Understanding the security risk within the supply chain The supply chain security risk is real and it is very important that an organization understands the risks of doing business with the suppliers, vendors, partners, and third parties. In this story, we will understand the concept by taking a simple example. …

Themes and Attributes Themes referred to the controls categorization that is (1) Organizational controls (Clause 5) (2) People controls (Clause 6) (3) Physical controls (Clause 7) and (4) Technological controls (Clause 8). Attributes are basically another view of the controls that is demonstrated in a table format. It consists of 5 values- (1)…

In the previous story, we looked at the changes introduced in the standard from version ISO 27001:2013 to ISO 27001:2022 and conversion timelines (the-transition-from-iso-27001-2013-version-to-iso27001-2022-part-1-b8ad858ec7e). In this story, we will exclusively look at the changes brought about within Annexure A — control requirements. ISO 27002:2013 contain 114 control requirements. They are…

Architecture Diagram |Data Flow Diagram |Network Diagram |Process Flow Diagram Almost every one of us has drawn some kind of information security diagram for various purposes including compliance, regulatory, contractual, and other requirements. …

Understanding the differences and preparation 1. Name Change The 2013 version of ISO 27001 was called Information Technology — Security Techniques — ISMS Requirements. The 2022 version is now called Information Security, Cybersecurity, and Privacy Protection — ISMS Requirements. 2. Structure Change ISO 27001 still includes the mandatory clauses as before. No new clauses were introduced…

Understanding the difference between containers and virtualizations Virtualization In a traditional computer system, you have the hardware to that you install the Operating System. This means the operating system is attached to the hardware. If the hardware fails the Operating System dies. This makes it very difficult to find those hardware…

Understanding Type 1 and Type 2 virtualization. Virtualization Overview Let's understand the traditional way of building a computer. You go out to purchase every single component separately like — Motherboard, Memory, Video Cards, power supply, CPU, CD-ROM, Floppy Disk, Hard Drive, and Operating System, and bring them all at home to assemble…

Trust principles, report structure, and management responses In this story, we will take a glance at the five trust principles, reporting structure, management responses, and how security analysts can use this report to evaluate a vendor’s security posture. Five Trust Principles Security: The system is protected against unauthorized access, both physical and logical. …

A periodic access review is very important Why do you need to perform an access review? Organizations need to perform access reviews for the following reasons- Ensure compliance with regulatory requirements and industry standards. Identify unauthorized access and prevent data breaches. Protect sensitive data and intellectual property from theft or misuse. Reduce the risk of fraud or insider threats.