1. Information Security Awareness
ISO Awareness
Information Security Awareness

2. Contents What is Information and Information Security? CIA Triad
Why Information Security?
Impact of Security Incidents
Introduction to ISO 27001

3. What is Information? Processed form of data is Information
Valuable asset to an organization which is to be protected is Information
Information may exist in several forms –
Tangible
Documented (printed or written on paper)
Published on web
Electronically stored (stored on laptop, mobile, tablet etc.)
Stored in s, servers, documents, diagrams etc.
In-Tangible
Ideas
Knowledge and expertise etc.
Information can be processed, stored, transmitted, modified, shared, deleted, destroyed, leaked, controlled, used properly or improperly

4. Information Security
Protection against the unauthorized use of information is Information Security
Information Security is prevent your organization from any risk/danger.
Information Security can be achieved by –
Identification of the risk to information and performing corrective/preventive actions
Protection of Confidentiality, Integrity, and Availability
Security of assets, processes, accounts, people, and infrastructure etc.
Implementing and continuously improving the processes

5. CIA Triad
Confidentiality Prevents unauthorized disclosure of information
Integrity Assure that data cannot be modified in an unauthorized manner.
Availability Information should be readily available for the authorized users.

6. Why Information Security?
Protection of information against threats
Privacy of information and 100% compliance
Better processes, reduced cost
Minimizes financial and business loss
Ensures business continuity
Maintain Confidentiality, Integrity, and Availability of information

7. Impacts of Security Incidents
Loss of confidential information
Fines and penalties
Civil and criminal liability
Breaking of rules and regulations
Downtime of business and IT services
Reputation damage and adverse publicity
Less effective processes, hence increased costs
Loss of customers, business partners, confidence, credibility, and assurance

8. About ISO
ISO – International Organization for Standardization is an NGO
Came into existence on Feb 23, 1947
Operates in 162 countries
3923 technical bodies to take care of standards development
Published International Standards till now
Create standards for all the industries applicable across the globe

9. ISO/IEC 27001:2013
ISO/IEC 27001:2013
ISO – International Organization for Standardization IEC – International Electrotechnical Commission
ISO is Information Security Management Systems initially published by ISO for IT industry only
ISO/IEC made it possible to implement it in any industry like IT, Aerospace, Pharmaceutical, Electronics, Mechanical, Civil, and Production etc.
Specifies the requirements for improving a documented ISMS within an organisation with 11 domains, 39 control objectives, and 114 controls
Ensure selection of adequate security controls to protect information assets from various threats & risks.
International Organization for Standardization
Publishing / Reissued Year
Standard Code for Information Security Management System
International Electrotechnical Commission

10. PDCA Cycle PDCA Plan – Establishment of the ISMS
Do – Implementation of the ISMS
Check – Monitoring and review of the ISMS
Act – Continuous improvement of the ISMS
PDCA
Plan Do
Check
Act

11. 11 Control Domains Information Security Information Security Policy
Organization of Information Security
Asset Management
Human Resource Security
Physical security
Communication & Operations Management
Access Control
System Development and Maintenance
Incident Management
Business Continuity Plan
Compliance

12. Control Domains (continued)
Information security policy – states management direction
Organization of information security – information security management framework for implementation
Asset management – assessment, classification and protection of valuable information assets
HR security – security for employees, new joiners, and separated employees
Physical & environmental security - prevents unauthorised access, theft, compromise, damage to information and computing facilities, power cuts
Communications & operations management - ensures the correct and secure operation of IT
Access control – restrict unauthorized access to information assets

13. Control Domains (continued)
Information system development & maintenance – build security into systems
Incident management – track security incidents and take necessary actions
Business continuity management – maintain business processes and restore if any failure occurs
Compliance - avoid breaching of laws, rules & regulations, policies and other obligations

14. Key Documents for ISO 27001
Information Security Management Manual and Information Security Policy
Statement of Applicability (SOA) document
Internal policies and procedure documents for all the departments like
Human Resource
Information Technology
Business development
Quality Assurance
Manufacturing and Production etc.
Policies for Risk Management, Incident Management, Change Management, Physical and Environmental, Internet usage etc.
Logs and reports like security logs, antivirus logs, security review reports, risk assessment logs, corrective and preventive actions.

15. Who is Responsible? Information Security Management committee
CEO/COO/CTO/CMO
Information Security Management Representative
Information Security Team/Department
Information Security Officer
Business Continuity Team
Incident Management Team
And all the departments like HR, IT, Accounts, Business, Legal etc.

16. Risk Management
Risk is the possibility that a threat exploits a vulnerability leading to adverse impact
Threat – that might cause harm like human error, software compliance, intellectual property, infrastructure issues, environmental factors etc.
Vulnerability – a weakness that may be exploited
Impact – damage to an asset of an organization
Risk assessment table
Risk ID
Risk
Category
Description
Severity of Impact
Likelihood
Risk Factor RF=S*L
Corrective Action
Severity
IT-01
Internet Downtime IT
Internet Issues 5 25
Other Internet Providers 1
HR-02
Employee Turnover HR
Employee exit is increasing 4 2 8
Strict policies to stop employee turnover

17. Physical Security Do’s Don’ts Follow security policies and procedures
Use biometrics and wear identity cards while in premises.
Inform incident management team or information security team in case of any incident.
Do not allow unauthorized visitors in your premises
Do not bring electronic media or banned devices in secure zones
Do no use personal devices unless authorized by higher management.

18. Email usage Do’s Don’ts
Use official IDs for official purpose only
Follow IT/ guidelines for usage
Delete spam and report to IT team if you receive any spam
Do not allow unauthorized visitors in your premises
Do not bring electronic media or banned devices in secure zones
Do no use personal devices unless authorized by higher management
Do not respond to spam and be aware of attachments or links

19. Key points to remember
Keep your computer system updated with operating system and antivirus
Lock your system locked when unattended, and always log-off at the end of the day
Clear cache and temporary files, restart your system twice a week
Take regular backup of your important information
Keep your system information in encrypted drive/folder
Always comply with the policies and procedures of your organization
Always comply with the security and privacy laws, copyrights, Non disclosure agreements, contracts, Master service agreements, and software licences
Use conference rooms for official meetings and phone calls
Do not bring eatables at your workstations
Contact Information Security team in case of any security incident

20. Thank You
Should you have any queries / suggestions / recommendations, feel free to contact – Website –