Risk is …
… when threat exploits vulnerability causing impact… tough to measure, express and control… the product of probability and impact… the gap between theory and practice… the root of pessimism and optimism … the once-in-a-hundred-years e…
risk
CISO workshop slides
A glossy, nicely-constructed and detailed PowerPoint slide deck by Microsoft Security caught my beady this morning. The title ‘CISO Workshop: Security Program and Strategy’ with ‘Your Name Here’ suggests it might be a template for use in a workshop/cou…
Risk management trumps checklist security
While arguably better than
nothing at all, an unstructured approach to the management of information security results in organisations adopting a jumble, a
mixed bag of controls with no clear focus or priorities and – often –
glaring holes in the ar…
Security in software development
Prompted by some valuable customer feedback earlier this week, I’ve been thinking about how best to update the SecAware policy template on software/systems development. The customer is apparently seeking guidance on integrating infosec into the develop…
Skyscraper of cards
Having put it off for far too long, I’m belatedly trying to catch up with some standards work in the area of Root of Trust, which for me meant starting with the basics, studying simple introductory articles about RoT.As far as I can tell so far, RoT i…
Complexity, simplified
Following its exit from the EU, the UK is having to pick up on various important matters that were previously covered by EU laws and regulations. One such issue is to be addressed through a new law on online safety.”Online safety: what’s that?” I hear …
The discomfort zone
Compliance is a concern that pops up repeatedly on the ISO27k Forum, just this morning for instance. Intrigued by ISO 27001 Annex A control A.18.1.1 “Identification of applicable legislation and contractual requirements”, members generally ask wh…
Standards development – a tough, risky business
News emerged during June of likely further delays to the publication of the third edition of ISO/IEC 27001, this time due to the need to re-align the main body clauses with ISO’s revised management systems template (specfically, the 2022 edition of the…
Authorised exemptions
Inspired by an exchange on the ISO27k Forum yesterday morning, I wrote and published a simple 2-page exemptions policy template for SecAware. In essence, after explaining what ‘exemptions’ are, the policy requires that they are authorised after du…
The business context for information risk and security
Although the
organisational/business context is clearly relevant and important to information risk and
security management, it is tricky to describe. In my opinion, clause 4 of ISO/IEC 27001 is so succinct that it leaves readers perplexed as to …