Chapter 20 — Information security: engineering context | Engineering Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 20 — Information security: engineering context

Lesson map

Lesson 20 published. Map, example, EX058.

flowchart TD
  N0["Learning outcomes"]
  N1["20.1 Management systems"]
  N2["20.2 Control guidance"]
  N3["20.3 NIST resources"]
  N4["20.4 Scope"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX058"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["20.1 Management systems"]
  N2["20.2 Control guidance"]
  N3["20.3 NIST resources"]
  N4["20.4 Scope"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX058"]

[Learning outcomes]
    |
    v
[20.1 Management systems]
    |
    v
[20.2 Control guidance]
    |
    v
[20.3 NIST resources]
    |
    v
[20.4 Scope]
    |
    v
[Worked example] --> [Exercise EX058]

Learning outcomes

You will (1) place engineering work within management standards; (2) use control catalogues and frameworks; (3) understand the scope of an information security management system.

20.1 Management systems

Lindiwe learns that ISO/IEC 27001:2022 specifies requirements for an information security management system: a structured way to understand context, assess and treat risks, set objectives, operate controls, monitor performance and improve. Saltmarsh is considering certification because large customers ask for it. Prof. Hale explains that the standard asks the organisation to decide which controls it needs based on risk, and to record those decisions in a statement of applicability with reasons for inclusion or exclusion. Lindiwe drafts a sample entry for multi-factor authentication.

20.2 Control guidance

ISO/IEC 27002:2022 gives guidance on information security controls, grouped as organisational, people, physical and technological controls. Lindiwe maps her earlier work onto these groups: the monitoring notice is organisational, phishing awareness concerns people, server room power is physical and multi-factor authentication is technological. She notes that ISO/IEC 27002 guides implementation but does not by itself make an organisation compliant with ISO/IEC 27001, which has its own requirements. Prof. Hale asks her to keep the mapping table, because it will help Saltmarsh prepare its statement of applicability later in the course.

20.3 NIST resources

Lindiwe also studies NIST resources. The Cybersecurity Framework 2.0 organises outcomes under six functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST SP 800-53 Revision 5 provides a detailed catalogue of controls in families such as access control and audit and accountability. NIST SP 800-12 Revision 1 introduces information security concepts for a general audience. She learns that frameworks express what to achieve, while catalogues describe controls in detail. She keeps a short table showing which resource answers which question: frameworks for outcomes, catalogues for detailed controls and introductions for terminology. Prof. Hale approves the table.

20.4 Scope

Before Saltmarsh can build a management system, it must define scope: which sites, systems and processes are included. Lindiwe helps draft a scope covering head office, all depots and the dispatch, payroll and customer systems, but not a subsidiary run separately. Prof. Hale notes that a narrow scope is easier to certify but may mislead customers, so the scope statement must be clear about what is excluded and why. The draft scope is reviewed by the managing director and the subsidiary's own manager, who agrees to follow later.

Worked example

Lindiwe places her work within ISO/IEC 27001 and 27002, relates it to CSF 2.0 functions and SP 800-53 families and drafts a scope for Saltmarsh's management system.

Synthetic case. The scope is synthetic; standards are paraphrased.

Errors and limits

Implementing ISO/IEC 27002 guidance alone does not make an organisation ISO/IEC 27001 compliant.

Exercises

EX058 — Applicability statement. What records control decisions with reasons? Rubric: 3 = statement of applicability;; 2 = partly correct;; 1 = other;; 0 = none.
EX059 — Control groups. Name the four ISO/IEC 27002 control groups. Rubric: 3 = organisational, people, physical, technological;; 2 = all;; 1 = some;; 0 = none.
EX060 — CSF functions. Name the six CSF 2.0 functions. Rubric: 3 = Govern, Identify, Protect, Detect, Respond, Recover;; 2 = all;; 1 = some;; 0 = none.

Continue studying — lesson 20 (chapter 20 of 50)

← Chapter 19 · Course chapter index · Chapter 21 →

Continue to the next authored lesson.