iso17799 newsletter iso17799securityriskcouk ______________________________________________________ iso17799 newsletter edition 4 ______________________________________________________ welcome fourth edition iso17799 newsletter designed keep abreast news developments respect iso17799 information security information contained newsletter absolutely free subscribers provides guidance various practical issues plus commentary recent information security incidents guidance information included issue 1 iso17799 toolkit uncovered 2 social engineering susceptible 3 iso17799 world wide phenomena 4 stranger danger 5 iso17700 frequently asked questions 6 credit card transactions minimize risks 7 bsi certifications congratulations 8 iso17799 section 11 bcp review 9 couldnt happen could 10 subscription information iso17799 toolkit uncovered iso17799 standard acquired either stand alone part introductory pack appropriately called iso17799 toolkit packaged thus included pack purpose toolkit help organizations get flying start respect iso17799 understand standard begin address many standards requirements quickly contents broken two groups help organization understand iso17799 fits involved embracing help organization take first critical steps compliance former group roadmap certification broadly describes process gaining certification xl management presentation explains history background current status standard course iso17799 standard parts latter group key items aid compliance include comprehensive set iso17799 compliant security policies address section 3 security policy business continuity audit checklists help address section 11 business continuity management doesnt end however audit section detailed set audit questionnaires address various issues platforms newcomers information security even substantial glossary terms clearly creating toolkit significant undertaking however terms helping organizations exploring initial stages iso17799 invaluable information iso17799 toolkit purchase found httpwwwiso17799madeeasycom standard alternatively procured httpwwwiso17799net social engineering susceptible term social engineering conjure variety ideas usually based around concept genetic tampering however applied security implications vocabulary following interviews known computer criminals list approaches produced designed gather information without target even realizing parted attempts often made opportune bases common locations sort activity planes trains pubs telephone probably major source premeditated acts following major techniques employed baiting essentially involves asking variety questions including leading questions designed catch right answers often items conversation introduced based upon replies received fiction legitimized small amounts fact right places pulling rank amounts ot perpetrator assuming senior position company victim usually enacted telephone necessitate direct impersonation position needs assumed exhausting involves asking constant stream similar questions wear target surf boarding basically looking someones shoulder something confidential could directly window doorway etc surveys information given freely surveys often extremely useful criminal surveys initially entirely legitimate purposes completely bogus start either case sensitive information often obtained unwittingly disclosed course many techniques however disclosure prevented via use series common sense rules policies releasing information essential least establish sensitivity information b authority exchange release information c real identity third party proper authentication purpose exchange act exchange also recorded audit purposes iso17799 world wide phenomina disney would said small world global take iso17799 proves organizations planet embracing enthusiasm illustrate global nature standard recently created table last 500 purchases standard iso17799 electronic shop wwwiso17799net figures come serious health warning though electronic shop credit card purchase system cultures comfortable familiar others credit card purchase therefore purchase position significantly understated example india acquires substantial numbers standard two show last 500 download location aside table makes interesting reading argentina 1 australia 6 austria 5 barbados 2 belgium 5 bermuda 1 bosnia herzegovina 1 brasil 2 brazil 4 canada 52 cayman islands 1 chile 3 china 3 colombia 5 costa rica 1 croatia 1 cyprus 1 denmark 5 deutschland 5 egypt 4 england 26 france 3 germany 20 greece 3 guatemala 1 hong kong 7 hungary 1 india 2 indonesia 2 ireland 11 isle man 1 israel 1 italia 1 italy 20 japan 3 malaysia 5 mexico 9 netherlands 3 new zealand 2 northern ireland 1 norway 10 nz 1 panama 1 portugal 1 russia 3 sacramento 1 scotland 3 singapore 9 slovak republic 1 slovenia 1 south africa 4 spain 9 sultanate oman 1 sweden 3 switzerland 14 taiwan 3 thailand 2 netherlands 8 tunisia 1 turkey 1 uae 1 uk 51 united arab emirates 2 united kingdom 24 united states 13 united states america 25 usa 176 venezuela 2 stranger danger read article look around working environment itemsinformation hand may seem sensitive deal every day look alone member staff would view would find looked around picture visitor passing hear terms conversation see chances hear see quite lot would want openly disclosed outside world case security information risk potentially every visitor stranger subcontractor etc article written intention discrediting visitors nonetheless important fully aware happen due caution exercised following guidelines may help ensuring risks minimized receptionvisitor area issue distinctive badges ensure visitors wear consider using different colored badges day week challenge displaying identity badges location issues identity badges make sure wear afraid ask someone visiting lazy escort visitors reception applicable dont let make way hold doors open people displaying id leave visitors alone iso17799 frequently asked questions 1 many controls standard part 1 organized 10 sections 127 main controls 500 detailed controls total 2 part 2 part 2 basically explains apply standard build operate information security management system 3 old standard stems original publication 1993 dti uk became bs7799 1995 course iso17799 2000 4 accreditation accreditation body authorize others certify third parties standard p2 number accreditation bodies exist different countries 5 certification life normally three year periods 6 iso17799 used throughout world internationally created yes indeed latest versions included input representatives many nations including australia brazil germany norway uk usa amongst others 7 linked specific national legal system generic terms legislation credit card transactions minimize risks use credit debit cards purchase goods services become everyday convenience