Posts

How-To create Security User Stories

/in

In the previous article, we explored how Scrum enables teams to add security to the backlog and prioritize it based on risk.

Incorporating security into the SDLC ensures that security is not an afterthought but an integral part of the development process.

Security User Stories are specific, actionable items that articulate the security needs of the software in the same way functional requirements are handled.

Writing Security User Stories complements this process by providing clear, actionable security requirements that can be integrated into each sprint.

By treating security stories with the same importance as functional stories, developers can ensure that the software they build is not only feature-complete but also secure.

 

What are Security User Stories?

Security User Stories are descriptions of security requirements written from the perspective of the user or the system. They focus on specific security needs, ensuring that the software not only meets functional requirements but also protects against potential vulnerabilities. Just like traditional user stories that describe a feature or function, security stories express how the system should behave securely.

A typical Security User Story follows the same format as a regular user story:

  • As a [role], I want [goal], so that [benefit].

For example, a Security User Story for web development might look like this:

  • “As a user, I want my session to expire after 15 minutes of inactivity, so that my account is protected from unauthorized access.”

Why are Security User Stories Needed?

Security is often treated as an afterthought, addressed late in the development process or after an incident occurs. This reactive approach leads to vulnerabilities, increased technical debt, and costly security fixes post-release. Security User Stories shift this paradigm by making security an integral part of the development process from the outset. They are necessary for several reasons:

  1. Proactive Security Integration: By incorporating security needs into the backlog from the start, you ensure that security considerations are addressed in each sprint, reducing the risk of vulnerabilities later on.
  2. Clear Requirements for Developers: Security User Stories provide clear, actionable security requirements, helping developers understand exactly what is expected to make the software secure.
  3. Accountability: Writing security stories holds the development team accountable for implementing security features and allows for better tracking of security tasks within the development cycle.
  4. Risk Mitigation: When security is considered early in the SDLC, potential security issues are identified and addressed before they become significant risks. This aligns with the concept of “Shift Left” security, where security is integrated into earlier stages of the development process.

How to Use Security User Stories

Security User Stories should be written as part of the Product Backlog and prioritized based on the level of risk or impact. Here’s how to use them effectively:

  1. Collaboration with Security Experts: Work with security professionals to identify potential threats and risks specific to the application or platform. They can help create and refine security user stories based on threat modeling and vulnerability assessments.
  2. Define Acceptance Criteria: Each Security User Story should have clear, testable acceptance criteria. These criteria define when the story is considered complete and what tests should be performed to verify the security requirement has been met.
  3. Prioritize Based on Risk: Security User Stories should be prioritized just like functional features, based on their importance. Stories that address high-risk vulnerabilities, such as authentication or encryption, should be prioritized early in the development cycle.
  4. Regular Review and Updates: Security is an evolving field. As new threats emerge, Security User Stories should be reviewed and updated to address the latest vulnerabilities. Regular threat assessments help ensure the backlog remains current.

Examples of Security User Stories Across Different Platforms

1. Web Application Development

Web applications face numerous security threats, from SQL injection to Cross-Site Scripting (XSS). Below are examples of Security User Stories that address common web application security issues:

  • “As a user, I want my password to be stored securely using a strong hashing algorithm like bcrypt, so that my account is protected from unauthorized access.”
  • “As a system, I want to validate all user inputs server-side to prevent injection attacks.”
  • “As a system, I must use HTTPS for all data transmitted between the client and the server, to ensure data confidentiality.”
  • “As a user, I want to be logged out after 15 minutes of inactivity, so that my session cannot be hijacked.”

2. Windows Software Development

Windows software may face risks such as privilege escalation or malicious code execution. Security User Stories for Windows development could include:

  • “As a user, I want my application to run with the minimum necessary privileges, so that the system is protected from privilege escalation attacks.”
  • “As a system administrator, I want all logs to be stored securely and be tamper-proof, so that I can audit user activities reliably.”
  • “As a developer, I want the application to verify all digital signatures before executing code, to ensure the code has not been tampered with.”
  • “As a system, I want to enforce Data Execution Prevention (DEP) to prevent malicious code from executing in the memory.”

3. Android App Development

Mobile applications, particularly Android apps, face unique security challenges, such as improper storage of sensitive information and unauthorized access to device features. Examples of Android-related Security User Stories include:

  • “As a user, I want my sensitive data (e.g., passwords, payment information) to be encrypted using the Android Keystore system, so that my data is safe even if the device is compromised.”
  • “As a developer, I want the app to request only the necessary permissions, so that the user’s privacy is respected.”
  • “As a user, I want to be required to authenticate using biometrics before making sensitive changes, such as resetting my password, to ensure the security of my account.”
  • “As a system, I want to securely store session tokens and prevent them from being accessible via insecure storage mechanisms (e.g., SharedPreferences).”

4. iOS App Development

iOS apps must adhere to strict privacy and security guidelines, and improper handling of user data can lead to severe breaches. Below are Security User Stories specific to iOS development:

  • “As a user, I want all sensitive information (e.g., authentication tokens) to be stored in the iOS Keychain, so that my data is protected from unauthorized access.”
  • “As a system, I want to ensure that network communication is secured using TLS 1.2 or above, to protect against man-in-the-middle attacks.”
  • “As a user, I want to enable Face ID for sensitive transactions (e.g., payments), to ensure that unauthorized users cannot perform critical actions.”
  • “As a developer, I want to implement App Transport Security (ATS) to ensure all connections are encrypted.”

Conclusion

Security User Stories are a powerful tool for developers to integrate security into their development process. By writing clear, actionable stories with defined acceptance criteria, development teams can proactively address security risks while ensuring that they meet functional requirements.

Whether you’re building a web app, Windows software, or mobile applications for Android or iOS, incorporating Security User Stories into the backlog ensures that security remains a priority throughout the SDLC.

With this approach, developers can create secure, reliable software that meets the needs of both the business and the users.

The post How-To create Security User Stories first appeared on Sorin Mustaca on Cybersecurity.

Delivering secure software in an agile way

/in

 

Agile Software Development: Why It’s Better

Traditional development methodologies, such as the Waterfall model, struggle to keep up with the need for quick iterations, frequent releases, and adaptability to changing requirements.

Agile software development addresses these challenges by emphasizing flexibility, collaboration, and continuous delivery. Agile methodologies break down the development process into smaller, manageable chunks, allowing teams to rapidly deliver working software while remaining responsive to feedback and changes.

Among the various Agile frameworks, Scrum stands out as one of the most widely adopted and effective methods for managing software development. It provides a simple, yet powerful framework, that helps teams continuously deliver high-quality products, adapt to dynamic customer needs.

Using Scrum for software development

Scrum is a lightweight agile framework designed to manage complex product development through iterative and incremental processes. It focuses on delivering working software in short cycles known as Sprints and emphasizes collaboration, accountability, and continuous improvement. This structure makes Scrum particularly well-suited for dynamic environments like software development, where requirements often change throughout the project lifecycle.

Scrum offers several key advantages that make it ideal for software development:

  1. Rapid Iteration and Feedback: Scrum’s short sprints allow teams to deliver working software frequently, which gives stakeholders the chance to review progress, provide feedback, and make necessary adjustments after each sprint.
  2. Adaptability to Change: In Scrum, the Product Backlog is continuously updated and reprioritized, enabling teams to adapt to changing business needs or customer demands without disrupting the overall workflow.
  3. Focus on Delivering Value: Scrum emphasizes delivering the highest business value early by prioritizing the most critical features. This ensures that the product development effort aligns with the business objectives.
  4. Cross-Functional Teams and Collaboration: Scrum fosters collaboration between cross-functional teams, which enables them to tackle complex problems and deliver complete product increments without relying on external resources.
  5. Simplicity and Structure: Scrum’s structured roles, artifacts, and ceremonies create a clear framework for managing work, making it easier for teams to stay organized, focused, and accountable.

With these features, Scrum empowers software development teams to build high-quality products faster and with greater alignment to customer needs. The framework’s flexibility and focus on delivering continuous value make it the ideal choice for modern software development.

