areas does ISO 27001 and 27002 cover? corresponding to question 100 of our 300  infosec interview questions. But while working on this subject , I realized that I could  talk more with ISO 27000 series with more details for  27001 and 27002  .

Also Known as ISMS Family of Standards or ISO 27K for short, it  is published jointly by International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) ; hence the jointed name ISO/IEC 27000 Series. ISO 27000 series of standards have been specifically reserved by ISO for informations security matters.

The Series provide best practices recommendations on informations security management, risks  and controls within the context of an overall Informations Security Management Systems -ISMS , similar in design to to management systems for quality assurance (ISO 9000 Series) and environmental protection ( ISO 14000 Series).

The series is populated by a range of individuals standards and  documents . A number of theses have been published for others and others are scheduled for publication .

The following standards already published  reflects the current known position for the major operational standards in the series.

  • ISO 27001 : This is the specification for an information security management system-ISMS, which replaced the old BS7799-2 standard.The objective of the standard itself is to “provide requirements for establishing, implementing, maintaining and continuously improving an Information Security Management System (ISMS)”. Regarding its adoption, this should be a strategic decision. Further, “The design and implementation of an organization’s information security management system is influenced by the organization’s needs and objectives, security requirements, the organizational processes used and the size and structure of the organization”.

    The 2005 version of the standard heavily employed the PDCA, Plan-Do-Check-Act model to structure the processes, and reflect the principles set out in the OECG guidelines (see oecd.org). However, the latest, 2013 version, places more emphasis on measuring and evaluating how well an organisation’s ISMS is performing. A section on outsourcing was also added with this release, and additional attention was paid to the organisational context of information security.

    The content sections of the standard are:

    • Context Of The Organization
    • Information Security Leadership
    • Planning An ISMS
    • Support
    • Operation
    • Performance Evaluation
    • Improvement
    • Annex A – List of controls and their objectives

  • ISO 27002 : This is the 2700 series standard number of what was originally ISO 17799 standard , itself was formerly known as BS7799-1.The standard “established guidelines and general principles for initiating, implementing, maintaining, and improving information security management within an organization”. The actual controls listed in the standard are intended to address the specific requirements identified via a formal risk assessment. The standard is also intended to provide a guide for the development of “organizational security standards and effective security management practices and to help build confidence in inter-organizational activities”.

    The basis of the standard was originally a document published by the UK government, which became a standard ‘proper’ in 1995, when it was re-published by BSI as BS7799. In 2000 it was again re-published, this time by ISO ,as ISO 17799. A new version of this appeared in 2005, along with a new publication, ISO 27001. These two documents are intended to be used together, with one complimenting the other.

    In 2013 the current version was published. ISO 27002:2013 contains 114 controls, as opposed to the 133 documented within the 2005 version. However for additional granularity, these are presented in fourteen sections, rather than the original eleven.

    Finally, it should be noted that over the years a number of industry specific versions of ISO 27002 have been developed, or are under development, (for example: health sector, manufacturing, and so on).

    The content sections are:

    • Structure
    • Security Policy
    • Organization of Information Security
    • Human Resources Security
    • Asset Management
    • Access Control
    • Cryptography
    • Physical And Environmental Security
    • Operations security
    • Communications Security
    • Information Systems Acquisition, Development, Maintenance
    • Supplier Relationships
    • Information Security Incident management
    • Information Security Aspects of Business Continuity
    • Compliance

  • ISO 27003 : This will be the official number of a new standard intended to ffer guidance for the implementation of an ISMS – IS Management System
  • ISO 27004 : This standard covers information security system management measurement and metrics , including suggested ISO27002 aligned controls.
  • ISO 27005 : This is the methodology independent ISO standard for information security risk management.
  • ISO 27006: This standard provides guidelines for the accreditation of organizations offering ISMS certification.

For others 

  • ISO/IEC 27007 — Guidelines for information security management systems auditing (focused on the management system)
  • ISO/IEC TR 27008 — Guidance for auditors on ISMS controls (focused on the information security controls)
  • ISO/IEC 27010 — Information security management for inter-sector and inter-organizational communications
  • ISO/IEC 27011 — Information security management guidelines for telecommunications organizations based on ISO/IEC 27002
  • ISO/IEC 27013 — Guideline on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1
  • ISO/IEC 27014 — Information security governance.  Mahncke assessed this standard in the context of Australian e-health.
  • ISO/IEC TR 27015 — Information security management guidelines for financial services
  • ISO/IEC 27018 — Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
  • ISO/IEC 27031 — Guidelines for information and communication technology readiness for business continuity
  • ISO/IEC 27032 — Guideline for cybersecurity
  • ISO/IEC 27033-1 — Network security – Part 1: Overview and concepts
  • ISO/IEC 27033-2 — Network security – Part 2: Guidelines for the design and implementation of network security
  • ISO/IEC 27033-3 — Network security – Part 3: Reference networking scenarios – Threats, design techniques and control issues
  • ISO/IEC 27033-5 — Network security – Part 5: Securing communications across networks using Virtual Private Networks (VPNs)
  • ISO/IEC 27034-1 — Application security – Part 1: Guideline for application security
  • ISO/IEC 27035 — Information security incident management
  • ISO/IEC 27036-3 — Information security for supplier relationships – Part 3: Guidelines for information and communication technology supply chain security
  • ISO/IEC 27037 — Guidelines for identification, collection, acquisition and preservation of digital evidence
  • ISO 27799 — Information security management in health using ISO/IEC 27002. The purpose of ISO 27799 is to provide guidance to health organizations and other holders of personal health information on how to protect such information via implementation of ISO/IEC 27002.

