| Industry | information securitybest practice research |
|---|---|
| Founded | London, United Kingdom (1989) |
| Website | SecurityForum.org |
The Information Security Forum (ISF) is an independent information security body.
The ISF delivers a range of content, activities, and tools.The ISF is a paid membership organisation: all its products and services are included in the membership fee. From time to time, the ISF makes research documents and other papers available to non-members.
The ISF released the updated Standard of Good Practice for Information Security in 2018. The Standard is available to ISF members and non-members, who can purchase copies of the report. The 2018 Standard represents an update on the 2016 release of the Standard, and builds upon the previous release to include the most up-to-date controls, approaches and thought leadership in information security.
The standard is a business-focused, practical and comprehensive guide available for identifying and managing information security risks in organizations.[1]
The 2016 standard covers current information security 'hot topics' such as Threat Intelligence, Cyber Attack Protection and Industrial Control Systems, as well as, significant enhancement of existing topics including: Information Risk Assessment, Security Architecture and Enterprise Mobility Management. It can be used to build a comprehensive and effective information security management system. In addition to covering information security-related standards such as COBIT 5 for Information Security, The CIS Critical Security Controls for Effective Cyber Defense, the 2016 standard covers ISO/IEC 27002 as well as PCI DSS 3.1 and the NIST Cybersecurity Framework.
Based on member input, the ISF selects a number of topics for research in a given year. The research includes interviewing member and non-member organizations and thought leaders, academic researchers, and other key individuals, as well as examining a range of approaches to the issue. The resulting reports typically go into depth describing the issue generally, outlining the key information security issues to be considered, and proposing a process to address the issue, based on best practices.
For broad, fundamental areas, such as information risk assessment or return-on-investment calculations, the ISF develops comprehensive methodologies that formalize the approaches to these issues. Supporting the methodology, the ISF supplies web and spreadsheet-based tools to automate these functions.
The ISF's Benchmark (formerly called the 'Information Security Status Survey') has a well-established pedigree – harnessing the collective input of hundreds of the world's leading organizations for over 25 years. Organizations can participate in the Benchmark service at any time and can use the web-based tool to assess their security performance across a range of different environments, compare their security strengths and weaknesses against other organizations, and measure their performance against the ISF's 2016 Standard of Good Practice, ISO/IEC 27002:2013, and COBIT version 5 for information security. The Benchmark provides a variety of data export functionality that can be used for analyzing and presenting data for management reporting and the creation of security improvement programs. It is updated on a biennial basis to align with the latest thinking in information security and provide the ISF Members with improved user experiences and added value.
Regional chapter meetings and other activities provide for face-to-face networking among individuals from ISF member organisations. The ISF encourages direct member-to-member contact to address individual questions and to strengthen relationships. Chapter meetings and other activities are conducted around the world and address local issues and language/cultural dimensions.[citation needed]
The ISF's annual global conference, the 'World Congress', takes place in a different city each year. The 2017 conference will take place in October in Cannes, France. The event offers an opportunity for attendees to discuss and find solutions to current security challenges, and gain practical advice from peers and leading industry experts from around the world. Over 1,000 global senior executives attend. The event includes a series of keynote presentations, workshops and networking sessions, best practice and thought leadership in a confidential peer-group environment.[2]
The ISF's extranet portal, ISF Live, enables members to directly access all ISF materials, including member presentations, messaging forums, contact information, webcasts, online tools, and other data for member use.[3]
The members of the ISF, through the regional chapters, elect a Council to develop its work program and generally to represent member interests. The Council elects an 'Executive' group which is responsible for financial and strategic objectives.
See Category:Computer security for a list of all computing and information-security related articles.
The Standard of Good Practice for Information Security, published by the Information Security Forum (ISF), is a business-focused, practical and comprehensive guide to identifying and managing information security risks in organizations and their supply chains.
The most recent edition is 2018, an update of the 2016 edition.
Upon release, the 2011 Standard was the most significant update of the standard for four years. It covers information security 'hot topics' such as consumer devices, critical infrastructure, cybercrime attacks, office equipment, spreadsheets and databases and cloud computing.
The 2011 Standard is aligned with the requirements for an Information Security Management System (ISMS) set out in ISO/IEC 27000-series standards, and provides wider and deeper coverage of ISO/IEC 27002 control topics, as well as cloud computing, information leakage, consumer devices and security governance.
In addition to providing a tool to enable ISO 27001 certification, the 2011 Standard provides full coverage of COBIT v4 topics, and offers substantial alignment with other relevant standards and legislation such as PCI DSS and the Sarbanes Oxley Act, to enable compliance with these standards too.
The Standard is used by Chief Information Security Officers (CISOs), information security managers, business managers, IT managers, internal and external auditors, IT service providers in organizations of all sizes.
The 2018 Standard is available free of charge to members of the ISF. Non-members are able to purchase a copy of the standard directly from the ISF.
The Standard has historically been organized into six categories, or aspects. Computer Installations and Networks address the underlying IT infrastructure on which Critical Business Applications run. The End-User Environment covers the arrangements associated with protecting corporate and workstation applications at the endpoint in use by individuals. Systems Development deals with how new applications and systems are created, and Security Management addresses high-level direction and control.
The Standard is now primarily published in a simple 'modular' format that eliminates redundancy. For example, the various sections devoted to security audit and review have been consolidated.
| Aspect | Focus | Target audience | Issues probed | Scope and coverage |
|---|---|---|---|---|
| Security Management (enterprise-wide) | Security management at enterprise level. | The target audience of the SM aspect will typically include:
| The commitment provided by top management to promoting good information security practices across the enterprise, along with the allocation of appropriate resources. | Security management arrangements within:
|
| Critical Business Applications | A business application that is critical to the success of the enterprise. | The target audience of the CB aspect will typically include:
| The security requirements of the application and the arrangements made for identifying risks and keeping them within acceptable levels. | Critical business applications of any:
|
| Computer Installations | A computer installation that supports one or more business applications. | The target audience of the CI aspect will typically include:
| How requirements for computer services are identified; and how the computers are set up and run in order to meet those requirements. | Computer installations:
|
| Networks | A network that supports one or more business applications | The target audience of the NW aspect will typically include:
| How requirements for network services are identified; and how the networks are set up and run in order to meet those requirements. | Any type of communications network, including:
|
| Systems Development | A systems development unit or department, or a particular systems development project. | The target audience of the SD aspect will typically include
| How business requirements (including information security requirements) are identified; and how systems are designed and built to meet those requirements. | Development activity of all types, including:
|
| End User Environment | An environment (e.g. a business unit or department) in which individuals use corporate business applications or critical workstation applications to support business processes. | The target audience of the UE aspect will typically include:
| The arrangements for user education and awareness; use of corporate business applications and critical workstation applications; and the protection of information associated with mobile computing. | End-user environments:
|
The six aspects within the Standard are composed of a number of areas, each covering a specific topic. An area is broken down further into sections, each of which contains detailed specifications of information security best practice. Each statement has a unique reference. For example, SM41.2 indicates that a specification is in the Security Management aspect, area 4, section 1, and is listed as specification #2 within that section.
The Principles and Objectives part of the Standard provides a high-level version of the Standard, by bringing together just the principles (which provide an overview of what needs to be performed to meet the Standard) and objectives (which outline the reason why these actions are necessary) for each section.
The published Standard also includes an extensive topics matrix, index, introductory material, background information, suggestions for implementation, and other information.
See Category:Computer security for a list of all computing and information-security related articles.
Menu