Non-Functional features in Scrum

Non-functional features, or non-functional requirements (NFRs), refer to critical system attributes like security, usability, and resource consumption that ensure the software performs optimally and meets quality standards. Unlike functional features, which are visible to users, non-functional features define how the system behaves under specific conditions and are essential to the system’s overall success.

Examples of Non-Functional Features

  1. Security: Protecting the system from unauthorized access and vulnerabilities.
  2. Usability: Ensuring that the system is user-friendly and easy to navigate.
  3. Resource Consumption: Optimizing the system’s use of resources, such as memory, CPU, and bandwidth, to ensure efficient operation.

Though non-functional features are not always visible to users, they are crucial to the long-term stability and security of the product. Managing these features properly within the Scrum process is essential to ensure the product meets both user and business expectations.

Incorporating Non-Functional Features in the Scrum Backlog

Non-functional features can be added to the Product Backlog similarly to functional ones, ensuring that they are prioritized, addressed, and tested throughout the development cycle.

Here’s how:

  1. Create explicit user stories for non-functional features

Define clear user stories for non-functional aspects like security or performance. For instance:

    • “As a user, I want my personal data to be encrypted, ensuring my privacy and security.”
    • “As a system administrator, I want the application to scale seamlessly for up to 10,000 concurrent users.”
      For security in particular, these user stories are usually called “security user stories”.
  2. Prioritize based on business impact
    Work with stakeholders and the Product Owner to prioritize non-functional features that have the greatest impact on the system’s overall performance and security.
  3. Define Acceptance Criteria
    Ensure that non-functional user stories include measurable acceptance criteria, such as performance benchmarks or security requirements, so they can be properly tested.
  4. Integrate NFRs into the Definition of Done
    Non-functional features should be part of the team’s Definition of Done (DoD), ensuring that each sprint delivers not only functional but also secure, performant, and stable increments.
  5. Define a certain ratio between functional and non-functional requirements in the backlog
    Ensure that the non-functional user stories like security user stories have always a reserved space in the backlog. For example, you can have 60% functional u.s., 20% non-functional u.s., 20% bug fixes u.s.

Security in Software Development

Security is one of the most critical non-functional features in software development. It involves protecting systems, data, and users from potential cyber threats and vulnerabilities.

As software becomes more complex, the attack surface increases, making robust security measures essential.

Failing to integrate security into the development process can lead to severe consequences such as data breaches, loss of customer trust, and regulatory penalties.

The challenge of adding security user stories to the backlog

One of the main challenges of integrating security into the Scrum backlog is that security requirements are often non-functional and may not be directly tied to a specific feature.

Security is also a broad area, encompassing various elements (authentication, encryption, vulnerability management), which can make it difficult for the Product Owner to prioritize and create detailed security user stories.

Another challenge is balancing security tasks with feature development. Development teams (especially the product owner) may be tempted to focus on customer-facing features, leaving security tasks to the end, which increases the risk of vulnerabilities slipping through.

 

How to add security to the Scrum backlog

1. Create security user stories

Translate security requirements into actionable user stories that fit into the Scrum process. These stories should describe the security needs from a user’s perspective. Examples include:

  • “As a user, I want my password to be hashed and stored securely, ensuring the safety of my account.”
  • “As a system administrator, I want the application to implement multi-factor authentication for increased security.”

By creating security user stories, the development team can directly address specific security needs in each sprint.

2. Prioritize security based on risk

Work with security experts and stakeholders to prioritize security tasks based on the potential risk they mitigate. Security stories that address high-risk areas, such as vulnerabilities in authentication or data handling, should be prioritized over less critical tasks.

3. Define clear acceptance criteria for security stories

Ensure that each security user story has measurable acceptance criteria. These criteria should be specific and testable, such as:

  • “Passwords must be hashed using a minimum of SHA-256 encryption.”
  • “The system must reject any user input that contains SQL injection attempts.”

Clear acceptance criteria help the development team understand what is required to achieve “done” for a security story.

4. Integrate security into the Definition of Done

Security tasks should be part of the Definition of Done for every sprint. This ensures that security checks, such as code reviews and penetration testing, are performed before a feature is considered complete. By making security a core part of the development process, teams can prevent security from being treated as an afterthought.

5. Conduct Security Spikes

If security requirements are complex, consider using spikes to explore potential solutions or gather more information. For example, a spike could involve researching encryption libraries or conducting a security audit to identify vulnerabilities. Spikes help teams plan and implement security features more effectively in future sprints.

6. Regularly Review and Update Security Stories

As security threats evolve, new vulnerabilities may emerge that need to be addressed. Regularly review and update the backlog to ensure that the most current security threats are covered. This could involve adding new security stories or reprioritizing existing ones based on changing risk assessments.

7. Define a fixed ratio for security user stories

As mentioned above for non-functional requirements, it is usually a very good practice to have fixed percentages of non-functional user stories. Since security user stories are non-functional user stories, you can enforce this way that security topics don’t get forgotten.

 

Conclusions

Agile development provides the flexibility and adaptability needed to keep up with today’s dynamic software environments, and Scrum stands out as probably the best framework for delivering software quickly while ensuring continuous feedback and improvement.

By incorporating both functional and non-functional features into the Scrum backlog, teams can ensure that they are delivering a product that is not only feature-rich but also secure, performant, and user-friendly.

Security, in particular, is an essential non-functional requirement that must be treated as a priority throughout the development lifecycle. By integrating security user stories into the backlog, prioritizing based on risk, and ensuring security is part of the Definition of Done, software development teams can create resilient, secure systems without sacrificing agility or speed.

The post Delivering secure software in an agile way first appeared on Sorin Mustaca on Cybersecurity.

Understanding Defense in Depth in IT Security

/in

The recent outage caused by Crowdstrike’s faulty update has create a lot of discussions. I wrote a post on LinkedIn where I asked the readers why are IT professionals using Crowdstrike on some systems that shouldn’t be in need of such protection in the first place.

The answers in various groups were mostly related to:

  • protect everything against everyone
  • assume the worse
  • assume that you are compromised.

I do not agree with such a shallow answer. And this raises a question about Defense in Depth.

Defense in Depth

Defense in Depth is a cybersecurity strategy that employs multiple layers of security controls to protect an organization’s assets and information. This approach is based on the premise that no single security measure is foolproof. By implementing several layers of defense, even if one control fails, others are in place to mitigate risks. The concept is inspired by military defense strategies, where a series of defensive positions are used to delay or prevent an attack.

A common misconception about Defense in Depth is that it requires identical security measures across all layers of an IT environment. In reality, this is neither necessary nor practical. Different layers have different requirements based on their specific functions, vulnerabilities, and the types of threats they are exposed to. Applying the same controls universally can lead to inefficiencies, increased costs, and potential performance issues.

In my opinion, this is what happened in many cases during the Crowdstrike outage: admins installed the EDR solution simply on all available devices, without doing an analysis of the threats they are exposed to. This is called threat modeling, and the first step after identifying the assets to protect is to analyze their threat landscape: this is the set of threats they are potentially exposed to. Once the potential threats are identified, then the appropriate security controls can be defined. But, it is important that the right controls are used based on the risk level of the potential threat. The mistake here is that people try to protect against any potential risk, no matter how improbable it might be. So, it is not worth to protect against every potential risk.

But, this operation is, at least at first sight, expensive, time consuming and very few people know how to do it.

So, what happens in most cases is that people consider to be cheaper to buy additional licenses and accept easily a slight reduction in performance due to the tool monitoring everything (“throw” more hardware on it).

And this might be OK, if everything works perfect all the time. Well, it doesn’t !

If this sounds too theoretical, then let’s have a closer look at various layers where applications run.

  • Running at the Web Application Layer: This layer might need strong authentication mechanisms, input validation, and encryption to protect against web-based attacks such as SQL injection or cross-site scripting (XSS).
  • Running at the Network Layer: Here, firewalls, intrusion detection systems (IDS), and virtual private networks (VPNs) are more appropriate to guard against network-based threats like DDoS attacks or unauthorized access.
  • Running at the Endpoint Layer: Devices such as laptops and mobile phones might require antivirus software, device encryption, and endpoint detection and response (EDR) solutions to prevent malware infections and data breaches.

