This presentation provides an overview of ISO 27001, an international standard for information security management systems, detailing its benefits, the certification process, and its impact on developers, emphasizing how robust security practices can enhance long-term productivity and resilience.
Mind Map
点击展开
点击探索完整互动思维导图
Hello.
Just doing a quick audio test.
Hello everyone. >> Hi.
>> Hi.
>> So, welcome today. Thank you for coming. Um,
Um,
so for the guys that are online, if you
guys online, we're coming from our
office in Dawn Cape Town. Um, so we've
just come off some some pizza and table
tennis. So, the the afternoon nap risk
is high, I'd say. Um, so let's uh let's
hang in there with me. Um, so yeah,
welcome. I see there's a couple more
people online. Thank you so much for joining.
joining. Um,
Um,
cool. So, today I've been asked to speak
about every developer's favorite topic,
governance and compliance.
Um, so that's exactly what I'm going to
do for hopefully 30 minutes straight.
Um, so it should be should be a blast.
Strap in. Um, yeah. So,
just introduction to myself. I'm Kevin
Wilson. Hi guys.
>> Kevin Wilson. I'm co-founder of
Commotion. We've been going for about uh
12 years now
in various industries. So we um have
Senalytics which is a company that does
consolidated investment reporting in the
financial services space. We've got
Commotion Dash which is a kind of
cloud-based analytics tool for large
scale data analytics. And then of course
we've got Commotion low code which is
our low code development uh resource in ARM.
ARM.
Yeah. And we are based locally in South
Africa with the global footprint around
the world in the US and in Europe.
Yeah. So today I'm going to just start
off with just giving a bit of an
overview. What is ISO 271?
What does it mean? Then I'm going to
just unpack our journey that we went on
with a little bit of kind of general
points on on the process to to getting
certified. Then I'm going to touch just
briefly on Menx control center and how
that uh overlaps with 271 and then just
talk a little bit generally about um
impact of the space for developers.
So cool firstly what is 271? So it's the
international standard for information
security management systems. So that is
an information security management
system or ISMS is the kind of process
and system that you put down in your
company that defines how information
security is managed across the whole
organization. So it's the control of
information security and how you make
sure that the information is actually
secured. So how does it do it? So it's
ISO 271 has a list of controls. It's
called the NXA controls. That's where
you start. That's all the kind of
required controls and then you would go
about and implement those controls by
means of policies and or procedures in
your in your business.
Cool. Um so the end goal is obviously
appropriate management and protection of
company information and risk management
or reduction of risk risk. So just
briefly context of 271 that the reason
why you would be doing something like
this obviously we all know ever
increasing threat of information
security compromises and then coupled
with that there's been a obviously over
the last say 10 years there's been a
real tightening of data privacy
legislation and regulation around uh
data and processing of data.
So for developers um obviously a privacy
and security aware developer is valuable
in this context uh and it's not just
about contributing to system features
but actually to the organization and the
client as a whole. So I think that's
that's critical for me.
So why is 271
valuable? I think if you've ever been
handed a third party security assessment
or dealt with a security incident, you
probably already know why it's valuable.
Um I must admit the first couple of
third party assessments that we received
um were very stressful. Um there's
nothing like a wellplaced question kind
of make you realize that you've got a
lot of work to do. Um so you know $271
is is a really a well- definfined
framework that helps you get through
these things so that these assessments
are actually almost a breeze right so
yeah so obviously also having said that
it's a diff differentiator to your
customers if you present a 271
certificate you know in your pre-sales
process um it's going to it's going to
like kind of leap frog your head we've
seen that um you those assessments or
pre-sales customer assessments have
really been reduced a lot just by the
ability of to provide that certificate.
Um reduces that friction. So it's going
to reduce time during your customer
and then obviously on a practical level
it just does give customers confidence
that the scary of the information is
well managed and really taken seriously.
And surprisingly, it actually really
does reduce risk um throughout your organization.
organization.
Cool. So, moving on, just want to
outline like it's obviously very kind of
detailed. There's a lot of lot of stuff
in the in the standard, but I just
wanted to like just from a high level
just unpack kind of some of the areas
for you guys for some context. So,
firstly, some key principles. So, risk
management. How do you actually deal
with risk? How do you make sure that you
kind of classify your risks and um
mitigate all of them kind of with the
same mindset so you're not kind of
misclassifying risks. So to have one
kind of central risk management process
and standard that's part of the ISO
standard to implement that. Access
control is a big one. How do you you
know make sure your you have segregation
of duties principle and lease privilege
applied. How do you actually um make
sure that you can actually audit who has
access to what in your company? That's
all part of the the standard. Then of
course incident response. How do you
monitor, detect and report security
events? So a key part of it. Management reporting
reporting
um is really like an overarching thing.
So um the standard does require evidence
of regular management reporting and
engagement. So it's not just something
you put in um and leave. There's an
ongoing engagement that you have to kind
of demonstrate in your company.
Then of course change management. How do
you manage change throughout your
organization and actually have
considerations for information security
while you're going through those
changes? Then of course secure
development. So how do you um develop
with security in mind and ensuring you
know secure features through all your
STLC stages.
training is a big aspect of it. So
ongoing training and and um for for
everyone in the company basically on
information security
and then continuous improvement um
continual review of your policies and
procedures uh and then also feeding back
from things like if there are incidents
take learnings from those incidents and
and and improve going forward.
Cool. So before you begin this process,
I would say management buying is really
critical. Um obviously it's top
management, senior management level, but
also middle management needs to buy in
and understand the reasons and value for
certification. If you don't do this,
it's going to be uh a whole lot of this.
Um it's going to be very frustrating to
get anything landed in your in your
company because it's all about actually
having processes and being able to show
evidence for these for these processes.
So in reality, you're probably going to
have some of this anyway, but there will
be less there'll be less uh if you have,
you know, full management buying.
So our journey really started off kind
of like that. We didn't really know much
about it. We knew it was a good thing
and a thing that we needed given the the
environment we were operating in. So we
decided to engage with knowledgeable
external consultants to assist us. So
that was a combination of legal
consultants and um really 271 certified consultants.
consultants.
We started off with a kind of developed
our pol policy ethos which was we try to
search for the balance between theory
and practice to ensure we arrived at the
best set of realistic executable
executable rules and processes and not a
list of unattainable goals. So in that
picture is pretty clear. Sometimes you
can put a policy in place and that's all
nicely theoretical and neat, but as soon
as it gets into the real world, you have
reality hits you and it doesn't really
quite operate like that. So, we really
wanted to make sure that what we put
down actually, you know, landed in the
in the company and actually really
actually made a difference. Otherwise,
it's kind of a checkbox exercise, which
is which is not what what we wanted to do.
do.
So, initial actions for the process of
certification. First action is scoping.
So here you determine what um part of
the organization you're actually
certifying and what controls actually
relevant to your operations. So for
example we we included you know the
whole all the divisions of our company
in the certification but you know as a
cloud cloud hosted as a provider of
cloud hosted solutions we all the
physical security controls weren't fully
relevant to us not having on-prem um
servers and that kind of thing. So there
were some controls that you can kind of
exclude and you as long as you can
explain why you've excluded those
controls that's acceptable to the to the standard.
