Information Security Best Practices for SMEs€¢ ISO/IEC 27002:2013 • Code of practice for information security controls • Collection of policies and guidelines available at ...

Office of the Government Chief Information Officer (OGCIO)

Information Security Best Practices for SMEs

Presented by Sammy Leung

Important Notice All rights, including copyright, in this PowerPoint file are owned and reserved by the Office of the Government Chief Information Officer (OGCIO). Unless prior permission in writing is given by OGCIO, you may not use the materials other than for your personal learning and in the course of your official duty.

重 要 告 示 政府資訊科技總監辦公室持有並保留本簡報檔案包括版權在內的所有權益。除預先獲得本辦公室書面許可外，本簡報檔案只可用作個人學習及處 理公務上用途。

Disclaimer The security sharing follows is based on well known security practices in the industry. It has no relations with the security measures in the OGCIO.

聲 明 這個講座所分享的內容是基於行業提倡的安全實踐，它與政府資訊科技總監辦公室的保安措施無關。

Information Security

Management Quartet

Web Security

Cloud Security

Bring Your

Own Device

(BYOD)

個案一：全球擁有超過三千萬用戶的另類交友網站被黑客入侵，報道稱，有些敏感的個人資料更一度被公諸網上。

Why Does Information Security Concern Me?

個案二 ：酒店集團旗下2間香港酒店，去年6月至今年2月均有住客的信用卡資料被黑客盜取。

Why Does Information Security Concern Me?

Source: 賽門鐵克 - 2015 年網路安全威脅研究報告，第 20 期 https://www.symantec.com/zh/tw/security_response/publications/threatreport.jsp

Information Security Management

Quartet

Information Security Management Quartet

Assessing Security Risks

Implementing & Maintaining a

Secure Framework

Monitoring & Recording

Reviewing

&

Improving

Information Security Management Quartet

Assessing Security Risks

Implementing & Maintaining a

Secure Framework

Monitoring & Recording

Reviewing

&

Improving

Information Security Management Quartet • Assessing Security Risks

Information Asset

Confidentiality Integrity Availability

Personal Data Privacy

Intellectual property (design, art work)

Price List

Client Contact Database

Information Security Management Quartet

Assessing Security Risks

Implementing & Maintaining a

Secure Framework

Monitoring & Recording

Reviewing

&

Improving

Policy, guidelines

Technical measures

Information Security Management Quartet • Implementing & Maintaining a Secure Framework

• Security Policy

• Ensure everyone has a common set of expectation and objectives • Specify requirements • Define the roles and responsibilities • Accepted and validated by the board and executive management

• Examples • Baseline IT Security Policy (S17) • IT Security Guidelines (G3) http://www.ogcio.gov.hk/en/information_security/policy_and_gui

delines/

• Guidelines

• Provide general guidance

OGCIO’s IT Security Policy and Guidelines

Baseline IT Security Policy (S17)

Baseline IT Security Policy (S17)

Information Security Management Quartet • Implementing & Maintaining a Secure Framework

• Example of Policy, Standards, Guidelines

• ISO/IEC 27000 Family • ISO/IEC 27001:2013

• ISMS Requirements • ISO/IEC 27002:2013

• Code of practice for information security controls

• Collection of policies and guidelines available at InfoSec http://www.infosec.gov.hk/english/technical/standards.html

InfoSec > Technical References > IT Security Standards and Best Practices

Information Security Management Quartet • Implementing & Maintaining a Secure Framework

• Example of Policy, Standards, Guidelines

• HKCERT • Bring Your Own Device (BYOD) Security Guidelines • Cloud Storage Security • Guideline of Web Security • Guideline of Mobile Security https://www.hkcert.org/security-guideline

HKCERT > Publications > Security Guideline

Information Security Management Quartet • Implementing & Maintaining a Secure Framework

• Select and Implement Technological Measures

Cloud Security Web Security BYOD Security

Bring Your Own Device (BYOD)