Each layer of security addresses different risks, and the controls should be tailored to the specific threats and the environment.

For instance, a high-value database containing sensitive customer information might warrant multiple layers of encryption, strict access controls, and regular auditing. In contrast, a low-value, non-critical application might only require basic security measures.

Of course, there are applications having parts that run on more than one layer. When this happens, then you must correctly create the threat model and identify the risks at each layer.

For example, if you have a computer which just displays flights schedules, without having an interaction with the exterior other than retrieving data from an internal webservice, you probably do not need a dedicated endpoint security product for it.

Why? Because you will not allow access to the machine other than the service account for patches and running the required software.

If you’re unsure, and the machine runs Windows, than the default Defender is more than enough.

Create a Threat Model for your endpoints

If you don’t know how to create a threat model for an endpoint (and not only Windows, MacOS and Linux are equally affected), here is a list of potential threats and their mitigations.

Important note:
If you apply correctly the principles of Defense in Depth, you will NEVER all all these potential risks applicable to your devices.

Even if you remotely consider that some or all these risks can occur, do not forget that the Risk is proportional to the Probability of occurrence and Impact effect:

  • Probability of occurrence – what are the chances that the risk actually occurs: Very probably, Probably, Sometimes, Unlikely, Never.
  • Impact effect: Catastrophic, Very high, High, Medium, Low.

Potential Risks on an Endpoint

  • Malware Infections

    • Risk: Viruses, Trojans, ransomware, spyware, and other malicious software can compromise the system.
    • Security Controls:
      • Antivirus/anti-malware software
      • Regular system scans and updates
      • Application whitelisting
      • Sandboxing suspicious files
      • Backup with versioning control (good for ransomware attacks)

  • Unpatched Software

    • Risk: Vulnerabilities in outdated software can be exploited by attackers.
    • Security Controls:
      • Automated patch management systems with rollback functionality
      • Regular software updates
      • Vulnerability scanning tools
      • Centralized patch distribution

  • Unauthorized Access

    • Risk: Unauthorized users may gain access to the endpoint, leading to data breaches or system compromise.
    • Security Controls:
      • Strong password policies
      • Multi-factor authentication (MFA)
      • User account control (UAC)
      • Role-based access controls (RBAC)

  • Data Theft

    • Risk: Sensitive data may be copied, transmitted, or stolen from the endpoint.
    • Security Controls:
      • Full disk encryption (e.g., BitLocker)
      • Data loss prevention (DLP) tools
      • USB port control and removable media encryption
      • Secure backup solutions

  • Physical Theft

    • Risk: The endpoint itself may be physically stolen, leading to loss of data and access to the network.
    • Security Controls:
      • Physical security measures (locks, secure storage)
      • Device tracking and remote wipe capabilities
      • Full disk encryption
      • BIOS/UEFI passwords

  • Drive-by Downloads

    • Risk: Malicious websites may automatically download and install malware without user consent.
    • Security Controls:
      • Web filtering and browser security plugins
      • Regular updates to browsers and plugins
      • Application whitelisting
      • Disabling automatic execution of scripts in browsers

  • Network-based Attacks

    • Risk: Attackers may exploit vulnerabilities in the network to compromise the endpoint.
    • Security Controls:
      • Personal firewall
      • Network segmentation
      • Secure VPN connections
      • Intrusion detection and prevention systems (IDPS)

  • Misconfigured Security Settings

    • Risk: Insecure configurations can leave the endpoint vulnerable to attacks.
    • Security Controls:
      • Regular security audits and compliance checks
      • Hardening guides and best practices (e.g., CIS benchmarks)
      • Group policies for centralized management
      • Security baselines and templates

Potential Human Risks

Phishing Attacks

  • Risk: Users may be tricked into divulging sensitive information or downloading malicious software through deceptive emails or websites.
  • Security Controls:
    • Email filtering with anti-phishing capabilities
    • User awareness training
    • Web filtering and reputation services
    • Multi-factor authentication (MFA)

Insider Threats

  • Risk: Malicious or negligent insiders may intentionally or unintentionally cause harm.
  • Security Controls:
    • User activity monitoring and logging
    • Least privilege principle
    • Endpoint detection and response (EDR)
    • Insider threat detection tools

Instead of conclusion: Balancing Security and Usability

The most critical aspect of Defense in Depth is balancing security and usability.

Over-securing can lead to decreased productivity, increased costs, and user dissatisfaction.

For instance, implementing multi-factor authentication (MFA) at every step might significantly slow down legitimate users, leading to frustration and potential workarounds that can undermine security.

A well-designed Defense in Depth strategy finds the right balance by applying strict controls where necessary and lighter measures where the risk is lower.

The goal is to create a robust security posture that protects against a wide range of threats without overburdening the system or its users.

 

The post Understanding Defense in Depth in IT Security first appeared on Sorin Mustaca on Cybersecurity.

ISO 27001:2022 and TISAX: overlaps and differences

/in

Introduction

ISO 27001:2022 and TISAX VDA ISA 6.0 are two prominent standards in the realm of information security management, particularly within the automotive industry. While ISO 27001 provides a global framework for establishing, implementing, maintaining, and continually improving an information security management system (ISMS), TISAX (Trusted Information Security Assessment Exchange), based on the VDA ISA (Information Security Assessment) framework, is tailored to meet the specific needs of the automotive sector.

This article delves into the nuances of these two standards, highlighting their overlaps, the ways in which TISAX leverages ISO 27001, and the distinct features that set TISAX apart.

Overview of ISO 27001:2022

ISO 27001:2022 is the latest revision of the internationally recognized standard for information security management. It provides a comprehensive approach to managing sensitive company information so that it remains secure. This involves a risk management process, which includes people, processes, and IT systems by applying a risk management process.

Key Features of ISO 27001:2022

  • Risk-Based Approach: Emphasizes the identification and management of risks through a continuous improvement process.
  • Annex A Controls: Contains 93 controls categorized under four themes: Organizational, People, Physical, and Technological.
  • PDCA Cycle: The Plan-Do-Check-Act cycle is integral for continuous improvement.
  • Context of the Organization: Requires understanding of internal and external factors impacting information security.
  • Leadership Commitment: Highlights the importance of top management’s involvement in the ISMS.

Overview of TISAX VDA ISA 6.0

TISAX, a standard specific to the automotive industry, is based on the VDA ISA (Verband der Automobilindustrie Information Security Assessment) catalog. TISAX ensures that automotive manufacturers and suppliers meet strict information security requirements to protect sensitive information.

Key Features of TISAX VDA ISA 6.0

  • Sector-Specific: Tailored specifically for the automotive industry.
  • VDA ISA Catalog: Based on the VDA ISA framework, which is a detailed checklist of requirements and controls. It is split in several areas of interest:
    • Information security – containing everything that belongs to an ISMS
      • IS Policies and Organization
      • Information Security Policies
      • Organization of Information Security
      • Asset Management
      • IS Risk Management
      • Assessments
      • Incident and Crisis Management
      • Human Resources
      • Physical Security
      • Identity and Access Management
      • Identity Management
      • Access Management
      • IT Security / Cyber Security
      • Cryptography
      • Operations Security
      • System acquisitions, requirement management and development
      • Supplier Relationships
      • Compliance
    • Prototype Protection – focused on physical and cyber protection of prototypes
    • Data Protection – focused on policies for protecting privacy and secrets
  • Assessment Levels: Comprises different levels of assessment depending on the type of information and its criticality.
  • Labeling System: Provides a TISAX label indicating compliance, which can be shared with partners within the automotive ecosystem.
  • Focus on KPIs: VDA ISA provides a large set of examples on how to measure certain controls effectively.

Overlaps between ISO 27001:2022 and TISAX VDA ISA 6.0

While TISAX and ISO 27001 serve different purposes, they share several common elements. TISAX leverages the fundamental principles of ISO 27001, creating a robust framework that is both comprehensive and specific to the automotive sector.

