15

🗺️ Big Picture

ISO 27001:2022 = International Standard for ISMS
│
├── Part I   — What is ISMS? + Clauses 0–10 Structure
├── Part II  — Gap Analysis, Risk Assessment, BIA, RTO/RPO
└── Part III — 93 Controls in 4 Themes
               ├── Organizational (5.x) — 37 controls
               ├── People (6.x)         —  8 controls
               ├── Physical (7.x)       — 14 controls
               └── Technological (8.x)  — 34 controls

$\boxed{\text{ISMS} = \text{Establish} + \text{Implement} + \text{Monitor} + \text{Review} + \text{Maintain} + \text{Improve}}$

Part I — Introduction to ISO 27001

Three Perspectives of Information Security

🍽️ Analogy: Like a restaurant — the owner (business) manages the operation, customers want their personal data safe, and the supplier must guarantee the quality of what they deliver.

What Is ISO/IEC 27001:2022?

• International standard for establishing an Information Security Management System (ISMS)
• Published by ISO (International Organization for Standardization) + IEC (International Electrotechnical Committee)
• Covers all organization types and sizes — commercial, government, non-profit
• Uses Plan–Do–Check–Act (PDCA) cycle for continuous improvement

🏭 Analogy: ISO 27001 is to information security what ISO 9001 is to quality management — a formal framework to prove you manage it properly.

Key Characteristics

• Concerns management of information security, not just technical IT security
• Implementation is scaled to the organization's size and needs
• Thousands of organizations worldwide are certified compliant

How to Protect Information (Tools)

Controls / Policy / Procedures / Passwords / Encryption / Security Applications / Secure Coding / Legal frameworks / Training & Awareness

ISO 27001 Clauses Structure

Output of risk assessment → Assessment report → Apply controls to mitigate risks → Document in Statement of Applicability (SoA)

ISO 27001 Certification Path (12 Steps)

① Plan the project
② Define scope and context of ISMS
③ Obtain management commitment
④ Establish Information Security Policy
⑤ Set ISMS objectives + management system
⑥ Conduct Risk Assessment
⑦ Produce Statement of Applicability (SoA)
⑧ Implement controls
⑨ Internal audit
⑩ Management review
⑪ External audit — Stage 1
⑫ External audit — Stage 2 (Certification) ✅

Part II — Gap Analysis & Risk Assessment

Gap Analysis vs. Risk Assessment

Gap Analysis = รู้ว่าขาดอะไร / Risk Assessment = รู้ว่าควรทำอะไร

What Is Risk?

$\boxed{\text{Risk} = \text{Threat exploits Vulnerability} \rightarrow \text{Adverse Impact on organization}}$

Risk Relationship:

Threat Agent → exploits → Vulnerability → affects → Information Asset
                                   ↑
                              Controls reduce this

Goals of Risk Analysis

1. Identify assets and their value to the organization
2. Identify vulnerabilities and threats (via VAPT — Vulnerability Assessment & Penetration Testing)
3. Quantify probability and business impact of threats
4. Provide economic balance between impact and cost of countermeasure

Risk Assessment Process (NIST SP 800-30)

① Identify assets
② Identify vulnerabilities and threats
③ Assess business impact on each vulnerability/threat
④ Conduct Risk Analysis
⑤ Provide controls / treatment plan
⑥ Evaluate the controls

Risk Analysis Approaches

Risk Calculation Methods

$\boxed{\text{Method 1 (Addition): Risk} = \text{Consequences} + \text{Likelihood}}$ $\boxed{\text{Method 2 (Multiplication): Risk} = \text{Consequences} \times \text{Likelihood}}$

Detailed Risk Score: $\text{Risk} = \text{Asset Value} + \text{Threat Value} + \text{Vulnerability Value}$

Example (Laptop theft):

• Asset value = 3, Threat value = 2, Vulnerability value = 2 → Risk = 7

Qualitative Risk Matrix

Asset–Threat–Vulnerability Examples

Risk Treatment Options

Risk Acceptance Criteria

• Define a risk acceptance threshold (e.g., if scale is 2–10, define acceptable = 7)
• Only risks above threshold need treatment
• Must be formally defined and documented

Business Impact Analysis (BIA)

Determines the Maximum Acceptable Outage for each service.

→ Maximum Acceptable Outage = between 8 and 24 hours → RTO is determined by examining dependencies on other activities

RTO & RPO

$\boxed{\text{RTO (Recovery Time Objective)} = \text{Maximum time within which a service must be restored after a disaster}}$

$\boxed{\text{RPO (Recovery Point Objective)} = \text{Maximum amount of data that might be lost due to a disruption}}$

🕐 Analogy: RTO = "กลับมาทำงานได้ภายใน X ชั่วโมง" (how fast to recover). RPO = "ข้อมูลสูญหายได้ไม่เกิน X ชั่วโมงย้อนหลัง" (how much data can you afford to lose).

