Read Slide 0 text version

ISO Cyber Security and ICT SCRM Standards

ACSAC Conference December, 2010


Cyber Security Standards and ICT SCRM Standards Landscape

ISO Cyber Security Standards Portfolio

ICT SCRM and Software Supply Chain Standards


The Landscape


Within the ISO structure, ISO/IEC JTC1 SC27 focuses on cyber security

ISO/IEC Joint Technical Committee 1 (Information Technology)

Subcommittee 27 (SC27) (IT Security Techniques)

Working Group 1 Information Security Management Systems

Working Group 2 Cryptography and Security Mechanisms

Working Group 3 Security Evaluation Criteria

Working Group 5 Identity Management and Privacy Technologies

Working Group 4 Security Controls and Services


Within the US CS1 focuses on Cyber, while SC7 TAG works in system and software engineering


Governance (WG1) Terminology

ISO/IEC Information Security Management System (ISMS) Family of Standards (WG1) ISO/IEC 27000 ­ Overview and Vocabulary


ISO/IEC 27001 ­ ISMS Requirements

ISO/IEC 27006 ­ Audit & Certification Requirements


ISO/IEC 27002 ­ Code of Practice ISO/IEC 27004 ­ Measurement

ISO/IEC 27003 ­ ISMS Guidelines ISO/IEC 27005 ­ Risk Management

ISO/IEC 27007 ­ Audit Guidelines

ISO/IEC 27008 ­ Guidance for auditors on ISMS controls

ISO/IEC 2700X (concept) ­ Sector-Specific Guidelines

Security Engineering (WG3) Implementation (WG4)

Tamper Protection Study Period ISO/IEC 15408 Common Criteria

ISO/IEC 21913 ­ Secure System Engineering Principles and Techniques

ISO/IEC 27036­ Supplier Relationships ISO/IEC 27034­ Application Security ISO/IEC 27033­ Network Security

ISO/IEC 20004-Secure software development and evaluation under ISO/IEC 15408 and ISO/IEC 18405


ISO/IEC JTC1 SC7, System and Software Engineering ­ Relationship of Key Life Cycle Process Standards

24748: Guide to Life Cycle Management Other standards providing details of selected SW processes Revised 12207: Life cycle processes for SW Revised 15289: Documentation Revised 15288: Life cycle processes for systems Other standards providing details of selected system processes 15026: Additional practices for higher assurance systems


Revised 16326: Project Mgmt Revised 15939: Measurement Revised 16085: Risk Mgmt

Source: J. Moore, SC7 Liaison Report, IEEE Software and Systems Engineering Standards Committee, Executive Committee Winter Plenary Meeting, February 2007.

Assurance Case


Common vocabulary, process architecture, and process description conventions


SC22 ­ Programming Languages, ISO/IEC TR 24772, Programming Language Vulnerabilities

Targets building software that is inherently less vulnerable through improving the programming languages, or, at least, improve the usage of them in coding A catalog of 60+ issues that arise in coding when using any language and how those issues may lead to security and safety vulnerabilities Cross-referenced to CWE Each discussion includes ­ Description of the mechanism of failure ­ Recommendations for programmers: How to avoid or mitigate the problem. ­ Recommendations for standardizers: How to improve programming language specifications. First edition will be published in 2010 Second edition will add annexes specific to particular programming languages

Courtesy of Jim Moore, MITRE


Over the past 2 years one of the focus areas for the US has been ICT SCRM standards

ICT SCRM And Hoc Group was established in February 2009

­ Joint group between CS1 and SC7 TAG

­ Substantial industry and government participation ­ Contributed ICT SCRM-related content to several new and under revision standards (ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27036)

Developed consensus-based USNB proposal for ICT Supply Chain Assurance Standard and presented at SC27 meeting in November 2009

Based on the US proposal a Study Period was established to explore the need to develop ICT Supply Chain Security Standard

The following slides tell the story of what happened at the conclusion of the study period...


