Pass the ISO/IEC 20000 Lead Implementer ISOIEC20000LI Questions and answers with ExamsMirror

According to ISO/IEC 27005:2021, there are three types of assets in information security risk management: primary assets, supporting assets, and business assets. Primary assets are the information and business processes that support the organization’s objectives and operations. Supporting assets are the resources that enable the primary assets to function, such as hardware, software, networks, people, facilities, etc. Business assets are the outcomes or benefits that the organization expects from the primary assets, such as reputation, market share, customer satisfaction, etc. (Must be taken from ISO/IEC 27001 : 2022 Lead Implementer resources)

In scenario 4, the assets that were identified during risk assessment are hardware, software, and networks, which are examples of supporting assets. These assets are necessary for the information and business processes of TradeB to operate, but they are not the main focus of the risk assessment. The risk assessment should also consider the primary assets and the business assets, as well as the threats and vulnerabilities that affect them, and the potential impacts and likelihood of information security incidents.

References: ISO/IEC 27001 : 2022 Lead Implementer Study guide and documents, specifically:

ISO/IEC 27001:2022, clause 6.1.2 Information security risk assessment

ISO/IEC 27005:2021, clause 5.2 Asset identification and valuation

PECB ISO/IEC 27001 Lead Implementer Course, Module 6: Risk Management

According to ISO/IEC 27001:2022, information security controls are measures that are implemented to protect the confidentiality, integrity, and availability of information assets1. Controls can be preventive, detective, or corrective, depending on their purpose and nature2. Preventive controls aim to prevent or deter the occurrence of a security incident or reduce its likelihood. Detective controls aim to detect or discover the occurrence of a security incident or its symptoms. Corrective controls aim to correct or restore the normal state of an asset or a process after a security incident or mitigate its impact2.

In this scenario, Socket Inc. implemented several security controls to prevent information security incidents from recurring, such as:

Segregation of networks: This is a preventive and technical control that involves separating different parts of a network into smaller segments, using devices such as routers, firewalls, or VPNs, to limit the access and communication between them3. This can enhance the security and performance of the network, as well as reduce the administrative efforts and costs3.

Privileged access rights: This is a preventive and administrative control that involves granting access to information assets or systems only to authorized personnel who have a legitimate need to access them, based on their roles and responsibilities4. This can reduce the risk of unauthorized access, misuse, or modification of information assets or systems4.

Cryptographic controls: This is a preventive and technical control that involves the use of cryptography, which is the science of protecting information by transforming it into an unreadable format, to protect the confidentiality, integrity, and authenticity of information assets or systems. This can prevent unauthorized access, modification, or disclosure of information assets or systems.

Information security threat management: This is a preventive and administrative control that involves the identification, analysis, and response to information security threats, which are any incidents that could negatively affect the confidentiality, integrity, or availability of information assets or systems. This can help the organization to anticipate, prevent, or mitigate the impact of information security threats.

Information security integration into project management: This is a preventive and administrative control that involves the incorporation of information security requirements and controls into the planning, execution, and closure of projects, which are temporary endeavors undertaken to create a unique product, service, or result. This can ensure that information security risks and opportunities are identified and addressed throughout the project life cycle.

However, information backup is not a preventive control, but a corrective control. Information backup is a corrective and technical control that involves the creation and maintenance of copies of information assets or systems, using dedicated software and utilities, to ensure that they can be recovered in case of data loss, corruption, accidental deletion, or cyber incidents. This can help the organization to restore the normal state of information assets or systems after a security incident or mitigate its impact. Therefore,information backup does not prevent information security incidents from recurring, but rather helps the organization to recover from them.

References:

ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements

ISO 27001 Key Terms - PJR

Network Segmentation: What It Is and How It Works | Imperva

ISO 27001:2022 Annex A 8.2 – Privileged Access Rights - ISMS.online

[ISO 27001:2022 Annex A 8.3 – Cryptographic Controls - ISMS.online]

[ISO 27001:2022 Annex A 5.30 – Information Security Threat Management - ISMS.online]

[ISO 27001:2022 Annex A 5.31 – Information Security Integration into Project Management - ISMS.online]

[ISO 27001:2022 Annex A 8.13 – Information Backup - ISMS.online]

According to ISO/IEC 27001, training and awareness are two different but complementary activities that aim to enhance the information security competence and performance of the organization’s personnel. Training is the process of providing instruction and guidance to help individuals acquire certain skills, knowledge, or abilities related to information security. Awareness is the process of raising the level of consciousness and understanding of the importance and benefits of information security, and developing certain habits and behaviors that support the information security objectives and requirements.

In scenario 6, Colin is holding a training and awareness session for the personnel of Skyver, which means he is combining both activities to achieve a more effective and comprehensive information security education. The training part of the session coverstopics such as Skyver’s information security policies and procedures, and techniques for mitigating phishing and malware. The awareness part of the session covers topics such as Skyver’s information security approaches and challenges, and the benefits of information security for the organization and its customers. The purpose of the session is to help the personnel acquire the necessary skills to perform their information security roles and responsibilities, and to develop the appropriate habits and behaviors to protect the information assets of the organization.

