Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Unification of information security policies towards a NATO-wide Information Security Scheme Arturo Herrera Colmenero Risk Analysis Consultants Prague, Czech Republic

Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic DO CHECK PLAN ACT Typical Approach

Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Objectives and Planning Strategic IT Plan ISMS NATIONAL SECURITY PLAN Financial Goals Research and Development Peace missions Other goals NATO (regional) SECURITY PLAN

Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic New challenges, Prague Summit, 2002 NATO Requirements Co-operation IT based defence technology Reliable information Accesible information Accurate information Interoperability NATO enlargement Networkcentric warfare, cyber attacks NATO Response Force New Military Command Structure Civil emergency planing action

Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Planning and preparation Policy Components Types of Policies Co-operation Principles NATO standards NATO Interoperability Platform NATO-wide perspective Member states efforts

Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Planning and Preparation problems Sponsor’s politicaly, legaly, technicaly unaware Uncompatible Risk Analysis methods Uncompatible Interviews Omited or unaccesible references Personnel Unawarenes

Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Policy Components problems Unclear Statements Insufficient Management commitment Uncomparable evaluation indicators Similar roles with unequal responsibilitie s Contradictory reactions upon violations Unmatching starting and revision dates

Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Types of Policies

Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Lack of interoperability

Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Co-operation Principles Sharing resources Muttual Support Common interests Bigger goals Resources efficiency Sturdier achievements

Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic NATO Standards

Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Planning and Preparation Advantages Homologous sponsorship Compatible Risk Assessments Development team with sufficient “Know-how” Compatible interviews outputs Common Definitions Similar Personnel Awareness programs Statement in focus Bigger references bank Common evaluation indicators Even Sanctions Exceptions tolerance Coordinated dates Policy Components Advantages

Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Final remarks Network centric warfare for fighting new international threats depends on reliable IT systems’ interoperability. NATO-wide Information Security Scheme will enhance the overall organization’s capabilities. Interoperability will never be achieved if ISMS’s lead to divergent objectives.

Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Final remarks NATO spirit is to unite efforts for collective defence and for the preservation of peace and security. (North Atlantic Treaty, 1949) Existing standardization work in NATO provides a set of useful tools.

Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Thank you for your time Arturo Herrera Colmenero Risk Analysis Consultants Španělská Prague 2 Czech Republic