The information age has ushered in a whole new set of vocations in order to manage the associated software and systems processes. We grew and adapted existing engineering / management specialties to develop the fields of Software Project Management, Software Quality Assurance, Software Configuration Management, Software Test Engineering and even Software Safety Engineering. One thing that has remained constant over the years is the constantly increasing importance that the industry is placing on the science of Information Security.
The emphasis on standardization in the Information Security arena has grown as well. In order to have confidence in companies, prospective clients are seeking assurances that information safeguards are in place. Additionally, they are seeking assurances that management will continually monitor the effectiveness of security protections for the information and associated systems. Thus, Information Security Management Systems (ISMSs) have immerged. The leading ISMS has been developed by the British Standards Institute and is known as the Code of Practice for Information Security Management. ISMS set the requirements for an Information Security Management System. It helps identify, manage and minimize the range of threats to which information is regularly subjected.
Annex A of ISO 27001: 2013 identifies 14 Technical Domains:
- Information Security Policies – To provide management direction & support for IS in accordance with business requirements and relevant laws and regulations,
- Organization of Information Security – To establish a management framework to initiate & control implementation & operation of information security within the organization,
- Human Resource Security – To ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered,
- Asset Management – To identify organizational assets and define appropriate protection responsibilities,
- Access Control – To limit access to information and information processing facilities,
- Cryptography – To ensure proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of information,
- Physical and environmental security – To prevent unauthorized physical access, damage & interference to organization’s information & information processing facilities,
- Operations security – To ensure correct and secure operations of information processing facilities,
- Communications security – To ensure the protection of information in networks and its supporting information processing facilities,
- System acquisition, development and maintenance – To ensure that information security is an integral part of information systems across the entire lifecycle. This includes requirements for ISs which provide services over public networks,
- Supplier relationships – To ensure protection of the organization’s assets that is accessible by suppliers,
- Information security incident management – To ensure a consistent and effective approach to the management of information security incidents, including communication on security events and weaknesses,
- Information security aspects of business continuity management – IS continuity shall be embedded in the organization’s business continuity management systems,
Compliance – To avoid breaches of legal, statutory, regulatory or contractual obligations related to information security and of any security requirements