Information Security Breaches: Avoidance and Treatment Based on ISO27001

Although breaches of information security are not a new phenomenon, the methods used to perpetrate such breaches have changed considerably over the years. Leaking information to non-authorised people has always been an issue but, in the computer age, the speed and effectiveness with which breaches of information security can occur, and the amount of harm potentially caused are disturbing. Typically, also, they favour the perpetrator, not the victim. Modern companies depend on their IT systems, and it is clear that special care needs to be taken to keep systems safe and secure. In this guide, we focus solely on the aspects of re-establishing that safety and security once, despite all measures taken, a breach has occurred. We put breaches of information security in the context of ISO27001 which, since its inception as former British Standard 7799 in the late eighties, has provided a framework of requirements well suited to the effective implementation of counter-measures and measures designed to protect information in all its forms (whether on paper, in the spoken word, or within the IT sphere). This pocket guide outlines a process and its elements for the treatment of severe breaches, and places them in the context of the associated ISO27001 controls. It provides input for decision making and breach classification, and case studies where the reader can check out how other companies were affected and what they did, or did not do, upon becoming the victim of a breach.

Table of Contents:
Introduction Chapter 1: What constitutes a breach? Chapter 2: Treatment using ISO27001 Assess the damage Past or future? Initiate an investigation, secure all evidence Evaluate evidence Draft the report Final decision Follow up with tenacity Review How ISO27001 supports the treatment of breaches Chapter 3: Case studies Case study 1 - small company On the importance of assuring availability Case study 2 - small company On data integrity - why you should use Word templates correctly Case study 3 - medium-sized company The missing contracts Case study 4 - large company Data theft - who wants my data? ITG Resources

About the Author :
Michael Krausz studied physics, computer science and law at the University of Technology in Vienna, and at Vienna and Webster universities. In order to combine his two main hobbies, namely investigations and computers, he has, over the last 20 years, become an accomplished professional investigator and IT expert. Since the beginning of his career, he has investigated over a hundred cases of information security breaches, usually connected with varying degrees of white- collar crime. He has delivered over 5,000 hours of professional and academic training, and has provided services in 11 countries to date.