1. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Unification of information security policies towards a NATO-wide Information Security Scheme Arturo Herrera Colmenero Risk Analysis Consultants Prague, Czech Republic

2. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic DO CHECK PLAN ACT Typical Approach

3. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Objectives and Planning Strategic IT Plan ISMS NATIONAL SECURITY PLAN Financial Goals Research and Development Peace missions Other goals NATO (regional) SECURITY PLAN

4. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic New challenges, Prague Summit, 2002 NATO Requirements Co-operation IT based defence technology Reliable information Accesible information Accurate information Interoperability NATO enlargement Networkcentric warfare, cyber attacks NATO Response Force New Military Command Structure Civil emergency planing action

5. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Planning and preparation Policy Components Types of Policies Co-operation Principles NATO standards NATO Interoperability Platform NATO-wide perspective Member states efforts

6. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Planning and Preparation problems Sponsor’s politicaly, legaly, technicaly unaware Uncompatible Risk Analysis methods Uncompatible Interviews Omited or unaccesible references Personnel Unawarenes

7. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Policy Components problems Unclear Statements Insufficient Management commitment Uncomparable evaluation indicators Similar roles with unequal responsibilitie s Contradictory reactions upon violations Unmatching starting and revision dates

8. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Types of Policies

9. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Lack of interoperability

10. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Co-operation Principles Sharing resources Muttual Support Common interests Bigger goals Resources efficiency Sturdier achievements

11. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic NATO Standards

12. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Planning and Preparation Advantages Homologous sponsorship Compatible Risk Assessments Development team with sufficient “Know-how” Compatible interviews outputs Common Definitions Similar Personnel Awareness programs Statement in focus Bigger references bank Common evaluation indicators Even Sanctions Exceptions tolerance Coordinated dates Policy Components Advantages

13. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Final remarks Network centric warfare for fighting new international threats depends on reliable IT systems’ interoperability. NATO-wide Information Security Scheme will enhance the overall organization’s capabilities. Interoperability will never be achieved if ISMS’s lead to divergent objectives.

14. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Final remarks NATO spirit is to unite efforts for collective defence and for the preservation of peace and security. (North Atlantic Treaty, 1949) Existing standardization work in NATO provides a set of useful tools.

15. Security and Protection of Information Conference April 28 – 30, 2003 Brno, Czech Republic Thank you for your time Arturo Herrera Colmenero herrera@rac.cz Risk Analysis Consultants www.rac.cz Španělská 2 120 00 Prague 2 Czech Republic