In the VDA ISA 6.x (and previous) there are the columns “Reference to other standards” (column P) and “Reference to implementation guidance” (column Q) which point to known standards. Of course, there is no coincidence that the most reference standard is the ISO 27001 in both versions 2022 and 2013.

In the guidance we usually see reference to the Annex A of the ISO 27001 standard (both versions).

 

In the column W there is “Further information” containing explanations of what can be described by the respective control.

Risk Management

Both ISO 27001 and TISAX emphasize a risk-based approach to information security. ISO 27001 mandates a formal risk assessment process, while TISAX incorporates this through the VDA ISA requirements, ensuring that organizations identify and manage risks relevant to the automotive industry.

Control Objectives and Controls

ISO 27001:2022 and TISAX VDA ISA 6.0 share a common structure in terms of control objectives and specific controls. Many of the controls listed in Annex A of ISO 27001 are reflected in the VDA ISA catalog, ensuring a comprehensive approach to securing information.

While this is a common trait shared by the standards, the TISAX is making use of other standards than ISO 27001: NIST, BSI other ISO standards.

Continuous Improvement

Both standards advocate for continuous improvement. ISO 27001’s PDCA cycle and TISAX’s periodic reassessment and updating of security measures ensure that organizations continually enhance their security posture in response to evolving threats.

TISAX VDA ISA has a sheet called “Maturity Levels” containing descriptions of the Maturity Levels 0 to 5.

Documentation and Record-Keeping

ISO 27001 requires detailed documentation of the ISMS, including risk assessments, policies, and procedures. TISAX also mandates thorough documentation as part of its assessment criteria, ensuring that organizations maintain a clear record of their security practices.

Third-Party Management/Suppliers Relationships

Third-party risk management is a critical component in both standards. ISO 27001 includes controls for managing supplier relationships and ensuring their compliance with information security requirements. Similarly, TISAX places a strong emphasis on securing information exchanged with suppliers and partners, crucial for maintaining the integrity of the automotive supply chain.

Differences between ISO 27001:2022 and TISAX VDA ISA 6.0

Despite their overlaps, ISO 27001 and TISAX have several distinctions, reflecting their different scopes and target audiences.

Industry Focus

ISO 27001 is a generic standard applicable to any organization, regardless of its sector. TISAX, however, is designed specifically for the automotive industry, addressing unique challenges such as the secure exchange of data between manufacturers and suppliers.

Assessment Process

ISO 27001 involves a formal certification process conducted by accredited bodies, leading to ISO 27001 certification. TISAX, on the other hand, employs a mutual assessment model where organizations are assessed by ENX approved audit providers, and successful assessments result in a TISAX label. This label can then be shared with other automotive industry stakeholders, facilitating trust and compliance.

Control Specificity

While ISO 27001 provides a broad framework of controls applicable to various industries, TISAX’s controls are highly specific to the automotive sector. The VDA ISA catalog includes detailed requirements for protecting manufacturing data, ensuring compliance with industry-specific regulations, and safeguarding automotive intellectual property.

Levels of Assessment

TISAX introduces different levels of assessment (Basic(Must and Should), High, and Very High) depending on the sensitivity and criticality of the information being protected. ISO 27001 does not have a tiered assessment system but rather a uniform certification standard.

Focus Areas

TISAX places significant emphasis on physical security, secure development of automotive products, and compliance with industry-specific legal requirements. ISO 27001, while comprehensive, does not delve into sector-specific issues with the same level of detail.

Commercial vs Open standards

ISO 27001 is an open international standard governed by the Internation Standards Organisation (ISO). The TISAX trademark is owned by the organization ENX, formed by many OEMs in automotive sector.

 

Implementation of TISAX Using ISO 27001

TISAX leverages ISO 27001’s framework to build a robust and industry-specific information security system. Many organizations begin with ISO 27001 certification and then adapt their ISMS to meet the additional requirements of TISAX.

Integration of Standards

  1. Foundation in ISO 27001: Organizations often establish a basic ISMS in accordance with ISO 27001. This includes conducting risk assessments, implementing controls, and ensuring continuous improvement.
  2. Customization to TISAX Requirements: Once the foundational ISMS is in place, organizations tailor it to meet TISAX requirements, which may involve additional controls specific to automotive data security and third-party management.
  3. Assessment and Labeling: Organizations undergo a TISAX assessment conducted by an approved audit provider. Successful completion results in the issuance of a TISAX label, demonstrating compliance with industry-specific security requirements.

Benefits of Integration

Integrating ISO 27001 with TISAX offers several benefits:

  • Streamlined Compliance: Simplifies the process of meeting both generic and sector-specific security requirements.
  • Enhanced Trust: The TISAX label, backed by ISO 27001’s rigorous framework, enhances trust among automotive industry partners.
  • Cost Efficiency: Leveraging ISO 27001 as a foundation reduces duplication of effort and resources in implementing security measures.

Conclusion

ISO 27001:2022 and TISAX VDA ISA 6.0 represent critical standards for information security, particularly within the automotive sector. While they share common principles such as risk management and continuous improvement, TISAX’s industry-specific focus and detailed requirements for automotive set it apart. By leveraging the robust framework of ISO 27001, organizations can start to effectively implement TISAX, ensuring comprehensive protection of sensitive automotive data and fostering trust within the industry.

Understanding the connections between these standards and their unique requirements is very important for organizations aiming to achieve a high level of information security and compliance.

The post ISO 27001:2022 and TISAX: overlaps and differences first appeared on Sorin Mustaca on Cybersecurity.

Understanding the SOC 2 Certification

/in

Introduction

SOC 2 (Service Organization Control 2) certification is a framework designed by the American Institute of CPAs (AICPA) to help organizations manage customer data based on five Trust Service Criteria: , confidentiality,processing integrity, availability, security and privacy. This certification is crucial for service organizations that store or process customer data in the cloud.

Comparison of Various SOC Certification Versions

SOC 1 (Service Organization Control 1)

  • Focus: SOC 1 is centered around internal control over financial reporting. It is particularly relevant for service organizations that impact their clients’ financial statements.
  • Users: Primarily used by financial auditors and companies that outsource services impacting financial operations.
  • Types: There are two types of SOC 1 reports:
    • Type I: Assesses the suitability of the design of controls at a specific point in time.
    • Type II: Examines the effectiveness of controls over a defined period.

SOC 2 (Service Organization Control 2)

  • Focus: SOC 2 addresses controls relevant to security, availability, processing integrity, confidentiality, or privacy, based on the AICPA’s Trust Services Criteria.
  • Users: Useful for management, customers, regulators, and other stakeholders concerned with information security and privacy.
  • Types: Like SOC 1, SOC 2 also offers Type I and Type II reports, focusing either on the design of controls at a point in time or their effectiveness over time.

Note: There is also SOC 3, but it is out of scope of this article.

 

Who Should Certify?

SOC 2 certification is essential for any organization that handles customer data, particularly cloud service providers, SaaS companies, and data centers.

It’s also relevant for companies in healthcare, finance, and other sectors where data security is paramount.

Why Certify?

Organizations pursue SOC 2 certification to demonstrate their commitment to data security, build customer trust, and comply with industry regulations. It also helps them stand out in competitive markets and avoid the financial and reputational damage associated with data breaches.

What Is Certified?

SOC 2 certification verifies that an organization adheres to robust information security policies and procedures. The certification evaluates five trust service criteria:

  1. Security: Protection of system resources against unauthorized access.
  2. Availability: Accessibility of the system as agreed upon.
  3. Processing Integrity: System processing is complete, valid, accurate, timely, and authorized.
  4. Confidentiality: Protection of confidential information.
  5. Privacy: Collection, use, retention, and disposal of personal information is in line with the organization’s privacy notice.

While some security frameworks like ISO 27001, PCI DSS, TISAX, HIPAA  have rigid requirements, SOC 2 considers that controls are unique to every organization.

Each company designs its own controls to comply with its Trust Services Criteria.

An independent auditor is then brought in to verify whether the company’s controls satisfy SOC 2 requirements.

After the audit, the auditor writes a report about how well the company’s systems and processes comply with SOC 2.

Every organization that completes a SOC 2 audit receives a report, regardless of whether they passed the audit.