Standby Types (determined by RTO):

• Cold standby — systems off, manual restart needed (longer RTO)
• Hot standby — systems running and ready (shorter RTO)
• Mirrored — real-time data mirroring (near-zero RTO/RPO)

⚠️ Key insight: Backup is NOT the real problem — being able to restore within the required timeframe is the real challenge.

Requirements for proper restore:

• Know the timeframe + order of system restoration
• Availability of systems + knowledgeable personnel + required software
• Restore procedures + test procedures post-restore

Part III — ISO/IEC 27002:2022 — 93 Controls in 4 Themes

$\boxed{\text{ISO 27002} = \text{93 Controls across 4 Themes: Organizational + People + Physical + Technological}}$

Control Attributes (5 Categories per control)

3.1 Organizational Controls — Section 5 (37 controls)

Full List

Key Organizational Controls — Details

5.1 — Policies for Information Security

• A document helping employees understand why InfoSec is important and what their role is
• Includes the information security policy + its review process

5.7 — Threat Intelligence

$\text{Threat Data} \rightarrow \text{Analysis} \rightarrow \text{Intelligence} \rightarrow \text{Action} \rightarrow \text{Improved Security}$

Three levels:

Good threat intelligence must be: Relevant, Insightful, Contextual, Actionable

5.9 / 5.10 / 5.11 — Asset Management

• 5.9 Maintain an Asset Management DB (inventory of all assets)
• 5.10 Define Acceptable Use Policy for assets
• 5.11 Procedures for returning assets when employment ends

5.12 — Classification of Information ⭐ Exam Note

Q: What is the major benefit of information classification? A: We can apply/decide access controls appropriately for each class of information.

• Asset owners classify information based on impact of loss/damage/disclosure
• Rules: e.g., confidential info must be encrypted or sent by registered mail

5.19–5.21 — Supplier Management

Supplier types: Software / Hardware / Facilities / BPO

5.29–5.30 — Business Continuity (Availability)

• 5.29 — Security during disruption (BCM aspects) — continuity of security procedures during a crisis
• 5.30 — ICT readiness — redundancy of ICT services (servers, network, applications)

BCP requirements:

• Must be exercised periodically — must fully restore within RTO/RPO
• All personnel must know their roles
• Any organizational change must trigger BCP updates (via change management)

3.2 Physical Controls — Section 7 (14 controls)

Full List

Key Physical Controls — Details

7.1 — Physical Security Perimeters

• Divide physical areas into zones (Public vs. Restricted)
• Perimeter protection: Landscaping, Fences, Gates, Bollards, CCTV, Perimeter IDS

7.2 — Physical Entry & Biometrics

3-Step Access Control:

① Identification  — Who are you?   (badge, user ID, biometrics)
② Authentication  — Prove it!      (have / know / are)
③ Authorization   — What can you do? (ACL-based)

Biometrics Errors:

7.6 — Working in Secure Areas

• Nobody may work alone in secure areas

7.11 — Supporting Utilities

• UPS (Uninterruptible Power Supply) — for short outages
• Generators / no-break systems — for longer outages

7.14 — Secure Disposal of Equipment

• Procedures + technical tools for secure disposal of media (paper, disks) with classified data

Physical Controls Guidance

• Zoning determines which areas need strict entry controls
• Access rights must interface tightly with HR (onboarding, offboarding, role changes)
• Check legislation before installing surveillance cameras (privacy laws)
• Physical controls managed by facilities management — must collaborate with ICT + security
• IT systems are vulnerable to electrical problems → backup power always required
• Physical barriers must not block emergency exits

3.3 People Controls — Section 6 (8 controls)

Full List

Key People Controls — Details

6.1 — Screening

• Especially for high-risk positions (financial, high confidentiality)
• In case of fraud: investigating the employee's workstation may be the only legal option

6.3 — Information Security Awareness, Education & Training

Three aspects of InfoSec awareness:

Tools: Class-based training, e-learning, one-to-one talks, gaming, discussion Key: Behavioral change only occurs when people understand why controls exist

6.6 — NDA / Confidentiality Agreements

• Clarifies legal responsibilities for protecting confidential information

6.8 — Event Reporting

• Clarifies responsibilities for reporting security events

People Controls Guidance

• Four-eye principle: Admins should only use admin rights when another admin is present
• Duties should be separated to reduce risk
• Access rights reviewed periodically, especially when employees change roles
• Key issues: Background screening / Clear job descriptions / Segregation of duties / Training

3.4 Technological Controls — Section 8 (34 controls)

Full List

Key Technological Controls — Details

8.5 — Secure Authentication

Authentication method must match risk level:

8.7 — Protection Against Malware

• Malware spreads via USB sticks and infected websites
• Detection: signature-based OR behavior-based
• May generate false positives; may fail to detect all malware
• Logical bombs (hidden code that triggers later) — sometimes only detectable by human code review

8.11 — Data Masking

Purpose: Protect sensitive data (PII, financial, credentials) while preserving usability in non-production environments.

