So in this section we're going to look at something we've called the fundamental concepts and principles of information security. Now of course I appreciate that many people looking at this training may well have a security background already, maybe you've you've got a lot of experience or other certifications and so forth. And the idea of this section isn't to sort of repeat what you may already know or to reteach the same thing. The idea is is to make sure that we're all speaking the same language and in particular from an ISO perspective. So the idea of this section is to introduce the sort of terminology and meanings, if you like, that uh ISO 27001 contains so that as we go forward When we start talking about auditing a management system, we can all understand the meaning of different terminology. So what we're going to look at in this section is the concept of information assets and information security according to ISO 20. The three tenants of security that ISO 27001 speaks about, which is confidentiality, integrity and availability. And we'll also look at the risk terminology, things like vulnerabilities, threats and consequences and how all these relate to the topic of risk. We'll also have a look at security controls because as you know the standard has annex A with multiple controls and we'll talk about how those controls can be classified and thought of. And we'll also examine the topics of cybersecurity and information privacy because you'll have noticed in the title of the standard it does refer to both cybersecurity and privacy and information privacy. So what do those things mean and how do they fit into the ISO information security concept? So let's start with information and asset then because one thing that ISO 27001 says is that we're trying to protect our information assets. So we can get the official definition of these two words from ISO 9000, basically a quality management series of standards, and ISO 55000, which is the asset management series of standards. So I think most of us would accept hopefully that information is meaningful data, that is to say data that we can do something with. So if I've got a customer database. containing customer records, you know, names, addresses, order histories, etc. That has some meaning, some use and some purpose. And an asset, we we typically say an asset is something that has value Now when I say value, that might be a financial value, something you can sell an asset for, for example, but it can also mean value in terms of usefulness and service to the organization. And most people, I would imagine, if I asked them what an asset was, would probably think of something tangible, you know, a c a computer, a building, some equipment, etc. And they'd be correct But also assets can be intangible. So actually the people who work for your organization are assets and ideas and intellectual property and of course information And even if I can't sell information for a you know a dollar, euro uh fee, so to speak, it still has uh a value to the organisation, hence the term asset So ultimately an ISMS based on ISO 27001 is about identifying those assets, those pieces of information, those you know, uh data sets, etc. , working out how valuable they are, and then essentially protecting them accordingly Now when we think about information assets and we think about running an information security management system, there are some other terms that we just need to be familiar with. The concept of document specifications and records. Now of course it might sound a little bit odd to uh tell you what a document is, I'm sure many people can imagine that, but there is a general saying which is a document is the information and the medium upon which it's contained. So yes, you could be thinking about a traditional Microsoft Word document here, but equally a confluence or a wiki page with information that we follow would also, in ISO speak, be considered to be a document. And of course some of the documents that we create or use in an ISMS will state very clear requirements. You know, maybe I've got a document that states things like secure coding standards requirements. for example or a document that says how a network device should be configured. And we would call that in ISO terminology a specification. And when an organization runs an ISMS and follows the requirements laid out in some of these documents. then essentially they end up generating records. So let's say for example you're running an ISMS and you have a process for reporting information security incidents. And let's imagine somebody follows it and they report an incident through whatever reporting channel. Of course then there'd be a record, there'd be some evidence that that process has been used. If you had a specification about how backups should be done and those backups run, of course there'd be logs generated, those logs would be records because they would serve as evidence that that activity is taking place. And records are very important in an ISMS, not just because the server's an audit trail, which is important. uh and certainly as auditors we'll be looking at records but also the fact is that records can be in their own right sensitive and need a certain level of protection. So an ISMS will concern itself with protecting documents specifically. and records. So it probably makes sense at this point to answer the question, what is information security? But more importantly, what is information security according to ISO 27000? And we have the uh the definition here which says Information security is the preservation of confidentiality, integrity and availability of information. And I'll come to that. And explore that in a little bit more depth in just a moment. Now the other thing that we we we say or ISO says about this is that information security is about determining what information needs to be protected. how it should be protected and from what. Now that would imply when you read that that that means that when we set up an ISMS we'll need to identify the kind of information we have. Trying to protect. And we'd need to do some kind of study