There are two types of SOC 2 reports:

  • SOC 2 Type I reports evaluate a company’s controls at a single point in time. It answers the question: are the security controls designed properly?
  • SOC 2 Type II reports assess how those controls function over a period of time, generally 3-12 months. It answers the question: do the security controls a company has in place function as intended?

To choose between the two, consider your goals, cost, and timeline constraints.

A Type I report can be faster to achieve, but a Type II report offers greater assurance to your customers.

 

 

Topics Verified in SOC 2 Certification

1. Security

The Security Criteria are also known as the Common Criteria. They prove that a service organization’s systems and control environment are protected against unauthorized access and other risks.

Security is the only Trust Services Criteria required for every SOC 2 audit. The other criteria can be added to your report scope if your organization chooses, but they are not required to achieve SOC 2 compliance.

These are the security criteria needed for SOC 2:

  • CC1 — Control environment
    Does the organization value integrity and security?
  • CC2 — Communication and Information
    Are policies and procedures in place to ensure security? Are they communicated well to both internal and external partners?
  • CC3 — Risk Assessment
    Does the organization analyze risk and monitor how changes impact that risk?
  • CC4 — Monitoring Controls
    Does the organization monitor, evaluate, and communicate the effectiveness of its controls?
  • CC5 — Control Activities
    Are the proper controls, processes, and technologies in place to reduce risk?
  • CC6 – Logical and Physical Access Controls
    Does the organization encrypt data? Does it control who can access data and restrict physical access to servers?
  • CC7 – System Operations
    Are systems monitored to ensure they function properly? Are incident response and disaster recovery plans in place?
  • CC8 – Change Management
    Are material changes to systems properly tested and approved beforehand?
  • CC9 – Risk Mitigation
    Does the organization mitigate risk through proper business processes and vendor management?

Implementation: Organizations must establish and maintain a set of security controls to protect against unauthorized access. This includes firewalls, encryption, access controls, and intrusion detection systems.

Audit: Auditors examine security policies, test the effectiveness of security controls, and review incident response plans.

Responsibility: Chief Information Security Officers (CISOs) and IT security teams are typically responsible for implementing and maintaining these controls.

2. Availability

Implementation: Ensuring systems are available involves implementing redundancy, disaster recovery plans, and maintaining system performance monitoring.

Audit: Auditors assess the organization’s ability to meet service level agreements (SLAs) and review backup and recovery procedures.

Responsibility: IT operations teams and service managers oversee availability aspects.

3. Processing Integrity

Implementation: Organizations must ensure that data processing is accurate and complete. This includes validating input data, processing logic, and output accuracy.

Audit: Auditors review data processing controls, check for errors, and validate processing integrity.

Responsibility: Data quality teams and IT personnel are responsible for maintaining processing integrity.

4. Confidentiality

Implementation: Protecting confidential information involves data encryption, access controls, and secure storage solutions.

Audit: Auditors evaluate the measures in place to protect confidential data and check compliance with confidentiality agreements.

Responsibility: Data protection officers (DPOs) and compliance teams handle confidentiality matters.

5. Privacy

Implementation: Organizations must adhere to privacy policies that govern the collection, use, and disposal of personal data. This involves data anonymization and consent management.

Audit: Auditors examine privacy policies, consent forms, and data handling procedures to ensure compliance with relevant privacy laws.

Responsibility: Privacy officers and legal teams are responsible for privacy compliance.

Conclusion

SOC 2 certification is a comprehensive framework that ensures organizations adhere to best practices in data security and management.

By certifying under SOC 2, organizations can demonstrate their commitment to protecting customer data, comply with regulatory requirements, and gain a competitive edge in the market.

Implementing and maintaining SOC 2 controls requires collaboration across various teams, including IT, security, operations, and legal departments, to ensure continuous compliance and security.

The post Understanding the SOC 2 Certification first appeared on Sorin Mustaca on Cybersecurity.

Introduction to CISA’s Secure by Design Initiative

/in

 

What is Secure by Design?

Secure by Design products are those where the security of the customers is a core business requirement, not just a technical feature. Secure by Design principles should be implemented during the design phase of a product’s development lifecycle to dramatically reduce the number of exploitable flaws before they are introduced to the market for broad use or consumption. Products should be secure to use out of the box, with secure configurations enabled by default and security features such as multi-factor authentication (MFA), logging, and single sign on (SSO) available at no additional cost. (Source)

Secure by Design is an initiative by the Cybersecurity and Infrastructure Security Agency (CISA) aimed at integrating cybersecurity practices into the design and development phases of technology products and systems. The goal is to ensure that security is considered a fundamental element from the outset, rather than an afterthought. This approach helps in reducing vulnerabilities and enhancing the resilience of systems against evolving cyber threats.

Sounds familiar?

Yes, because we know for the past 20 years or more the Microsoft initiative:   Secure by design – Secure by default – Secure operations

 

 

 

Who Should Be Interested?

This initiative is crucial for software developers, system designers, engineers, and manufacturers involved in creating and deploying digital solutions. It is also vital for policy makers and business leaders who oversee the management and governance of cybersecurity risks in their organizations.

Why Is It Important?

Incorporating cybersecurity measures early in the design process can significantly mitigate risks, reduce costs associated with addressing security flaws after deployment, and improve consumer trust. Secure by Design supports not only the protection of individual products but also the overall security posture of national infrastructure and business ecosystems.

Focus of the Initiative

The primary focus of the Secure by Design initiative is to create a systematic, standardized approach to cybersecurity, ensuring that every phase of technology development includes security as a core component. This involves collaborative efforts among stakeholders to adopt best practices that promote security from the initial stages of product and system development.

Topics Covered by the Initiative

Development and Implementation of Security Practices

  • Guidelines for integrating security into software development life cycles (SDLC).
  • Establishment of security benchmarks and standards for new technologies.

Stakeholder Collaboration

  • Engagement with private sector, academia, and international bodies to harmonize security standards.
  • Public-private partnerships to advance security innovations and solutions.

Regulatory Compliance and Risk Management

  • Frameworks for compliance with emerging laws and standards in cybersecurity.
  • Strategies for risk assessment and management integrated into the design process.

Implementation and Auditing

How to Implement

  • Create a Secure Software Development Lifecycle with security protocols and checklists tailored to each stage of the design and development processes.
  • Incorporate automated security testing tools to assess vulnerabilities during the development phase.
  • Continuous monitoring and updating of security measures as part of ongoing maintenance.

Auditing

  • Regular security audits conducted by internal or third-party auditors to ensure adherence to established standards.
  • Use of automated auditing tools to provide ongoing assessments of security posture.

Responsibility and Governance

Who Is Responsible?

  • Chief Information Security Officers (CISOs) and IT managers are primarily responsible for overseeing the implementation of Secure by Design principles.
  • Developers, engineers, and product managers are accountable for incorporating these principles into their workflows and outputs.

Governance

  • Establishment of a governance structure to enforce security standards and practices.
  • Regular reviews and updates to security policies to align with technological advancements and threat landscapes.

Conclusion and further steps

CISA’s Secure by Design initiative represents a proactive shift in cybersecurity strategy, emphasizing the importance of integrating security at the foundational level of technology development. By fostering a collaborative environment among all stakeholders, it aims to standardize and strengthen cybersecurity practices across industries, thereby enhancing the security and resilience of digital infrastructures and systems.

 

CISA’s Secure by Design Alert Series

highlights the prevalence of widely known and documented vulnerabilities, with available and effective mitigations, that have not been eliminated. Alerts are released in response to threat actor activity, but further demonstrate how secure by design software development can help reasonably protect against malicious cyber actors successfully exploiting predictable and well-known vulnerabilities.

Check here their page for Alerts: https://www.cisa.gov/securebydesign/alerts

Secure by Design Blogs

Learn what’s top of mind at CISA and our efforts to help make technology products secure by design.

https://www.cisa.gov/securebydesign/blogs

The post Introduction to CISA’s Secure by Design Initiative first appeared on Sorin Mustaca on Cybersecurity.

Implementing ISO 27001:2022 Annex A.18 – Compliance

/in

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented.

