1. Security and business continuity in ICT : a case study by Orange
ITU Workshop on “ICT Security Standardization for Developing Countries”
(Geneva, Switzerland, September 2014)
Security and business continuity in ICT : a case study by Orange
Francois Zamora,
Global security management system
Corporate Security Department, Orange Group
Geneva, Switzerland, September 2014

2. Purpose of this presentation
To exchange on how normative references are used for security and business continuity
To detect opportunities in the context of developing countries
Orange
Trends observed
Selected approach and methodology in Orange security function
Geneva, Switzerland, September 2014

3. Orange’s footprint
Geneva, Switzerland, September 2014

4. Some trends observed Regulatory Standardization ICT
European Critical Infrastructures, started with energy, transports and interlinks ICT.
France reformulates Europe’s vision
Influences on developing countries
Standardization
Information security
BCM
Privacy
Cloud security (provider and consumer)
Management systems for records
SCADA security …
ICT
mutates
concentrates
outsources
is exposed
enables new fields
Geneva, Switzerland, September 2014

5. A vision shared in France
courtesy : HCFDC, Feb 2013 (Laurent Ducamin, SGDSN)
Geneva, Switzerland, September 2014

6. Case study
All these sectors are interlinked with strong interdependencies leading to complex representations and challenging requirements
Orange selected an approach and methodologies to clarify and address ICT security and resilience in a context of strong technological mutations
Geneva, Switzerland, September 2014

7. Approach Clarify requirements and maintain watch
Manage risks and comply
Continuously improve
Certify for business, re-use for compliance
Orange Global security standard
Global security management system
Use and map external references
Geneva, Switzerland, September 2014

8. Methodology
Identifying critical scopes of services, activities and processes : Risk identification and management with ISO/IEC 27005
Continuous improvements with ISO/IEC 27001, and 22301
Use and map other normative references
Maintain watch to assess effects :
from and on Cloud-computing-based infras
from the virtualization trends of network equipments
from and upon key providers
from the conquest of new fields of services
Geneva, Switzerland, September 2014

9. Conclusions and Recommendations
Thanks to a risk approach : effort is focused on critical functions and only relevant references are selected
Maintaining watch enables : adequacy to local requirements and proportionality of effort with real-life threats
Geneva, Switzerland, September 2014

10. Thank you backup slides follow
Geneva, Switzerland, September 2014

11. disctinctive features and strength
Geneva, Switzerland, September 2014

12. Orange’s weight
Geneva, Switzerland, September 2014

13. Orange’s networks overview for the enterprise market
Geneva, Switzerland, September 2014