or research into the potential risks that that information faces. So in other words, when we implement an ISMS, if I had two organizations implementing an ISMS They may protect their information very differently depending on the type of information we're speaking about and the type of risks they face. So the standard is flexible enough so you tailor your controls as needed. Now the other thing that's important in the definition about information security is the fact that it covers information in all formats. Now this is interesting. A little bit later in the section we're going to talk about this concept called cybersecurity. And certainly what I've noticed over the last few years when you look at job descriptions and you know, what a lot of people talk about. You hear a lot about cyber. And cyber of course is focusing very much on the technology aspects, you know, protecting the technical systems that will store and process information. And of course that makes sense because the vast majority of information today is indeed processed electronically. But it's not all processed electronically. It is still possible to have information in paper format, in video format, in spoken word, etc. So information security concerns itself with protecting that information regardless of format. And maybe a very quick example I could give. I recall having a train journey where on that particular train there was a solicitor from a law firm having a conversation with a client. uh quite openly for the entire carriage on the train to hear and s in and discussing some quite sensitive topics. It was actually discussing a divorce case with a client uh and basically pretty much with the phone on loudspeaker uh to you know revealing uh people's names, addresses, dates of birth, salaries, you know, a lot of very sensitive information which Let's say I or somebody else in that carriage was a cyber criminal, for example, or a fraudster, we could have gathered plenty of information to conduct things like identity theft. and so on. The point of that story is to say that organization for all I know, I don't know them, but for all I know they might have extremely strong cybersecurity. They may have, you know, um robust networks, strong application security, etc. But they've obviously still got some weak links in their information security program. In this case maybe the awareness of some of the employees who work for them So information security will concern itself with all those things. And ultimately the last thing to say before we look at this confidentiality, integrity and availability bit is of course when we look think about information security what ISO says is we're always focusing on the business objectives There is a saying that information security should be an enabler, not a disabler. So in other words, we're not implementing security to stop the organisation operating and achieving what it needs to achieve. What we want is the organization to achieve. to achieve what it's aiming to achieve but in a secure manner essentially. So let's have a look at this confidentiality integrity and availability bit and I just want to run through those and again I realize people have been in security for quite some time should be already familiar with this but again let's just make sure we're on the same page Now the first thing is that ISO says that these are the three pillars of security, the three tenets of security. But I must stress that when you set up an ISMS, you're not limited to just thinking about these three. things. These are the minimum three things you would think about. So just for those who might be in other industries, for example, if you're in a regulated industry where you need to have strong audit trails of activity and you're concerned about accountability, for example. There's no reason why we cannot implement controls and manage that through an ISMS. If you're an organization that's producing products or services and you're concerned about you know counterfeiting or piracy and risks like that. Um your controls to ensure authenticity, your digital rights management. authenticity management, etc. , can be considered. And similarly, if you're in the business of doing transactions and you don't want people to be able to deny activities, so you're concerned about non-repudiation those things can be considered. So my point is just because they're not explicitly called out by ISO doesn't mean that they don't matter or can't be thought about. But let's focus on the first three, the confidentiality, integrity and ability So what I typically tell people is imagine if you went outside and stopped somebody in the street who doesn't really know much about information security. Somebody who's not really in that space, and I asked them what is information security, probably I imagine the answer I would get back would be something like stopping unauthorized access to data or you know, um only allowing people access who should have access, something like that. I imagine the vast majority of people would probably focus on confidentiality, says the most obvious one. So indeed confidentiality is is exactly that, about limiting access to information to only those people who need it, about having control over information and and who can access it. And of course organisations can achieve that in many ways by implementing robust authentication for example, establishing a clear data access policy, having proper access control, perhaps using things like encryption or data masking, all of these are confidentiality techniques. But of course, whilst confidentiality is important, if we're building the argument that information is an asset because we use it to make business decisions, to respond to uh uh various problems and challenges, then we surely want some confidence that the information is actually trustworthy, up to date, accurate, and so forth. And that's where we concern ourselves with integrity. So integrity is about implementing controls that reduce the risk of unauthorized changes to data, data corruption. helps us ensure minimum data quality so that when we do come to rely on a