Today we end the series with ISO 27001:2022 Annex A.18, “Compliance”, which addresses the importance of ensuring that organizations comply with relevant laws, regulations, contractual agreements, and other requirements related to information security. This annex focuses on ensuring that the organization identifies and adheres to all applicable legal, statutory, regulatory, and contractual requirements regarding information security and the requirements of the ISMS itself.

Understanding the Importance of Compliance

Annex A.18 is divided into several controls designed to help organizations manage and demonstrate compliance with various information security requirements.

These controls aim to prevent breaches of legal, statutory, regulatory, or contractual obligations related to information security and the security requirements of the organization.

Compliance with legal, regulatory, and contractual requirements is essential for organizations to maintain the confidentiality, integrity, and availability of information assets and mitigate legal and regulatory risks.

Annex A.18 emphasizes several key aspects:

  • Legal and Regulatory Requirements: Identifying and understanding applicable laws, regulations, and industry standards related to information security.
  • Contractual Obligations: Ensuring compliance with contractual agreements, service level agreements (SLAs), and data protection agreements with customers, partners, and suppliers.
  • Risk Management: Assessing and mitigating legal and regulatory risks associated with non-compliance, including financial penalties, legal liabilities, and damage to reputation.

Key Controls in Annex A.18:

  • A.18.1.1 Identification of Applicable Legislation and Contractual Requirements: Identify all relevant requirements that the organization must comply with.
  • A.18.1.2 Intellectual Property Rights (IPR): Ensure protection of IPR, covering software, information content, and patents.
  • A.18.1.3 Protection of Records: Securely manage records in accordance with legal, regulatory, and contractual requirements.
  • A.18.1.4 Privacy and Protection of Personally Identifiable Information: Ensure the protection of personal information as per privacy laws and other requirements.
  • A.18.1.5 Regulation of Cryptographic Controls: Use cryptographic controls as required by legislation, regulations, and agreements.

Practical Implementation of Annex A.18

Legal and Regulatory Compliance Assessment

Practical Examples

  1. Regulatory Mapping: Identify and map relevant legal and regulatory requirements, such as data protection laws (e.g., GDPR, CCPA), industry standards (e.g., PCI DSS, HIPAA), and sector-specific regulations (e.g., SOX for financial services).
  2. Compliance Assessment: Conduct compliance assessments to evaluate the organization’s adherence to legal and regulatory requirements, including data protection principles, security controls, and breach notification obligations.

Contractual Compliance Management

Practical Examples

  1. Contract Review: Review contractual agreements, SLAs, and data processing agreements to identify information security requirements, confidentiality obligations, data protection clauses, and compliance obligations.
  2. Compliance Monitoring: Monitor compliance with contractual agreements by tracking performance metrics, service levels, and adherence to contractual terms and conditions.

Risk Management and Compliance Monitoring

Practical Examples

  1. Risk Assessment: Assess legal and regulatory risks associated with non-compliance, including financial penalties, legal liabilities, and reputational damage, and implement measures to mitigate these risks.
  2. Compliance Monitoring: Establish processes for ongoing compliance monitoring, including periodic reviews, audits, and assessments to ensure adherence to legal, regulatory, and contractual requirements.

We know Compliance is hard, so here are some more examples:

More examples

  1. Compliance Framework Development
    • Example: A multinational corporation needs to comply with the GDPR for its operations in Europe and the CCPA for those in California.
    • Implementation: Establish a compliance framework that identifies all applicable legal and regulatory requirements for each region of operation. Maintain a database of these requirements and update it as laws evolve.
  2. Training and Awareness
    • Example: An organization handling sensitive patient data under HIPAA must ensure that all employees are aware of the requirements.
    • Implementation: Develop ongoing training programs and workshops to educate employees about their responsibilities under relevant laws and how these impact their day-to-day operations.
  3. Auditing and Monitoring
    • Example: A financial services firm regularly audits its data handling practices to ensure compliance with the Sarbanes-Oxley Act.
    • Implementation: Implement a schedule for regular audits, both internal and external, to assess compliance with legal and contractual obligations. Use automated tools to monitor compliance continuously.
  4. Handling Intellectual Property
    • Example: A software development company uses proprietary code that needs to be protected under copyright laws.
    • Implementation: Implement IPR controls, including secure storage, access controls, and regular audits of IPR usage and adherence to licensing agreements.
  5. Privacy Management
    • Example: A retail company collects customer data and needs to comply with privacy laws in multiple jurisdictions.
    • Implementation: Deploy a privacy management solution that helps in classifying, managing, and protecting personal data in compliance with all applicable privacy laws.

Auditing Annex A.18 Implementation

The audit process for ISO 27001:2022’s Annex A.18 involves verifying that the organization has effectively implemented the controls to meet compliance requirements. The audit typically includes:

  1. Document Review: Review policies, procedures, compliance records, training records, audit reports, and any actions taken on previous audit findings.
  2. Interviews: Discuss with management and staff to assess their understanding and implementation of compliance controls.
  3. Observation: Observe processes and controls in operation to verify that they function as intended.
  4. Compliance Verification: Check compliance with specific legal, regulatory, and contractual requirements through evidence collection and analysis.
  5. Report Findings: Provide a detailed report of the audit findings with recommendations for improvement if any non-conformities are found.

Conclusion

Effective implementation of ISO 27001:2022 Annex A.18 ensures that an organization not only meets its legal and contractual obligations but also demonstrates a commitment to comprehensive information security management.

By establishing a structured compliance program and conducting thorough audits, organizations can maintain high standards of information security and build trust with stakeholders.

The post Implementing ISO 27001:2022 Annex A.18 – Compliance first appeared on Sorin Mustaca on Cybersecurity.

Maping NIS2 requirements to the ISO 27001:2022 framework

/in

We described here the process needed to perform a gap analysis for NIS2, but we did not add the details on how to approach this.

This article references on the ISO27001:2022 series, especially on the description of the Annex A controls. Make sure you are familiar with the ISO 27oo1:2022 requirements and the with the Annex A.

Introduction

The NIS2 Directive, aimed at strengthening network and information system security across the European Union, necessitates a thorough alignment with the latest iteration of the ISO 27001 standard, which was updated in 2022. This article explores a comprehensive methodology for conducting a gap analysis to ensure compliance with NIS2 using the framework provided by ISO 27001:2022.

Understand NIS2 Requirements

The NIS2 Directive expands upon its predecessor by setting stringent cybersecurity and resilience measures for essential and important entities across various sectors. Its key focus areas include incident response, supply chain security, and the security of network and information systems. These areas are critical in maintaining the integrity and availability of services that are vital to the internal market and public welfare.

 

The NIS2 Directive does not prescribe a specific set of controls for the affected companies.

Rather, it states that they should adopt measures that are appropriate to their specific risk profile, considering factors such as:

  • The state of the art in cybersecurity

  • The potential impact of incidents on their services

  • The costs of implementing the measures

  • The proportionality between the measures and the risks

The directive also refers to existing standards, guidelines, and best practices that can help entities to choose suitable controls.
For example, it mentions:

  • The NIST Cybersecurity Framework

  • The ENISA Good Practices for Security of Internet of Things

  • The ETSI Technical Specification on Critical Security Controls for Effective Cyber Defense

 

Read here our collection of articles about the NIS2 directive.

Overview of ISO 27001:2022

ISO 27001:2022 establishes requirements for an Information Security Management System (ISMS), providing a systematic approach to managing sensitive company information so that it remains secure.

It includes people, processes, and IT systems by applying a risk management process and clearly defines information security control requirements in its Annex A .

 

Similarities

Despite the differences in scope, objectives, requirements and controls, there are some similarities between the NIS2 Directive and the ISO 27001:2022 standard.

Here are the most evident similarities :

  • Risk management: Both frameworks are based on the concept of risk management, which involves identifying, analyzing, evaluating, and treating the information security risks that affect the organization or the service.

  • Involvement and commitment of top management: Both frameworks require the involvement and commitment of top management, who are responsible for ensuring that the appropriate resources, roles and responsibilities are allocated to support the implementation and maintenance of the measures.

