Information security standards

Information security standards are published works by various professional organizations which attempt to encapsulate the guidance necessary to properly secure an IT system. Different standards have applicability to different industries, such as payment card versus healthcare, but tend to cover the full breadth of applicable system-related components, such as network devices, workstations, servers, software, user interaction with systems, system process interactions, data transmission, and storage. It is very important to understand that information security standards are not checklists.

When implementing a security standard for your organization you must look at the standard and decide how you will implement it for you organization. In most cases, the standard information is not prescriptive in that it does not tell you what tools to implement and how to implement them. You need to work with your IT and business teams to determine the best tools for the job and how they should be implemented within your infrastructure. It is also important to note that implementing a standard does not mean that you have effectively secured your organization. This is the trap of thinking of a standard as a checklist. You must look at an information security standard as a place to start. It is up to the information security professional to implement a standard in an effective way that properly secures the organization and mitigates risk to acceptable levels.

The following are some popular standards that are used around the globe:

• ISO 27001 and 27002 (https://www.iso.org/isoiec-27001-information-security.html):
  • A set of requirements which provide a framework for an organization to plan, and assess their security.
  • It has a very specific mechanism. An organization can contract a third party to verify their security controls and so be deemed compliant with 27001.
• Voluntary NIST Cybersecurity Framework (https://www.nist.gov/cyberframework):
  • Guidance developed to help private sector entities and critical infrastructure develop an effective risk-based approach to implementing cybersecurity.
  • Provides information security activities, outcomes, references, and detailed guidance necessary for planning a well-functioning information security program.
  • Voluntary.
• HIPPA (https://www.hhs.gov/hipaa/):
  • The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the secretary of the U.S. department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information.
  • To fulfill this requirement, HHS published what is commonly known as the HIPAA Privacy Rule and the HIPAA Security Rule. The Privacy Rule, or standards for privacy of inpidually identifiable health information, establishes national standards for the protection of certain health information. The security standards for the protection of electronic protected health information (the Security Rule) establish a national set of security standards for protecting certain health information that is held or transferred in electronic form.
  • Mandatory requirement for any organization processing HIPPA-related data (Personal Health Information (PHI)).
• PCI DSS (https://www.pcisecuritystandards.org/):
  • The PCI Data Security Standard (DSS) provides a framework for developing a payment card data security process, which includes prevention, detection, and incident response to security incidents.
  • Mandatory requirement for any organization processing payment card data.