Study Period was active for a year with the report briefed out in October 2010 at SC27 meeting in Berlin


­ ICT Supply Chain Study Period Report

­ National Body contributions ­ Japan and UK ­ ISF proposal for a joint standard to address information security in Third Party relationships US Goals ­ US had a strong going in position that a standard is needed


When we arrived ­

Four sets of meetings were scheduled to discuss:

­ ISF proposal

­ ICT Supply Chain Security Study Period Results ­ ISO/IEC 27036, Guidelines for Security of Outsourcing 3rd WD review ­ Cloud Computing Security Proposal

We were worked with SC27 leadership and delegates to sequence these meetings to ensure logical flow and to allow for attendance by all interested parties

Tuesday Afternoon ICT SCRM Study Period

Wednesday ICT SCRM Study Period

Thursday ISO/IEC 27036 ICT SCRM Study Period


Attendance of these meetings and discussion by delegates exceeded expectations

Heads of Delegation / Experts from following national Bodies

­ Belgium ­ Canada ­ France ­ Japan ­ Korea ­ Luxembourg ­ Malaysia ­ Russia

Liaison Officers


­ Singapore

­ South Africa ­ Sweden ­ Switzerland ­ United Kingdom ­ United States of America


Results exceeded expectations too ­ the group decided that

Current ISO/IEC 27036 was too narrow, and a broader standard was needed to address all concerns related to ensuring information security in supplier relationships ISF proposal and results of ICT Supply Chain Security Study Period provided good material for restructuring and expanding ISO/IEC 27036 ICT SCRM Study Period should be closed ISO/IEC 27036 should be restructured into a 4-part standard with the following new title: Information technology ­ Security techniques ­Information Security for Supplier Relationships

­ Part 1 ­ Overview and Concepts(ISF proposal, 27036), to introduce the topic

­ Part 2 ­ Common Requirements (ISF proposal, 27036), to provide requirements that acquirers can use in contracts ­ Part 3 ­ Guidelines for ICT Supply Chain (study period outcomes), to address ICT SCRM specifically ­ Part 4 ­ Guidelines for Outsourcing (placeholder for the current text, remain at WD3 to determine future course of action)


Expanded ISO/IEC 27036 scope

This international standard covers information security in relationships between acquirers and suppliers to provide appropriate information security management for all parties. In particular, it also includes management of information security risks related to these relationships. This International Standard applies to all types of organisations (e.g., commercial enterprises, public sector organisations, not-for-profit organisations, and partnerships). It specifies the information security requirements and guidance associated with managing a supplier relationship (e.g., identifying and categorizing suppliers; agreeing, monitoring, validating, and changing supplier arrangements; and exiting). This International Standard covers all types of supplier relationships, including outsourcing, product and service acquisition, and cloud computing. The intent of this standard is that supplier relationships cover ICT and other types of supplier relationships (e.g. power supply, human resources, facilities management) that have information security implications.


The expanded standard will make many connections with existing standards to ensure that they are referenced appropriately

Relevant standards to be considered

­ Management Systems: ISO/IEC 27000 family; ISO 28000, Supply Chain Resiliency; ISO/IEC 20000, IT Service Management

­ Risk Management: ISO 31000, ISO/IEC 27005, and ISO/IEC 16085 ­ Lifecycle Processes and Practices, software acquisition, and software assurance ISO/IEC/IEEE 15288 (systems), ISO/IEC/IEEE 12207 (software), IEEE 1062 (software acquisition), ISO/IEC15026 (software assurance) ­ ISO TMB NWIP on Outsourcing Proposed liaisons with other standards bodies

­ Information Security Forum (ISF)

­ ISO/IEC JTC1 SC7 ­ Systems and Software Engineering ­ ISO PC246 ­ Anti-Counterfeiting Tools ­ ISO TC247 ­ Fraud Countermeasures and Controls

­ ISO TC8 ­ Ships and Marine Technology (home of ISO 28000)

­ ISO TC223 ­ Societal Security (home of resiliency standards)


What's next?

Preliminary drafts of ISO/IEC 27036 Parts 1, 2, and 3 are due to SC27 Secretariat no later than December 18 ­ ISO/IEC 27036 editors will restructure existing text into new Parts 1 and 2 ­ ISO/IEC 27036 Part 3 editor will create an outline and preliminary draft based on the ICT SCRM Study Period outputs Preliminary drafts will be distributed to the National Bodies for comment and reviewed and revised at the Spring 2010 meeting CS1 will review all drafts and comment back to SC27 And then we will go to the next meeting, review, revise, and repeat... until we are done within the required timeframe of 3-5 years


Nadya Bartol

Senior Associate

Booz Allen Hamilton Inc. One Preserve Parkway Rockville, MD 20852 Tel (301) 922-9537 [email protected]



Slide 0

17 pages

Find more like this

Report File (DMCA)

Our content is added by our users. We aim to remove reported files within 1 working day. Please use this link to notify us:

Report this file as copyright or inappropriate


You might also be interested in