Security in the Cloud: ISO 27001 Explained

Cloud computing is no less at risk than an on-premises environment. That said, adopting an Information Security Management System (ISMS) is a great starting point to protecting your information against cyber threats.

However, with its broad scope, many business owners often find themselves stuck on where to start. If information security is of crucial concern, ISO 27001 can serve as an excellent guideline.

What Is ISO 27001?

Formerly known as ISO/IEC 27001:2005, ISO/IEC 27001-Information technology-Security techniques-Information security management systems-Requirements, is a specification for an ISMS.

An ISMS is a framework of policies and procedures developed to handle information security and includes all legal, physical and technical controls involved in an organization’s information risk management process.

Published by the International Organization for Standardization (ISO), in collaboration with the International Electrotechnical Commission (IEC), ISO 27001 focuses on establishing, implementing, operating, monitoring, reviewing, maintaining, and improving an information security management system.

What is the Purpose of ISO 27001?

Whenever you store your information online, there is always the issue of security. How do you ensure your data is safe from attacks by cybercriminals?

The ISO standard helps organizations protect their information cost-effectively by developing a set of policies and guidelines. Additionally, companies also get an internationally recognized certificate that they can use to build a reputation, as well as increase business opportunities.

It’s such a game changer that some countries have gone to the lengths of requiring some industries to implement it. Laws will differ with each country, so it's always advisable to check with your region’s regulations beforehand.

Both businesses and individuals can get ISO 27001 certified. Certification for companies is easy. All the business needs to do is to maintain an ISMS that covers all aspects of the standard, then invite an accredited certification body to perform the certification audit.

For individual certification, one can enroll for training, where you have to show you have acquired the skills necessary by passing the exam. Once issued, the certificate lasts for three years during which the certification body will be regularly performing surveillance audits to evaluate implementation.

As you can see, receiving an ISO certification isn’t as easy as filling out a checklist and submitting it for approval. It requires hard work and collaboration from both internal and external stakeholders.

Failure to comply with the policies and procedures outlined in the standard risks failing a future audit, and potentially losing your certification. In some regions, you might not even be allowed to operate without certification.

The CIA Triad

The CIA triad comprises of three ISMS security objectives:

• Confidentiality: Only authorized persons should have access to information, especially classified data. File and volume encryptions, access control lists, and Unix file permissions are some of the means companies can manage confidentiality.

• Integrity: Data integrity is of utmost importance in information security, and only authorized persons can alter the data. Guaranteeing data integrity also involves ensuring unauthorized modifications or deletions made can be undone.

• Availability: Information should be available upon need by authorized persons. Power outages, network failure, and sabotage are some of the risks facing information availability.

As there lacks a one-fits-all approach to information security, it’s the duty of those responsible for managing information security risks to apply security controls based on their risk assessment.

ISO 27001 attaches utmost importance to protecting the CIA triad, which is achieved by assessing the risks plausible and coming up with mitigation measures to prevent such incidents from occurring.

Put simply, the standard is founded on a process for managing risks by first establishing where the threats exist, and then systematically addressing them through the adoption of security controls.

The standard, which takes a risk-based approach to address information security, defines a six-step planning process:

1. Define a security policy

2. Define the scope of the ISMS

3. Conduct a risk assessment

4. Managed identified risks

5. Select the control objectives and controls to be implemented

6. Prepare a statement of applicability

As this standard only offers a checklist of controls for businesses to follow, companies should consider adopting it together with ISO/IEC 27002:2005. ISO/IEC 27002:2005 includes a comprehensive set of information security control objectives and a set of generally accepted security controls.

Whether ISO 27001 is GDPR compliant is a question that gets asked often. As the standard only offers a framework for developing an ISMS, it doesn’t cover the general rules of GDPR put in place by the European Union. Luckily, pairing this standard with ISO 27701 will ensure GDPR compliance.

What are the ISO 27001 Controls?

Also known as safeguards, these are the practices to be implemented to reduce risks to acceptable levels. These practices can be:

• Technical: These are mainly implemented in the information system department and include anything from software and hardware to firmware components. Creating a backup or installing antivirus software are some of the basic technical controls.

• Organizational: This includes defining the expected behavior from the users and the system. Access Control Policy and BYOD Policy are some of the controls commonly applied.

• Legal: Legal controls are implemented by ensuring set rules and behaviors comply with other business regulations.

• Physical: Physical controls involve using devices humans physically interact with, such as CCTV cameras, alarm systems, or locks.

• Human resource: These controls are implemented by sharing awareness on how to perform your activities securely. Such will include security awareness training and internal auditor training.

Security in the Cloud

Laboratory monitoring is crucial for flexibility and agility in daily operations. And with so many pharmaceutical, life science, biotech and healthcare industries moving their devices, data centers, business processes and more to the cloud, security in the cloud is essential.

The good news is, one can ensure security in the cloud and protect digital information by implementing ISO/IEC 27001. This is the best-known compliance standard within the ISO/IEC 27000 family of standards.

Founded in 1986, ELPRO Cloud is a secure cloud database solution that protects your valuable data from breaches, unauthorized access and other threats.