Microsoft PowerPoint - ISMS-ITSMS.ppt

Size: px

Start display at page:

Download "Microsoft PowerPoint - ISMS-ITSMS.ppt"

祀坍闵
5 years ago
Views:

How ISMS can help outsourcing management by Chris Cheng, ISMS

National Standard Body 世界首家国家标准机构 (NSB) 1901,20000 ISO9000

ISO9000/14000/ OHSAS18000 ISO27001/ISO20000 TL9000 TS16949

mark RoHS CE mark ISO13485 Medical devices Standards

1 How ISMS can help outsourcing management by Chris Cheng, ISMS Product Manager BSI Management Systems, China BSI-The first National Standard Body 世界首家国家标准机构 (NSB) 1901,20000 ISO9000 BS5750 ISO14000 BS7750 ISO27001 BS7799 ISO20000 BS15000 ISO9000/14000/ OHSAS18000 ISO27001/ISO20000 TL9000 TS16949 Assessment/ Certificate Standard Training Product Service Kite mark RoHS CE mark ISO13485 Medical devices Standards Implementation Risk management Business Continue Management Certified by BSI Foundation 1

2 Business Demand & Management System ISO ISO Finance BS 6079 & Environmental Strategy Quality Management Management ISO 9000 / QS/TL/AS/HACCP/ IT service ISO Human Resource Integration Management System Customer Satisfaction ISO / CMSAS 86 Information Security ISO / ISO Health & Safety Product Reliability CE, UL, Kite Mark, CCC OHSAS Why we need ISMS Information Business relay on information heavily The information system more and more complicated Globalization Global factory Competitive edge Social responsibility Protect ourselves, protect others 2

3 ISMS in outsourcing More information handled by partner ISMS is a checklist for security management with ISMS enhance partner confidence ISMS 标准构成 ISO/IEC 17799:2005 (BS 7799 Part 1) Code of Practice for Information Security 信息安全实践要点 ISO/IEC 27001:2005 (BS 7799 Part 2) Information Security Management Systems Requirement 信息安全管理体系要求 3

4 Risk Assessment 风险评估组织将定义出适当的风险评估方法, 并对所有资产鉴别出的风险进行评估 1. Assets 资产 2. Asset values 资产价值 3. Threats 威胁 4. Vulnerabilities 弱点 5. Likelihood/ Probability 可能性 / 概率 6. Consequence/ Impacts 后果 / 冲击 Risks 风险 4

5 Risk Treatment 风险处理 Avoiding the risk 避免风险 Reducing the risk to an acceptable level 降低风险到可接受水平 Transferring the risk 转移风险 Accepting the residual risk 接受残余风险 ISMS Risk protect against 预防 Controls 控制 met by 符合 Threats 威胁 Security Requirements 安全要求 Increase 增加 Reduce 降低 Indicate 显示 Exploit 利用 Risks 风险 Vulnerabilities 脆弱性 Increase 增加 Increase 增加 Expose 暴露 Assets 资产 Asset Values 资产价值 Potential impact on Business 对企业的潜在冲击 Have 具有 5

6 ISMS_Risk Management Process Asset Identification and Valuation 资产鉴别与评价 Business Risk 营运风险 Risk Assessment 风险评估 Identification of vulnerabilities 脆弱性的鉴别 Identification of Threats 威胁的鉴别 Evaluation of Impacts 冲击的评估 Rating/ranking of Risks 风险的分级 Review of Existing Security Controls 现有的安全控制措施审查 Risk Acceptance (Residual Risk) 风险可接受度 ( 残余风险 ) Identification of new Security Controls 新安全控制措施的鉴别 Risk Management 风险管理 Policy and Procedures 政策与程序 Implementation and Risk Reduction 实施与风险降低 ISMS 标准构成 Security Policy Organizing Information Security Asset Management Human Resource Security Physical &Env Security Access Control Comm & Operation Management Information Security Incident Management Business Continuity Management Compliance Information Systems Acquisition, Development and Maintenance 6

7 ISMS certificate development Accenture 埃森哲 Bearing 3000 Point 毕博 GenPact 2500简柏特 2555 SMIC 2000 中芯国际 HHNEC 1500华虹 NEC 1315 Samsung 1000 三星 1107 Ricoh 500 理光 BJ Mobile 0 data 11 center 12 北京移动数据中心 Jazz Semiconductor 捷智半导体 Shanghai SuperComputer 上海超级计算中心 GDS 万国数据 Bleum 博朗软件 2005 年 3 月 2005 年 5 月 2005 年 7 月 2005 年 9 月 2005 年 11 月 2006 年 1 月 2006 年 3 月 2006 年 5 月 2006 年 7 月 2707 Total China ISMS Benefit The risk of information theft, loss or corruption is minimised 信息失窃丢失破坏的风险被最小化 Customers have access to information through secure and protected media 客户可以籍由安全和保护的介质获取信息 The system ensures that risks and appropriate controls are continually reviewed 系统可确保风险和适宜的控制措施被持续回顾 Internal Management Improvement Customer Confidence 7

What service BSI provide Assessment and Certificate Training Essential Course 基础课 Implementation Course 实施课 Internal Auditor 内审员 Lead Auditor 主任审核员 Certified by BSI

8 What service BSI provide Assessment and Certificate Training Essential Course 基础课 Implementation Course 实施课 Internal Auditor 内审员 Lead Auditor 主任审核员 Certified by BSI Foundation Thanks Q&A 成芳 ( Chris Cheng) QMS/ISMS/ITSM Lead Auditor BSI 中国区 ISMS 产品经理 Chris.cheng@bsi-global.com Tel:

Microsoft PowerPoint - BSI_ISSM_presentation.ppt

Microsoft PowerPoint - BSI_ISSM_presentation.ppt How ISMS can help outsourcing management 信息安全管理体系应用于外包管理 by Chris Cheng, ISMS Product Manager BSI Management Systems, China BSI-The first National Standard Body 世界首家国家标准机构 (NSB) 1901,20000 ISO9000 BS5750