Implementation Plan for an ISMS according to ISO/IEC 27001:2013 Student name: Plácido Rodal Castro Degree: Master Program in Security of Information and Communication Technologies (MISTIC) Area: Information security management system Consultant: Antonio José Segovia Henares Subject responsible teacher: Carles Garrigues Olivella University: Universitat Oberta de Catalunya Delivery Date: 12/30/2016 i Esta obra está sujeta a una licencia de Reconocimiento-NoComercial- SinObraDerivada 3.0 España de Creative Commons ii PROJECT DATA SHEET Implementation Plan for an ISMS according Project Name: to ISO/IEC 27001:2013 Author name: Plácido Jose Rodal Castro Consultant name: Antonio José Segovia Henares Subject responsible teacher Carles Garrigues Olivella name: Delivery Date: 12/2016 Master Program in Security of Information Degree: and Communication Technologies (MISTIC) Final Work Area: Information Security Management System Working language: English Key Words: Security, ISMS, IS0/IEC 27001:2013 Project Summary: The main objective of this project is to define the implementation plan for an ISMS (Information security management system) according to ISO/IEC 27001:2013 for Xintiba. This system includes all the policies, procedures, plans, processes, practices, roles, responsibilities, resources, and structures that are used to protect and preserve the information and assets of the company. Xintiba is a company from the north of Mexico that develops video games for children and handicap people. By using these video games, they attempt to accelerate the acquisition of certain cognitive skills that may help these people adapt and perform in society. The scope of the ISMS is the ISO/IEC 27001 entire organization certification. We have just two locations and no more than 50 employees so the best option is to cover the whole organization. Xintiba has not established a ITSM and only has one employee to manage all security of the organization. We started defining a Security Strategic Plan to efficiently and effectively address the management, control and protection of the information assets. The improvement a few weeks before the project kick-off is high. Nevertheless, more needs to be done to make the final target a reality. Next initiatives are going to focus in move up nonexistence and initial controls and is expected to finish 2017 with a high maturity levels to start the ISO 27001 certification in 2018. It is noteworthy that employees are more compromised with the security since we start this project. iii Table of Contents 1. Introduction ......................................................................................................2 1.1. Overview ................................................................................................................ 2 1.2. Project Objectives ............................................................................................... 2 1.3. Methodology ......................................................................................................... 2 1.4. Project Planning .................................................................................................. 3 1.5. Deliverables .......................................................................................................... 3 1.6. Brief Description of Chapters .......................................................................... 4 2. Background .......................................................................................................5 2.1. Xintiba .................................................................................................................... 5 2.2. Scope ...................................................................................................................... 7 2.3. ISO/IEC 27001 and 27002 .................................................................................. 9 2.4. Security Strategic Plan ...................................................................................... 9 3. Gap Analysis ................................................................................................... 11 4. Document management system ...................................................................... 20 4.1. Information security policy ................................................................................ 20 4.2. ISMS internal audit procedure ........................................................................... 20 4.3. ISMS Key performance indicators ....................................................................... 20 4.4. ISMS Management review ................................................................................. 21 4.5. ISMS roles and responsibilities ........................................................................... 21 4.6. Methodology for the risk management .............................................................. 21 4.7. Statement of applicability .................................................................................. 21 5. Information Security Risk Assessment ............................................................. 21 5.1. Assets summary ................................................................................................ 22 5.2. Threat analysis .................................................................................................. 23 5.3. Potential impact ................................................................................................ 26 5.4. Residual Impact and Risk Value .......................................................................... 27 5.5. Analysis of results .............................................................................................. 29 6. Proposal Projects ............................................................................................ 31 6.1. Proposals .......................................................................................................... 31 6.2. Project Planning ................................................................................................ 36 6.3. Summary of results ............................................................................................ 37 7. Compliance Audit ............................................................................................ 39 8. Conclusions ..................................................................................................... 41 9. Glossary .......................................................................................................... 42 10. References .................................................................................................. 44 11. Annexes ...................................................................................................... 46 Annex 1 – Xintiba Information security policy ................................................................. 46 Annex 2 – ISMS Internal Audit Procedure ....................................................................... 50 Annex 3 – ISMS Key Performance indicators ................................................................... 54 Annex 4 – ISMS Management review agenda ................................................................. 56 Annex 5 – ISMS Roles and Responsibilities ..................................................................... 