take granted associated information security risks pause consider especially making payments internet web sites becoming increasingly popular means purchasing goods services also become popular targets cyber criminals often use stolen credit card numbers purchase goods easily exchanged cash also relatively simple technologies readily available could used hackers surreptitiously steal vast amounts money pounds time millions people survey research company gartner httpwwwgartnercom predicted internet crime involving mass victimization consumers could take place end year recommend following best practice guidelines minimize risks involved credit card transactions ensure credit cards used purchase goods services internet low credit limit debit cards used limited funds topped cover specific internet purchases expenses incurred internet transactions carefully audited regular basis anomalies enter credit card details web site confident authenticity connection secure prefix https opposed usual http web site address indicates secure connection security web site doubt confidential information posted may exposed malicious intent extremely cautious posting confidential details site internet service provider hosting site verified note prechecked sites referenced newsletter security ordering telephone using credit card ensure talking correct person unsure whether organization dealing handle details sensitively pay means lost stolen credit card details may used internet transactions inform card issuer relevant person within organization immediately company credit card lost stolen bsi certifications congratulations following certified bsi respect bs7799 part2 least one system least one location 7 global accordis acetate chemicals limited alenia marconi systems ltd american society quality amoun pharmaceutical co egypt attenda limited business coach management cadweb limited camelot group plc capita business services daiichi kangyo bank limited dbi consulting digex dnp facility services co limited japan ericsson espa sa glaxo wellcome manufacturing singaporeglaxosmithkline hanvit bank korea hyundai information technology icfox international intergalis logic systems management macquarie corporate telecommunications pty limited australia netstore plc ntt data corp paramount computer systems uae pccw business esolutions hong kong scube inc serious fraud office siemens business services trust center munich stiki ehf iceland sony bank inc japan cooperative bank plc university texas total network solutions limited unisys limited vodafone telecommerce gmbh volex group plc intend produce complete list future newsletter also include certificates issued growing number certification bodies across world iso17799 section 11 bcp review business continuity planning covered section 11 standard core requirement creation maintenance business continuity plan creating plan scratch difficult undertaking course one reason software products produced unfortunately often become problematic difficult learn expensive etc recent times therefore seen move simplification organizations keen avoid adding complexity already complex task vanguard change product developed entirely msword bcp generator designed top simplify business continuity planning comprises two components plan template interactive guide latter using word macros jump fro correct part template impact upon business continuity scene substantial organizations largest smallest embracing tool concepts active use 40 countries change emphasis business continuity planning market excuse creating full recovery plan old lines expensive difficult less hollow ever although section 11 clear respect need comprehensive plan surely also matter due diligence one equally irresponsibility one information bcp generator see httpwwwdisasterrecoveryplancom information business continuity generally see httpwwwyourwindowtobusinesscontinuity couldnt happen herecould every issue iso17799 newsletter features least one true story information security breach consequences issue focus upon low tech high impact incidents 1 25th october contract programmer worked large us based bank walked inner sanctum main building security guards remembered someone permitted dealing room claimed conducting quality audit interrogated junior employee watched program run noting security codes entered left hung around outside normal trading time rang bank public phone box initiated electronic funds transfer using codes 102m swiss account plan nearly failed found noted one codes incorrectly rang bank department back incredibly managed trick different employee revealing correct digit flew switzerland later returned money caught simply couldnt resist boasting great feat police contacted bank still totally unaware loss 2 remote dialin access real achilles heel properly controlled recent case young hacker gained access major companys system using default password system engineer never changed gave considerable scope powers access cover however semidisabled machine log changed number user passwords created several fictitious privileged users tampered dial back system getting ambitious established communication link another computer ended making crash took place couple evenings recover havoc installation close prime computer restore previous weeks backup considerable cost 3 period nine months number computer malfunctions within large company risen average two per year critical levels impact business fell behind invoicing systems buy processing backup third parties could deliver services reliably started lose confidence customers situation began spiral eventually company suspected foul play may involved called police secret surveillance equipment installed monitor staff one filmed lightly scratching circuit boards disk units also attaching paper clips actions led short circuit confronted confessed everything motive earn overtime required process overlap work delayed malfunction netted 689 ukp 9 months company lost least 500000 ukp contributions got something say topic iso17799 fresh insight information might benefit others please feel free contribute submission us iso17799 newsletter reminder hope found newsletter informative hopefully useful helping address iso17799 issue future editions pursue ends include interviews case studies subscription iso17799 newsletter free please feel free pass copy friends colleagues wish receive copies please email us address title unsubscribe friends colleagues wish receive newsletter directly simply send blank email iso17799securityriskcouk finally binarynine ltd accept liability responsibility errors omissions newsletter also applies loss damage caused arising directly indirectly use reliance information contained within copyright 2002 mon 24 jun 2002 190718 0100 iso17799 newsletter issue 4