Information Security Fundamentals: CIA Triad, ISMS and ISO 27001
CIA Triad
The CIA triad is a fundamental information security model composed of confidentiality, integrity and availability.
- Confidentiality ensures that information is only accessible to authorized users.
- Integrity ensures that information remains accurate and is not modified without authorization.
- Availability ensures that information and systems are accessible to authorized users when required.
Data States
Data can be in one of three states:
- At rest: data is stored.
- In transit: data is being transmitted.
- In use: data is being used or processed.
Security Governance
Security governance is part of corporate governance and ensures that information security supports the organization’s objectives. It provides strategic direction, establishes responsibilities and decision-making, manages information security risks and resources, and helps ensure compliance with applicable regulations.
Key Elements
- Mission: why information security is relevant.
- Vision: what we want information security to become.
- Strategy: how to achieve goals and add value.
- SMART objectives: specific, measurable, achievable, realistic and time-bound.
Policies, Standards, Procedures and Guides (PSPG)
- Policy establishes general principles and explains why security requirements are necessary.
- Standards define what requirements must be followed.
- Procedures establish the ordered steps explaining how activities must be performed.
- Guides provide detailed instructions for specific components or situations.
Information Security Management System (ISMS)
An ISMS is part of an organization’s overall management system, based on a risk approach, used to establish, implement, operate, monitor, review, maintain and improve information security. Its objective is to preserve confidentiality, integrity and availability.
It includes policies, organizational structures, responsibilities, procedures, processes and resources. Risk management and continuous improvement are fundamental elements of an ISMS.
PDCA Cycle
The PDCA cycle is a continuous improvement model used in an ISMS:
- Plan: establishing the ISMS.
- Do: implementing and operating it.
- Check: monitoring and reviewing it.
- Act: maintaining and improving it.
The cycle is continuously repeated to achieve continuous improvement.
ISO/IEC 27001
ISO/IEC 27001 is an international standard that establishes requirements for implementing, maintaining and continually improving an ISMS. It follows a risk-based approach and provides a framework for managing information security. The 2022 version contains 93 controls grouped into four categories: organizational, people, physical and technological.
Statement of Applicability (SoA)
The statement of applicability determines which security controls are applicable to the organization’s ISMS and justifies why controls are included or excluded. Additional controls may also be included when necessary according to the organization’s risks and requirements.
Esquema Nacional de Seguridad (ENS)
The Esquema Nacional de Seguridad (ENS) is the Spanish security framework for public administrations. It establishes principles and technical and organizational security measures to protect electronic information and services. It defines three security levels: low, medium and high.
Security Controls
A security control is a measure implemented to mitigate risk. Controls are classified by typology as administrative, technical or physical, and by objective as preventive, deterrent, corrective and alternative.