system or the information it contains we can have a confidence within it. And whilst we were talking about confidentiality a moment ago, confidentiality is all well and good and we could achieve it by locking down all kinds of things, but it's not much use if Those people in an organization who need access can't gain access. So there's a balance and that's where we look at availability. So availability and the principle of it is about making sure information and systems are available as required when required by the right audience and of course some organizations will have very important um commitments on this you know maybe you have a commitment as an organization to ensure certain systems are available for a certain amount of time. So this is all about focusing on things like system resilience, ensuring that there's Where necessary, there's failover in place, so that we have disaster recovery and business continuity plans in place. Now whilst ISO says we should uh focus on those three things I think it's important to point out one point. It doesn't tell us which one of those is more important. This depends on the context of your organization and looking at risk. And a couple of very quick examples I can give on two two totally different industries. So of course I mentioned in my introduction that I spent some time working with the health service in the UK. So in that context Obviously confidentiality was very high on our radar, you know, respecting the patient's right to privacy, protecting very sensitive medical records. was right up there. But equally integrity was. You know, I always say to people, imagine a doctor treating a patient with inaccurate medical records or data that's been corrupted. You know, the consequence could be extremely significant. Separately, I did some work for an electricity distributor, so think of it like a national grid organization. And on that project we were doing an industrial control system security project. So what we were interested in was protecting essentially computer systems that controlled electricity substations on the on the uh power grid. Now for that there wasn't really a lot of confidential information. you know there's no patient records or customer data. Maybe the designs of the system were probably the confidential information we wanted to protect. Our focus was very much on system integrity, controls to prevent or reduce the risk of people tampering with those systems And of course availability. You know, if somebody could do a denial of service attack and bring one of those systems down, they could cause significant disruption in the country that we're speaking about. So that project was much more focused on availability. My point being, n neither of them are right or wrong. Both of them are perfectly compatible under ISO twenty seven thousand and one and it's all about focusing in the right areas and looking at the organisation priorities. Just speaking of availability, um this diagram here just tries to pin together the relationship between information availability versus confidentiality and integrity. So of course we have on the side here it says information security. So information security is supported by uh data confidentiality controls and integrity. If we think about availability, what we should say is availability isn't just about a system being up and running. It's about other things as well. A system may be up and running, but is it reliable? In other words, if I go to use the system, you know, is it still going to function correctly And timeliness and performance are all part of that. You know, let's say I'm um I'm an online customer going to a website, uh that website might well be there, but if I can't make, for example, a purchase because because of performance issues, then I still wouldn't argue that the system is available. And there are multiple things that support system availability. So the there are those things that prevent systems going offline in the first place, such as housing those systems in an environment with adequate physical security, your professional data center with fire suppression and um you know air conditioning and uh monitoring and all of those things. Having effective security policies in place which reduce the risk of actions being taken that could bring systems offline Designing systems in such a way that they're what we call redundant. So let's imagine we have a a hardware failure, that we don't just lose the system because of one hardware failure, that another piece of hardware Where um that kicks in. So even with networking, you can do that with firewalls, you know, you can have failover firewalls, for example. Uh making sure there's adequate monitoring. So these are all preventative things, hopefully to stop the loss of availability when things go wrong. And then of course in worst case scenarios, having adequate business continuity plans which lay out how we would recover. if something significant happened in terms of interruption and also thinking about backups and having adequate backups in place so we could recover from a trusted uh backup. Now one thing to say about all of the things I've mentioned, because I've mentioned them at a very high level, when we look at ISO 2701, uh how rigorous we need to be in each of these areas comes back to your risk assessment. So for example, ISO 27001 is not sitting. For every piece of hardware you must have an equal and uh uh opposite duplicate for example or that you must have two power feeds into your data centre etc you might determine that your availability needs are so high that that makes absolute sense and you need to invest in those controls. In other environments where the availability requirement may be less, then you can make different decisions. So ISO is not dictating here, but what it is saying is these are the areas to think about when it comes to availability So ultimately, yes, yes we're about protecting confidentiality and integrity, but we also want to make sure we have information systems we can trust and have a confidence in and have a confidence. That they'll be there when we need to use them.