57 Annex 6 – Methodology for the risk management .......................................................... 58 Annex 7 – Statement of applicability .............................................................................. 63 Annex 8 – Compliance Audit Report ............................................................................... 75 List of Figures Figure 1: Project planning……………………………………………………………..3 Figure 2: Xintiba hierarchy…………………………………………………………....5 Figure 3: Xintiba main areas for the audit……………………………………….…..8 Figure 4: ISO 27001 compliance gap analysis report 1…………………………. 13 Figure 5: ISO 27001 compliance gap analysis report 2…………………………. 20 Figure 6: Assets Acceptable Risk Summary.……………………………………....30 Figure 7: Assets Security Categories Summary.………………………….............31 Figure 8: Proposed Projects Gantt Chart. …………………………......................38 Figure 9: ISO 27001 Compliance Gap Analysis Benchmark 1…………………..39 Figure 10: ISO 27001 Compliance Gap Analysis Benchmark 2…………………39 Figure 11: Final ISO 27001 Compliance Gap Analysis Results 1……………….40 Figure 12: Final ISO 27001 Compliance Gap Analysis Benchmark 2…………..40 Figure 13: ISO 27001 Controls Maturity……………………………………………41 v List of Tables Table 1: Xintiba Servers.…………………………………………………………….9 Table 2: ISO/IEC 15004 Capability Level Description..………………………….12 Table 3: ISO/IEC 27001 Capability levels evaluation…………………………....13 Table 4: ISO/IEC 27001's controls compliance audit…………………………….19 Table 5: ISO 27001compliance summary; target and optimal…………………..20 Table 6: Asset Summary…………………………………………………………….24 Table 7: Threat Analysis Report…………………………………………………....27 Table 8: Threats potential impacts………………………………………………….28 Table 9: Acceptable assets risks……………………………………………...……30 Table 10: P – Xintiba Security Policies…………………………………………….32 Table 11: P – Xintiba Security Workshops………………………………………...33 Table 12: P – Asset Management.………………………………………………....34 Table 13: P – Implementation of a Business Endpoint Protection………………34 Table 14: P – Set up a Third Party VPN Solution.………………………………...35 Table 15: P – Renew Office Routers.………………………………………………35 Table 16: P – Sucuri Website Protection.………………………………………….36 Table 17: P – Black Box Audit by a Third Party………………………………….,.36 Table 18: P – White Box Audit by a Third Party.…………………………………..37 Table 19: P – Proposed plans time line.……………………………………………37 vi 1 1. Introduction 1.1. Overview There is no doubt, the computer security is a concern for most of companies. Xintiba is one of these companies that is looking to improve and invest in the security of each organization. Xintiba develops therapeutic video games for children or handicapped people. They are concerned about ensuring the privacy of important data because any leak could have serious consequences for the operation of the company. The objective of this document is to describe the implementation plan for an ISMS (Information security management system) according to ISO/IEC 27001:2013 for Xintiba. This system includes all of the policies, procedures, plans, processes, practices, roles, responsibilities, resources, and structures that are used to protect and preserve the information and assets of the company. 1.2. Project Objectives The main purpose of the project is to establish the basis of an ISMS and it is divided into the following stages:  Xintiba current situation and objectives: A process which starts identifying business objectives and priorities. To do so, understand Xintiba internal structure, processes, services and operation.  Best practices of information security management: Most effective strategy for keeping organizations and users safe.  ISO / IEC 27001: 2013 compliance audit: A process which Xintiba we are going to be review and report of the implemented controls of the standard.  ISMS Scope: The selection of the ISMS proper scope implementation which helps to achieve the identified business objectives.  Xintiba threat and risk analysis: Identification and evaluation of Xintiba threats and risks.  Project proposals to achieve adequate safety management. 1.3. Methodology Xintiba doesn’t have an ISMS so we must start from the beginning. We will show the project as a completely new initiative that will help to improve Xintiba security. Firstly, we should analyse if Xintiba is following some security practices and the level of security processes. It can be useful to start with some advantage. 2 Secondly, we are going to focus on protecting the most critical process of the company. Although we haven´t analysed Xintiba, we know that the current security level is low. These measurements were taken based on ISO 27001:2013 standard. We are going to implement measurements into short deliverables in order to release them as we advance. At the end of this project Xintiba will have an acceptable security level and the first steps done to start formally looking for the ISO 27001:2013 certification. 1.4. Project Planning We divide project into two groups of tasks: Documentation and Implementation. Project implementations are more described into 6. Proposed Projects. Figure 1: Project planning. 1.5. Deliverables Below, as project deliverables:  Gap analysis of ISO/IEC 27001:2013: An evaluation of the capability levels of the ISO/IEC 27001 controls according to the ISO/IEC 15504.  Documents scheme of ISO/IEC 27001:2013: It contains the information security policy, the ISMS internal audit procedure, the ISMS Key performance indicators, the ISMS Management review, the ISMS roles and responsibilities, the Methodology for the risk management and the Statement of applicability.  Xintiba threat and risk analysis: Enable Xintiba to systematically identify, analyze and evaluate the information security risks associated with an information system or service along with the controls required to manage it.  Project plan: Contains documentation of the proposed projects to improve Xintiba Security. 3  Compliance audit results of ISO/IEC 27001:2013.  Conclusion and results report. 1.6. Brief Description of Chapters We start this document with the background of Xintiba. It contains an overview of the company, the main line of business and how they organize. Also, it describes the project scope and objectives. The document continues with a Gap Analysis to evaluate the capability levels of the ISO/IEC 27001. This standard is a set of technical standard documents for the software development process and related business management functions. | Once we know the security maturity of the company it is time to define some processes and policies that can help to start working on improving Xintiba information systems security. This chapter contains the descriptions of these deliverables that are annexes on this document. It continues with the chapter of the Information security risk assessment. It describes how Xintiba can systematically identify, analyse and evaluate the information security risks associated with an information system or service along with the controls required to manage it. The next chapter is about the proposed projects to mitigate the current risk in the organization and evolve ISO compliance to its proper level. The following chapter shows the results of security audit before the proposed projects implementation. The documents finish with a conclusion section where we capture the most important lesson learned, the difficulties encountered and the next steps of Xintiba to continue enhancing its security levels. 4