Scheduled for publication:

  • ISO/IEC 27017 — Information security management for cloud systems
  • ISO/IEC 27019 — Information security management guidelines based on ISO/IEC 27002 for process control systems specific to the energy utility industry
  • ISO/IEC 27033 — IT network security, a multi-part standard based on ISO/IEC 18028:2006 (parts 1-3 are published already)
  • ISO/IEC 27036 — Guidelines for security in supplier relationships
  • ISO/IEC 27038 — Specification for redaction of digital documents
  • ISO/IEC 27039 — Intrusion detection and protection systems
  • ISO/IEC 27040 — Guideline on storage security
  • ISO/IEC 27041 — Assurance for digital evidence investigation methods
  • ISO/IEC 27042 — Analysis and interpretation of digital evidence
  • ISO/IEC 27043 — Digital evidence investigation principles and processes

src: http://www.27000.org

Securing Cisco Network with Threat Detection and Analyst – (SCYBER)

CyberSecurity Specialist
CyberSecurity Specialist

I would like to introduce you to the  Cisco Certification called SCYBER.

The Securing Cisco Networks with Threat Detection and Analysis (SCYBER) (600-199) is a 1.5-hour exam with 50−60 questions.

This exam is associated with the Cisco Cybersecurity Specialist certification. Candidates can prepare for this exam by taking the Interconnecting “Securing Cisco Networks with Threat Detection and Analysis”course.This exam tests a candidate’s knowledge and skills required to proactively detect and mitigate network security threats by leveraging features that exist in Cisco and other industry network security products today.

Designed for professional security analysts, the exam covers essential areas of competency including event monitoring, security event/alarm/traffic analysis, and incident response. The exam is closed book and no outside reference materials are allowed.

My experience with this certification is the following:

Some months ago ( February) after I passed my CompTia Security + Certification , I was looking for the  next certification to prepare.

My search leads me to CEH of EC-Council , GSEC of SANS Institute and Cybersecurity Essentials of Prometric. In the same time I received some Cisco ads  about their new SCYBER  Certification and that caught my attention.

To make my choice , I discarded CEH and GSEC because the sources materials for these certifications were scarse and not fully available on Pi****bay ;)!(shuuuuuut !!! I took almost all y sources materials on it ).

I started compare SCYBER and Cyber Security Essentials of Prometric , and for me this last looked like Security + Certification that I passed . Then I focused on SCYBER , but it was a new certification , that means no sources materrials available,  only in the training center !

I decided to come back to CEH. some months have passed and I started to see the new version V8 of the certification available, but my mind was always in the SCYBER  may be due to of lack of materials  to correctly setup my CEH Lab.., it was difficult for me to perform CEH Labs  ( I had 2 computers one Mac Book Air “11”, and an old Windows PC 32bits  😦  ,  not enough memory for different VMs Machine to setup  …and so on ) .

This is how the true CEH Lab looks like according to EC-Council.

Capture d’écran 2014-10-01 à 14.40.41

But I don’t give up , I keep trying my best by download and learn about Computer Forensic , Hacking , Cybersecurity … ( I have a 700 GB data  hard disk so I can always  do news things :)) .

Few week ago , after an interview I saw one Cisco Live conference gived by James Risler , the Topic was about Cisco Cyber Security Analyst Specialist Certification, that convince me to prepare SCYBER.

For me , it was not too difficult , besides I think that the SCYBER exam was  easy more  than the preparation I  made (may be I did too much  preparation ?!?!). I so  much appreciated all subjects I learned and experienced more  than the exam itself.  I just failed one question on 58  🙂 .

The official sources material it not yet available excepted some cisco presses . The official  preparation is given by a  cisco instructor led courses.

I used some Cisco presses , mainly  my own searchs among my 700 GB data of my hard disk ( Computer Forensic , Ethical Hacking , TCP/IP fundamental , TCPdumps , Wireshark , Incidence Response procedure , …) and some forum .

Capture d’écran 2014-10-01 à 17.49.57

Some subjects seems basic, but for example if you can not read the information contained in the TCP header , payload ..how can you investigate?

Even if  it’s Cisco certification , the subjects are not based on cisco technologies or products, but mainly on Cybersecurity in general like a neutral vendor certification can proceed .

And the winner is … 😉

Capture d’écran 2014-10-23 à 23.22.07

That’s what I can say about this certification I recommend you to watch this video if you want more details.