Masking Techniques:

Masking Example:

Masking vs. Tokenization vs. Encryption:

8.12 — Data Leakage Prevention (DLP)

What is data leakage? Unauthorized transfer of info outside org's boundaries.

DLP Implementation — 5 Steps:

① Identify Sensitive Data — classify, tag/label (e.g., MIP sensitivity labels)
② Deploy DLP Technologies
    ├── Network DLP  — monitors emails, web, FTP (data in motion)
    ├── Endpoint DLP — monitors USB, clipboard, print, screenshots
    ├── Cloud DLP    — SaaS protection (M365, Google Workspace)
    └── Content-Aware Inspection — regex/keyword (credit card numbers, national IDs)
③ Define DLP Policies — rules by content, context, channel
④ User Awareness & Training — educate on data handling
⑤ Monitor & Respond — log events, alert teams, integrate with SIEM/SOAR

DLP Policy examples:

• Block documents labelled "Confidential" from being emailed to personal addresses
• Block upload of spreadsheets with >10 SSNs to public cloud
• Alert when >100 files are downloaded by one employee in 1 hour

8.15 — Logging

Events that must be logged:

• Unauthorized access attempts
• Changes to configuration or data
• Privileged access attempts
• Creation / modification / deletion of user IDs
• System alarms

⚠️ Not all events = incident, but all events must be analyzed. All logs must be protected to preserve their own CIA (logs are evidence!).

8.19 — Software Installation on Operational Systems

• Only authorized admins may install software
• All software must be verified and tested for vulnerabilities first
• Use CMDB (Configuration Management DB) to track installed software and versions
• Use automated patch management to deploy vendor patches promptly

8.23 — Web Filtering

Purpose: Restrict access to malicious or non-business websites.

Implementation:

• DNS filtering — intercepts DNS queries, evaluates against threat intel + policy + content categories
• URL filtering + Secure Web Gateways
• Maintain logging and monitoring of all web access

DNS Filtering Flow:

User types URL → DNS query sent → DNS filter intercepts →
checks against blacklists / org policy / content categories →
Allow ✅ or Block ❌

Best practices: Principle of least privilege for web access; regularly update blacklists/whitelists; combine technical + administrative controls.

8.24 — Use of Cryptography

Cryptography achieves:

Cryptography policy must define:

• Principles for protecting information
• Link to data classification (which classification requires encryption)
• Encryption on specific vulnerable devices (phones, USB sticks)
• Standards: algorithm, key length, key management

Hardware Security Module (HSM)

A dedicated hardware device that protects encryption keys and accelerates cryptographic operations.

Software Cryptography Weaknesses vs. HSM Strengths:

HSM FIPS Standards: ⭐ Exam Note

• FIPS 140-1 Level 2
• FIPS 140-2 Level 3 (higher assurance)

HSM Types:

8.20–8.22 — Network Security

Firewall Type Recap (from ISO perspective):

8.31 — Separation of Dev / Test / Production Environments

• Authorization required every time data is moved:
  • Production → Test
  • Test → Production
• Increases data integrity and ensures alignment with InfoSec policy

Service Oriented Architecture (SOA) & Security

• Architecture where apps use services available in the network
• Two roles: Service Provider (publishes services + contract) / Service Consumer (uses services)
• InfoSec team must be involved when designing SOA-based systems

Common Criteria (ISO/IEC 15408) — EAL Levels

• Framework for evaluating security products (firewalls, access control equipment)
• Three parties: Users (specify requirements) / Vendors (make claims) / Testing Labs (evaluate)
• Products receive an Evaluation Assurance Level (EAL):

5 Tips for Successful ISO 27001 Implementation

1. Get senior management involved — policy enforcement + budget allocation
2. Produce a gap analysis — may need professional consultants
3. Gain cross-functional support from colleagues across departments
4. Develop a project plan with key milestones
5. Focus on continual improvement — PDCA never stops

⚡ Key Facts to Remember