References:

ISO/IEC 27001:2013, clause 7.2.2: Information security awareness, education and training

ISO/IEC 27001 Lead Implementer Course, Module 6: Implementing the ISMS based on ISO/IEC 27001

ISO/IEC 27001 Lead Implementer Course, Module 7: Performance evaluation, monitoring and measurement of the ISMS based on ISO/IEC 27001

ISO/IEC 27001 Lead Implementer Course, Module 8: Continual improvement of the ISMS based on ISO/IEC 27001

ISO/IEC 27001 Lead Implementer Course, Module 9: Preparing for the ISMS certification audit

ISO 27001 Security Awareness Training and Compliance - InfosecTrain1

ISO/IEC 27001 compliance and cybersecurity awareness training2

ISO 27001 Free Training | Online Course | British Assessment Bureau

Based on his tasks, Bob is part of the incident response team (IRT) of InfoSec. According to the ISO/IEC 27001:2022 standard, an IRT is a group of individuals who are responsible for responding to information security incidents in a timely and effective manner. The IRT should have the authority, skills, and resources to perform the following activities:

Identify and analyze information security incidents and their impact

Contain, eradicate, and recover from information security incidents

Communicate with relevant stakeholders and authorities

Document and report on information security incidents and their outcomes

Review and improve the information security incident management process and controls

Bob’s job is to deploy a network architecture that can prevent potential attackers from accessing InfoSec’s private network, and to conduct a thorough evaluation of the nature and impact of any unexpected events that might occur. These tasks are aligned with the objectives and responsibilities of an IRT, as defined by the ISO/IEC 27001:2022 standard.

References:

ISO/IEC 27001:2022, Information technology — Security techniques — Information security management systems — Requirements, Clause 10.2, Information security incident management

ISO/IEC 27035-1:2023, Information technology — Information security incident management — Part 1: Principles of incident management

ISO/IEC 27035-2:2023, Information technology — Information security incident management — Part 2: Guidelines to plan and prepare for incident response

PECB, ISO/IEC 27001 Lead Implementer Course, Module 10, Information security incident management

An access control software is a type of preventive control that is designed to limit the access to sensitive files and information based on the user’s identity, role, or authorization level. An access control software helps to protect the confidentiality, integrity, and availability of the information by preventing unauthorized users from viewing, modifying, or deleting it. An access control software also helps to create an audit trail that records who accessed what information and when, which can be useful for accountability and compliance purposes.

The IT Department of a financial institution decided to implement preventive controls to avoid potential security breaches. Therefore, they separated the development, testing, and operating equipment, secured their offices, and used cryptographic keys. However, they are seeking further measures to enhance their security and minimize the risk of security breaches. An access control software would help the IT Department achieve this objective by adding another layer of protection to their sensitive files and information, and ensuring that only authorized personnel can access them.

References:

ISO/IEC 27001:2022 Lead Implementer Course Guide1

ISO/IEC 27001:2022 Lead Implementer Info Kit2

ISO/IEC 27001:2022 Information Security Management Systems - Requirements3

ISO/IEC 27002:2022 Code of Practice for Information Security Controls4

What are Information Security Controls? - SecurityScorecard4

What Are the Types of Information Security Controls? - RiskOptics2

Integrity is the property of safeguarding the accuracy and completeness of information and processing methods. A breach of integrity occurs when information is modified or destroyed in an unauthorized or unintended manner. In this case, Diana accidently modified the order details of a customer without their permission, which resulted in the customer receiving an incorrect product. This means that the information about the customer’s order was not accurate or complete, and therefore, the integrity principle was breached. Availability and confidentiality are two other information security principles, but they were not violated in this case. Availability is the property of being accessible and usable upon demand by an authorized entity, and confidentiality is the property of preventing disclosure of information to unauthorized individuals or systems.

References: ISO/IEC 27001:2022 Lead Implementer Course Content, Module 5: Introduction to Information Security Controls based on ISO/IEC 27001:20221; ISO/IEC 27001:2022 Information Security, Cybersecurity and Privacy Protection, Clause 3.7: Integrity2

According to ISO/IEC 27001:2013, clause 9.1, an organization must monitor, measure, analyze and evaluate its information security performance and effectiveness. Thisincludes determining what needs to be monitored and measured, the methods for doing so, when and by whom the monitoring and measurement shall be performed, when the results shall be analyzed and evaluated, and who shall be responsible for ensuring that the actions arising from the analysis and evaluation are taken 1.

SunDee failed to comply with this requirement and did not monitor or measure the performance and effectiveness of its ISMS for the past two years. As a result, the company did not have any objective evidence or indicators to demonstrate the achievement of its information security objectives, the effectiveness of its controls, the satisfaction of its interested parties, or the identification and treatment of its risks. Thisalso meant that the company did not conduct regular management reviews of its ISMS, as required by clause 9.3, which would provide an opportunity for the top management to ensure the continuing suitability, adequacy and effectiveness of the ISMS, and to decide on any changes or improvements needed 1.

Just before the recertification audit, the company decided to conduct an internal audit, as required by clause 9.2, which is a systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled 1. However, the company did not have a well-defined audit program, scope, criteria, or methodology, and relied on the written reports of its staff for the past two years. This caused a disruption in the workforce, as most of the staff had to compile their reports for their departments, leaving the Production Department with less than the optimum workforce, which decreased the company’s stock. Moreover, the internal audit process was very inconsistent, as the reports were written by different employees with different styles, formats, and levels of detail. The internal audit process also lacked any qualitative measures, such as performance indicators, metrics, or benchmarks, to evaluate the performance and effectiveness of the ISMS.

Therefore, the cause of SunDee’s workforce disruption was the negligence of performance evaluation and monitoring and measurement procedures, which led to a lack of objective evidence, a poorly planned and executed internal audit, and a decrease in the company’s productivity and stock value.

References: 1: ISO/IEC 27001:2013, Information technology – Security techniques – Information security management systems – Requirements