  • Importance of continuous improvement: Both frameworks emphasize the importance of continuous improvement, which involves monitoring, measuring, reviewing, and updating the measures to ensure they remain effective and relevant in a changing environment.

  • Cooperation and information sharing: Both frameworks encourage cooperation and information sharing among relevant stakeholders, such as authorities, regulators, customers, suppliers, and peers, to enhance the overall level of cybersecurity.

Mapping NIS2 to ISO27001:2022 requirements

The mapping begins with identifying the specific NIS2 requirements that are applicable to the organization.

Step 1: Identify NIS2 requirements

1. Scope of Application

  • Expansion of Affected Entities: NIS2 extends its requirements beyond the sectors covered by the original NIS Directive, including essential and important entities across various sectors such as energy, transport, health, and digital services.

2. Risk Management Measures

  • Comprehensive Security Requirements: Entities are required to implement appropriate technical and organizational measures to manage the risks posed to the security of network and information systems, including measures for incident handling, business continuity, and supply chain security.

3. Incident Response and Reporting

  • Incident Reporting Obligations: NIS2 mandates strict incident reporting requirements, where entities must notify relevant national authorities about significant cybersecurity incidents with potentially severe operational impacts, within a short timeframe.

4. Supply Chain Security

  • Security of Supply Chains and Supplier Relationships: Entities need to address cybersecurity risks not only within their own operations but also across their supply chains, ensuring that suppliers meet security requirements to protect against potential vulnerabilities and threats.

5. Interoperability and Cooperation

  • Enhanced Cooperation Among States: NIS2 emphasizes improved information sharing and coordinated response among EU member states, with mechanisms for cross-border collaboration in cybersecurity threat detection, response, and recovery.

6. Security and Network Systems

  • Strengthening of Security Practices: Detailed requirements on securing network and information systems, ensuring the integrity, availability, and confidentiality of services, particularly in critical infrastructure sectors.

7. Regulatory Oversight and Compliance

  • Increased Enforcement Powers: Regulatory authorities are granted more significant powers to enforce the Directive, including the ability to conduct audits, review compliance, and impose sanctions on entities failing to meet the cybersecurity requirements.

8. Financial Penalties

  • Penalties for Non-Compliance: NIS2 introduces substantial financial penalties for non-compliance, aimed at ensuring that entities take their cybersecurity obligations seriously.

9. Cybersecurity Measures Specificity

  • Detailed Guidelines and Standards: The Directive encourages the use of established standards and specifications to fulfill the required security measures, promoting best practices in cybersecurity management.

 

This step involves a detailed review of NIS2, focusing on the obligations that directly impact the organizational processes and security measures.

Step 2: Map requirements to the ISO 27001:2022 chapters

The next step is to map relevant chapters and controls in ISO 27001:2022 to these NIS2 requirements:

  • Chapter 4 (Context of the Organization) -> NIS2 1,4,5
    • Understand external and internal issues that affect the ISMS, aligning with NIS2’s broader security requirements.
    • Identify if the company is falling into the two entity categories: Important and Essential.
    • An important step is also to identify and assess all external suppliers.
  • Chapter 5 (Leadership) -> NIS2 1,5,8
    • Ensures management’s commitment to the ISMS, mirroring NIS2’s emphasis on leadership and governance in cybersecurity.
  • Chapter 6 (Planning) -> NIS2 2,3,4,6 
    • Address the assessment and treatment of information security risks, a core component of proactive compliance under NIS2.
    • Conduct a risk assessment to identify threats, vulnerabilities, and impacts on information assets.
    • Develop a risk treatment plans to address identified risks, including mitigation, transfer, or acceptance.
  • Chapter 7 (Support) -> 5,7,9
    • Provide the framework for managing resources and operational planning,
    • Establish communication channels for reporting security incidents and seeking guidance on information security matters.
  • Chapter 8 (Operation) -> NIS2 2,3,4,6
    • Provide the framework for managing resources and operational planning, establishes incident response and business continuity plans to mitigate the impact of security incidents and disruptions, crucial for implementing the technical and organizational measures required by NIS2.
  • Chapter 9 (Performance Evaluation) -> NIS2 8,9
    • Assess the performance of the ISMS, helping to ensure continuous improvement in line with NIS2’s dynamic compliance landscape.

Disclaimer:
This mapping is author’s own interpretation based on his personal opinion and understanding of the requirements. It is not the only possible interpretation and it is most probably not the best one available.

 

Conclusion

By mapping NIS2 requirements to the structured framework provided by ISO 27001:2022, organizations can not only ensure compliance but also strengthen their overall security posture.

It is important to understand that this alignment is not a one-time effort but a continuous process of adaptation and improvement, reflecting the dynamic nature of cybersecurity threats and regulatory requirements.

As such, organizations should focus on regular reviews and updates to their ISMS, ensuring that it remains robust, responsive, and compliant.

The post Maping NIS2 requirements to the ISO 27001:2022 framework first appeared on Sorin Mustaca on Cybersecurity.

Implementing ISO 27001:2022 Annex A.17 – Information Security Aspects of Business Continuity Management

/in

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented.

Today we address ISO 27001:2022 Annex A.17, “Information Security Aspects of Business Continuity Management” is crucial for organizations to ensure the resilience of their information security management systems (ISMS) in the face of disruptive events.

This annex provides guidelines for integrating information security into business continuity management processes to minimize the impact of disruptions and ensure the continuity of critical business operations.

Understanding the Importance of Business Continuity Management

Annex A.17 of ISO 27001:2022 outlines the controls necessary to ensure that information security is an integral part of the organization’s business continuity management. The annex emphasizes the need to prepare for, respond to, and recover from incidents that can impact the availability of critical information assets.

Business continuity management (BCM) is essential for organizations to prepare for and respond to disruptions that could affect their ability to deliver products and services.

Annex A.17 emphasizes several key aspects:

  • Risk Assessment: Identifying and assessing risks that could disrupt business operations and impact information security.
  • Business Impact Analysis: Evaluating the potential consequences of disruptions on critical business processes and information assets.
  • Business Continuity Planning: Developing and implementing strategies and procedures to maintain essential functions during and after disruptive events.
  • Testing and Exercise: Conducting regular testing and exercises to validate the effectiveness of business continuity plans and improve response capabilities.

 

Key Controls in Annex A.17:

  • A.17.1 Information Security Continuity: Ensure that information security continuity is embedded within the organization’s overall business continuity management systems.
  • A.17.2 Redundancies: Implement redundancy measures to ensure availability of information processing facilities.

Practical Implementation of Annex A.17

  1. Risk Assessment and Business Impact Analysis (BIA):
    • Example: An e-commerce company assesses the impact of a server downtime on its operations. The BIA shows significant revenue loss for each hour of downtime.
    • Implementation: Develop and implement continuity strategies based on the results of BIA. This includes identifying critical systems and processes and the extent of their protection.
  2. Establishing Redundancy and Resilience:
    • Example: A financial institution uses multiple data centers in geographically diverse locations to ensure data availability even in the case of a natural disaster.
    • Implementation: Invest in redundant hardware, failover systems, and data mirroring techniques to ensure continuous service and data availability.
  3. Developing and Implementing Business Continuity Plans:
    • Example: A healthcare provider ensures that all critical patient information systems have backups and are capable of being restored quickly in any emergency.
    • Implementation: Prepare detailed business continuity plans that include recovery objectives, strategies, and employee responsibilities. Regularly train staff on their roles during a disruption.
  4. Testing and Exercises:
    • Example: A technology firm conducts bi-annual drills to simulate different scenarios including cyber-attacks and power failures.
    • Implementation: Regular testing and rehearsal of business continuity plans to evaluate their effectiveness and make necessary adjustments.
  5. Embedding Information Security into Business Continuity:
    • Example: Incorporate cybersecurity measures into the business continuity plans of an online retailer to protect against data breaches during disruptions.
    • Implementation: Ensure that information security practices are maintained during a disruption, including access controls, encryption, and secure communication channels.

