[In response to a LinkeDin query about finding an information security consultant for a 'security compliance project' (whatever that means!), I developed a slightly shorter version of the following advice, extending something I wrote much earlier in relation to finding a contractor/consultant IT auditor . I think the basic principles are quite general and deserve a wider airing, so I'm repeating them here for now. I may yet turn this into a paper for one of the websites or journals if the feedback is positive, provided I ever find the time and energy to continue.] In preparing to contract with a consultant, there are maybe three or four distinct aspects to consider and document. Some issues blur across the aspects shown, and there may well be other factors you need to consider. Furthermore, answering the rhetorical questions below may involve reviewing other answers, plans etc . - this is an iterative process of Consider - Document - Review - Reconsider ...  Define the wor...

Suggested text for a new control on cloud computing Back in February 2011, I proposed to incorporate a new information security control on cloud computing into ISO/IEC 27002 which was being revised by the committee at the time. See what you make of the donor text I provided in New Zealand's submission to  ISO/IEC JTC1/SC27  ... ---------------------------------- Control objective To identify and mitigate the information security risks associated with cloud computing. Implementation guidance The organization should analyze the information security risks associated with its intended use of cloud computing and specify appropriate risk treatments, normally including specific information security controls such as those outlined below, as part of the process of determining its requirements for cloud services. The following information security controls are not meant to be comprehensive, but suggest typical information security aspects to be taken into account when implementing clo...

Krag and I have discussed this question from time to time and, although we are broadly aligned in our thinking, we haven't yet totally resolved our differences ... which makes the exchanges fun. With that in mind, I always wonder what someone really means when they talk about KPIs. To some, Key Performance Indicator has a very specific and particular meaning, although I suspect if we assembled a dozen such people in a room to discuss it, we'd soon end up realizing that we have more than a dozen different interpretations!  To others (including me, as it happens), KPI is a generic, blanket term for a class or type of metric that satisfies the criteria implied by the term:  Key implies that the metric itself is especially important, crucial or vital even, given that there are many many different ways to measure and assess things but most of them are of limited value. Picking out the few things that truly matter is a core issue in metrics. 'Spam volume' is an example of a...

We have just delivered April's awareness module on information security and privacy compliance, a perennial topic that remains stubbornly on management's agenda. This time around, we had the 'benefit' of an excellent ready-made compliance case study in the shape of Target's recent breach. Reviewing the news on Target revealed plenty of lessons on compliance, security, privacy, governance, risk management, incident response, press relations and accountability - a rich vein indeed! Something else that came out of our research was the value of encouraging compliance in a positive sense, as much as hammering non-compliance through enforcement and penalties, the more conventional approach (typified by this poster image - one of six new designs in the module).  Compliance benefits the organization, management, the authorities, customers, business partners, owners, stakeholders and society, as well as individual workers. The module talks about good practices, maturity and ...

Continuing the series of bloggings on new/changed controls proposed to SC 27 in 2011 for incorporation into the 2013 version of ISO/IEC 27002 , we come next to thorny issue of business continuity. Let me set the scene for this by reminding you what ISO/IEC 27002:2005  had to say about business continuity management in its section 14  ( italicized ) along with my comments (not italicized). 14.1 INFORMATION SECURITY ASPECTS OF BUSINESS CONTINUITY MANAGEMENT  Objective:  To counteract interruptions to business activities and to protect critical business processes from the effects of major failures of information systems or disasters and to ensure their timely resumption. Mmm.  OK, well I note that it mentions 'information systems', primarily meaning IT systems - at least, that is how the vast majority of readers will interpret it. The mention of resumption also hints at IT Disaster Recovery (DR) which in practice was the main emphasis of business continui...

Things being measured are patently being observed in a very specific, focused manner. Things that are observed so closely tend to be presumed by others to be of concern to the measurer/observer, at least. Things under the measurement ruler therefore assume a certain significance simply by dint of their being closely observed , regardless of any other factors. We see this 'fascination bias' being actively exploited by cynical promoters, marketers and advertisers on a daily basis through an endless stream of largely banal and unscientific online polls and infographics, their true purpose made all the more obvious by the use of bright primary-color eye-catching graphics. They are manipulating readers to believe that since something has been measured, it must be important. How many of us take the trouble to think about the quality of the metrics, or about all the other aspects that haven't been measured? Like bunnies in the headlights, we stare at the numbers. In PRAGMATIC Secu...