Security

Bring Your Own Device (BYOD)

• Risk

• Data leakage • Remote intrusion • Cross platform infection • Strategy

• Which information and system are available for BYOD • BYOD Policy, Best Practices • User awareness and user buy-in

- Encrypted WiFi network (e.g. WPA2) - MAC address filtering

- Setup VPN

WPA2 VPN

- Setup a firewall for BYOD to connect to company network

- Adopt Mobile Device Management (MDM) - detect jailbroken device - create security profile - track and control running apps

Firewall MDM

Update

圖片來源： GuidingTech - [Quick Tip] How to Delay Android Screen Lock Time http://www.guidingtech.com/16416/delay-android-screen-lock-time/

Web Security

Web Security • User-side

• Update web browser

• Update Adobe Flash • Update Java

• Remove all unused plug-in and extension

• Enable browser's anti-phishing feature

• Disable browser's plugins autorun feature

Web Security Guideline • User-side

Web Security • User-side

• Beware of shortened URL

http://tinyurl.com/XXXXXX into http://preview.tinyurl.com/XXXXXX http://bit.ly/XXXXXX+ http://bit.ly/XXXXXX into http://bit.ly/info/XXXXXX http://goo.gl/XXXXX+ http://goo.gl/XXXXX into http://goo.gl/info/XXXXX

• Use preview feature

Web Security • User-side

• Beware of malicious website

VirusTotal http://www.virustotal.com URLVoid http://www.urlvoid.com/ AVG Online Web Page Scanner http://www.avgthreatlabs.com/ww-en/website-safety-reports/ Quttera Online Website Malware Scanner http://quttera.com/website-malware-scanner#

• Use online website scanners

Cloud Security

Cloud Security • Cloud Service

• Selecting Cloud Service Providers

• Read the Terms of Service and Security & Privacy Policy • How is your data stored and protected?

• Clear policy on data protection • Good reputation

• How to report an incident?

• Clear reporting mechanism • Provide incident problem report

• Does the Privacy Policy follow the data protection principles of the Personal Data (Privacy) Ordinance?

• PCPD’s Cloud Computing leaflet http://www.pcpd.org.hk/english/resources_centre/publications/information_leaflet/flipbook/cloud_computing/index.html#1/z

Cloud Security • Cloud Service

• Selecting Cloud Service Providers

• Data Ownership • Check whether the service provider can use, disclose, or make your information public • Check whether data can be permanently erased from the cloud, backup, when data are deleted or when you terminate the service.

• Other concerns: • Data in motion – Support SSL • Strong authentication – 2-factor authentication; 2-step verification • Access control - different access privilege for different users/groups

Cloud Security • Cloud Service

• Selecting Cloud Service Providers

• Supported by an independent information security management certification (e.g. ISO/IEC 27001)

• Read the scope statement carefully

Cloud Security • Cloud Service

• Selecting Cloud Service Providers

• Other References:

• ISO/IEC 27000 Family • ISO/IEC 27017:2013

• Code of practice for information security controls based on ISO/IEC 27002 for cloud services • Under development

• ISO/IEC 27018:2014 • Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors

Cloud Security • Cloud Service

• Selecting Cloud Service Providers

• Other References: • InfoCloud http://www.infocloud.gov.hk/

Other Resources

Twitter

https://twitter.com/cybersecurityhk

www.infosec.gov.hk

Youtube Channel

infosecgovhk

香港電腦保安事故協調中心 (HKCERT) https://www.hkcert.org 香港警務處 - 預防科技罪案 http://www.police.gov.hk/ppp_tc/04_crime_matters/tcd/index.html 香港警務處 - 童叟無欺 http://www.police.gov.hk/ppp_tc/04_crime_matters/ccb/index.html 香港個人資料私隱專員公署 http://www.pcpd.org.hk

Thank You

Presentation template and clipart from PresenterMedia