Background
We wanted to be able to prove that we managed information security systemically. We knew that we had the basics in place. We had worked through the Cyber Essentials requirements, so we knew we had the minimum standard recommended by the Government and the National Cyber Security Centre. As a business that develops software and manages servers, we felt that we needed to set our sights higher, mature our security practices and hold ourselves to the highest standard.
This led us to the ISO 27001 standard for information security, cybersecurity and privacy protection. This is the international standard that sets requirements for creating, implementing, operating and continually improving an information security management system. We knew that this would require a serious commitment, but we felt that a lighter security framework was not enough.
Getting started
The first hurdle was understanding the standard itself. The information security management system requirements run to 26 pages followed by a further document outlining controls which runs to 164 pages and 93 controls. The standard applies to businesses of all sizes, large and small, operating in all sectors, so the language was sometimes unfamiliar. It was a case of mapping the requirements to what we were doing, identifying gaps and researching best practices.
We started with what was most familiar which, for us, was the requirements around software development. That helped us get to grips with how the standard worked, and, from there, we worked in parallel on the technological controls and the operational, people and physical controls. We had many good practices in place, but, as a small business, we needed better documentation, risk management and evidence.
Challenge 1: Documentation
Documented policies and procedures form the foundation of an information management system, as they are formal statements of what you do. They cover areas such as access control, incident response, backups, supplier management, asset management, information handling, business continuity and employee training. We have been forced to re-assess the processes and procedures that we had in place, to compare them to best practice and to document them.
As certification is ongoing, all of the documentation requires regular reviews and updates to ensure that it stays current and regular checks that practice matches what is in the documentation. This is actually quite difficult for a small team, and it took us a while to find an approach that works for us, with a clever technical solution that minimises administrative effort so we can focus on making an impact.
Challenge 2: Risk Management
ISO 27001 focuses on assessing and treating information security risks in a structured way. Risk assessment involves looking at our entire operations, figuring out the biggest risks and coming up with treatments to control or reduce the likelihood or impact of the risk. It includes a threat intelligence process of gathering information on evolving cyber risks.
In attaining this certification, we commit to making information security a priority for Olamalu, through assigning resources, including ongoing education for the whole team, and constantly assessing risks.
Challenge 3: Evidence
As part of the certification process, we are required to consider a list of controls that cover the full scope of our operations, from managing suppliers to educating our team members, from physical security perimeters to secure disposal of equipment, from network segregation to secure authentication. These controls address questions of information security from the perspective of technology, physical security, people and operations. By implementing the relevant controls, we commit to meeting the requirements and following best practice.
It is not enough to say that a control exists. Auditors expect records and evidence to prove that you are doing what you say you are doing. We are audited by an experienced consultant every three months and by a certification body every year, with a full recertification every three years. This demanding cycle ensures that an ISO 27001 certified business is always maintaining the required standard and that they are continually improving their information management system.
The impact
Obtaining this certification has made sure that we are thinking about information security during every stage of a project, from the initial discussions through coding and on to deployment. We consider information security risks at every stage and take actions to mitigate them. Everything we build is architected and coded with cyber security in mind. Our developers have a quarterly secure development session, where they talk about secure development and coding best practices.
We have also tightened up how we manage information security on a live site by implemented a more structured change management process. This minimises the probability of the change having an adverse effect on the rest of the site. Change requests outline a test plan so that there is a clear check that everything is working correctly. We want our clients to feel comfortable that we always look after their website or application from its inception and throughout its lifecycle.
We have re-looked at every aspect of our technical environment since getting this certification, including server configuration, threat intelligence and vulnerability management. With the advent of AI, there are more and more frequent security updates that need ever faster response times. We have improved our process of managing security updates, so that we can now keep up-to-date with fast security updates for the software that our clients’ websites run on and the software that our servers run on.
Everyone on the team is kept aware of what they need to do about information security, through ongoing training and awareness sessions, especially about phishing attacks. The majority of security breaches involve phishing in some form, so it is important that everyone is alert to potential scams and recent phishing events. On a weekly basis, we discuss the kinds of phishing that have been sent to the company and which are on the news, making it very easy for people to report any phishing attempts and stay aware of any dangers.
The certification has ensured that we put in place a more formalised incident response procedure, with predefined steps to work through. We frequently carry out exercises with specific scenarios to help us to be ready for different types of attacks. With increasingly frequent attacks, it is more important than ever that everyone knows how to respond to a security incident.
As a result of having to constantly review our procedures, our operations have become more comprehensively and reliably secure. We now have in place a detailed business continuity plan, which means Olamalu can continue to run in whatever circumstances it faces. While creating this plan and considering best practices, we were really forced to think thoroughly about how we can keep operations running, what is truly necessary for us to have in place, what are the risks we face and how we might respond to them. All of our plans are tested by doing exercises where we take key risks and walk through the responses, so that the right people know what to do if it is necessary.
The outcome
We wanted to do this certification because we knew that it would make us practice information security procedures to the highest standard. Our clients know that they can trust our ISO 27001 certification, its breadth and depth, and the continual and rigorous audits we undergo. As a result of all our reviews, our operations have become more dependable, consistent and resilient. We are committed to retaining this certification and to keep improving and refining our information security approach.