Auditing Annex A.17 Implementation

The audit of ISO 27001:2022’s Annex A.17 focuses on verifying that the business continuity plans and controls are in place, effective, and in alignment with the organization’s overall security policies. The audit process typically involves the following steps:

  1. Documentation Review: Auditors review all relevant documentation including the business impact analysis, risk assessments, continuity plans, and previous audit reports.
  2. Interviews: Conduct interviews with key personnel involved in business continuity management to assess their understanding and implementation of the policies.
  3. Observation and Testing: Direct observation of drills and testing processes, and reviewing logs and records to verify that procedures are regularly executed and monitored.
  4. Report Findings and Recommendations: Provide a detailed report of findings with any non-conformities and suggest corrective actions.

Conclusion

Implementing Annex A.17 of ISO 27001:2022 effectively ensures that an organization can protect its critical information assets during disruptions. By following structured implementation and regular audits, organizations can not only comply with ISO 27001 but also enhance their resilience against unforeseen events, thereby safeguarding their operations and reputation in the long term.

The post Implementing ISO 27001:2022 Annex A.17 – Information Security Aspects of Business Continuity Management first appeared on Sorin Mustaca on Cybersecurity.

Executive summary: NIS2 Directive for the EU members (updated)

/in

The NIS 2 Directive is a set of cybersecurity guidelines and requirements established by the European Union (EU) . It replaces and repeals the NIS Directive (Directive 2016/1148/EC) . The full name of the directive is “Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)” .

The NIS 2 Directive aims to improve cybersecurity risk management and introduce reporting obligations across sectors such as energy, transport, health, and digital infrastructure . It provides legal measures to boost the overall level of cybersecurity in the EU .

The directive covers a larger share of the economy and society by including more sectors, which means that more entities are obliged to take measures to increase their level of cybersecurity .

The management bodies of essential and important entities must approve the cybersecurity risk-management measures taken by those entities, oversee its implementation, and can be held liable for infringements .

 

Who is affected?

The NIS 2 Directive significantly expands the sectors and type of critical entities falling under its scope.

As a ground rule, companies from certain areas that meet these conditions are affected:

Essential Entities (EE):

  • at least 250 employees and
  • 50 Mil € revenue

Important Entities (IE):

  • at least 50 employees and
  • 10 Mil € revenue

 

NIS 2 covers areas such as

  • Essential Entities:
    • energy (electricity, district heating and cooling, oil, gas and hydrogen);
    • transport (air, rail, water and road); banking;
    • financial market infrastructures;
    • health including  manufacture of pharmaceutical products including vaccines;
    • drinking water;
    • waste water;
    • digital infrastructure (internet exchange points; DNS service providers;
    • TLD name registries; cloud computing service providers;
    • data centre service providers;
    • content delivery networks;
    • trust service providers;
    • providers of  public electronic communications networks and publicly available electronic communications services);
    • ICT service management (managed service providers and managed security service providers), public administration and space.

Important Entities:

    • postal and courier services;
    • waste management;
    • chemicals;
    • food;
    • manufacturing of medical devices, computers and electronics, machinery and equipment, motor vehicles, trailers and semi-trailers and other transport equipment;
    • digital providers (online market places, online search engines, and social networking service platforms) and research organisations.

Note:
An entity may still be considered “essential” or “important” even if it does not meet the size criteria, in specific cases such as when it is the sole provider of a critical service for societal or economic activity in a Member State.

 

Deadlines

The Member States have until October 17, 2024, to adopt and publish the measures necessary to comply with the NIS 2 Directive. They shall apply those measures from October 18, 2024 .

The benefits of the NIS 2 directive include creating the necessary cyber crisis management structure (CyCLONe), increasing the level of harmonization regarding security requirements and reporting obligations, encouraging Members States to introduce new areas of interest such as supply chain, vulnerability management, core internet, and cyber hygiene in their national cybersecurity strategies, bringing novel ideas such as peer reviews for enhancing collaboration and knowledge sharing amongst Member States .

In order to comply with the NIS 2 directive, entities will need to take measures to increase their level of cybersecurity. This may include following training for members of management bodies of essential and important entities as well as offering similar training to their employees on a regular basis .

How does the NIS 2 Directive differ from the previous directive?

The NIS 2 Directive replaces the previous Network and Information Security (NIS) Directive, which was the first piece of EU-wide legislation on cybersecurity. Its specific aim was to achieve a high common level of cybersecurity across the Member States .

While the NIS Directive increased the Member States’ cybersecurity capabilities, its implementation proved difficult, resulting in fragmentation at different levels across the internal market. To respond to the growing threats posed by digitalization and the surge in cyber-attacks, the Commission submitted a proposal to replace the NIS Directive and thereby strengthen security requirements, address security of supply chains, streamline reporting obligations, and introduce more stringent supervisory measures and stricter enforcement requirements, including harmonized sanctions across the EU .

 

Consequences

The proposed expansion of the scope covered by NIS 2, by effectively obliging more entities and sectors to take measures, would assist in increasing the level of cybersecurity in Europe in the longer term . The NIS 2 Directive establishes very strict sanctions for breaches of its obligations. In contrast to the previous NIS Directive, which merely required Member States to set forth effective, proportionate and dissuasive penalties for non-compliance, the NIS 2 Directive introduces a much stricter regime .

NIS 2 will introduce a fining regime for non-compliance. The potential maximum fines for non-compliance could reach either

(i) €10 million or 2% of global annual turnover for “essential” entities or

(ii) €7 million or 1.4% of global annual turnover for “important” entities .

What’s next, if you are in a hurry

Try to identify the following topics in your ISMS and map them to the NIS2 requirements.

1. Scope of Application

  • Expansion of Affected Entities: NIS2 extends its requirements beyond the sectors covered by the original NIS Directive, including essential and important entities across various sectors such as energy, transport, health, and digital services.

2. Risk Management Measures

  • Comprehensive Security Requirements: Entities are required to implement appropriate technical and organizational measures to manage the risks posed to the security of network and information systems, including measures for incident handling, business continuity, and supply chain security.

3. Incident Response and Reporting

  • Incident Reporting Obligations: NIS2 mandates strict incident reporting requirements, where entities must notify relevant national authorities about significant cybersecurity incidents with potentially severe operational impacts, within a short timeframe.

4. Supply Chain Security

  • Security of Supply Chains and Supplier Relationships: Entities need to address cybersecurity risks not only within their own operations but also across their supply chains, ensuring that suppliers meet security requirements to protect against potential vulnerabilities and threats.

5. Interoperability and Cooperation

  • Enhanced Cooperation Among States: NIS2 emphasizes improved information sharing and coordinated response among EU member states, with mechanisms for cross-border collaboration in cybersecurity threat detection, response, and recovery.

6. Security and Network Systems

  • Strengthening of Security Practices: Detailed requirements on securing network and information systems, ensuring the integrity, availability, and confidentiality of services, particularly in critical infrastructure sectors.

7. Regulatory Oversight and Compliance

  • Increased Enforcement Powers: Regulatory authorities are granted more significant powers to enforce the Directive, including the ability to conduct audits, review compliance, and impose sanctions on entities failing to meet the cybersecurity requirements.

8. Financial Penalties

  • Penalties for Non-Compliance: NIS2 introduces substantial financial penalties for non-compliance, aimed at ensuring that entities take their cybersecurity obligations seriously.

9. Cybersecurity Measures Specificity

  • Detailed Guidelines and Standards: The Directive encourages the use of established standards and specifications to fulfill the required security measures, promoting best practices in cybersecurity management.

 

By addressing these key topics, NIS2 aims to significantly raise the level of cybersecurity across the EU, ensuring a uniform level of security in critical sectors and enhancing the resilience of the internal market against cyber threats.

Sources:
1. cybertalk.org
2. nis-2-directive.com
3. digital-strategy.ec.europa.eu
4. enisa.europa.eu
5. europarl.europa.eu
6. mondaq.com
7. rapid7.com
8. https://digital-strategy.ec.europa.eu/en/faqs/directive-measures-high-common-level-cybersecurity-across-union-nis2-directive-faqs

The post Executive summary: NIS2 Directive for the EU members (updated) first appeared on Sorin Mustaca on Cybersecurity.