ISO/IEC 27002 is an information securitystandard published by the International Organization for Standardization (ISO) and by the International Electrotechnical Commission (IEC), titled Information technology – Security techniques – Code of practice for information security controls.

The system must allow users to select and change their own passwords and include a confirmation procedure to allow for input errors. The system must not display passwords on the screen when being entered. The system must store and transmit passwords in a protected form. ISO/IEC 27002 is a massive monolithic standard covering a deliberately broad range of information security controls. Some 237 pages of comments on WD2 were received and processed, reflecting the extent of interest across the globe. ISO/IEC 27001 is the best-known standard in the family providing requirements for an information security management system (ISMS). There are more than a dozen standards in the 27000 family, you can see them here. Aug 18, 2016 NIST’s new password rules – what you need to know. 18 Aug 2016 91 2-factor Authentication. And one other thing nobody mentioned is password complexity requirements that are. Password policies are a set of rules which were created to increase computer security by encouraging users to create reliable, secure passwords and then store and utilize them properly. Here are some of the password policies and best practices that every system administrator should implement: 1. Enforce Password History policy.

The ISO/IEC 27000-series standards are descended from a corporate security standard donated by Shell to a UK government initiative in the early 1990s.^[1] The Shell standard was developed into British Standard BS 7799 in the mid-1990s, and was adopted as ISO/IEC 17799 in 2000. The ISO/IEC standard was revised in 2005, and renumbered ISO/IEC 27002 in 2007 to align with the other ISO/IEC 27000-series standards. It was revised again in 2013.

ISO/IEC 27002 provides best practice recommendations on information security controls for use by those responsible for initiating, implementing or maintaining information security management systems (ISMS). Information security is defined within the standard in the context of the CIA triad:

the preservation of confidentiality (ensuring that information is accessible only to those authorized to have access), integrity (safeguarding the accuracy and completeness of information and processing methods) and availability (ensuring that authorized users have access to information and associated assets when required).^[2]

1Outline
2Implementation example of ISO/IEC 27002

Outline[edit]

Outline for ISO/IEC 27002:2013[edit]

The standard starts with 5 introductory chapters:

Introduction
Scope
Normative references
Terms and definitions
Structure of this standard

These are followed by 14 main chapters:

Information Security Policies
Organization of Information Security
Human Resource Security
Asset Management
Access Control
Cryptography
Physical and environmental security
Operation Security- procedures and responsibilities, Protection from malware, Backup, Logging and monitoring, Control of operational software, Technical vulnerability management and Information systems audit coordination
Communication security - Network security management and Information transfer
System acquisition, development and maintenance - Security requirements of information systems, Security in development and support processes and Test data
Supplier relationships - Information security in supplier relationships and Supplier service delivery management
Information security incident management - Management of information security incidents and improvements
Information security aspects of business continuity management - Information security continuity and Redundancies
Compliance - Compliance with legal and contractual requirements and Information security reviews

Within each chapter, information security controls and their objectives are specified and outlined. The information security controls are generally regarded as best practice means of achieving those objectives. For each of the controls, implementation guidance is provided.

Specific controls are not mandated since:

Each organization is expected to undertake a structured information security risk assessment process to determine its specific requirements before selecting controls that are appropriate to its particular circumstances. The introduction section outlines a risk assessment process although there are more specific standards covering this area such as ISO/IEC 27005. The use of information security risk analysis to drive the selection and implementation of information security controls is an important feature of the ISO/IEC 27000-series standards: it means that the generic good practice advice in this standard gets tailored to the specific context of each user organization, rather than being applied by rote. Not all of the 39 control objectives are necessarily relevant to every organization for instance, hence entire categories of control may not be deemed necessary. The standards are also open ended in the sense that the information security controls are 'suggested', leaving the door open for users to adopt alternative controls if they wish, just so long as the key control objectives relating to the mitigation of information security risks, are satisfied. This helps keep the standard relevant despite the evolving nature of information security threats, vulnerabilities and impacts, and trends in the use of certain information security controls.
It is practically impossible to list all conceivable controls in a general purpose standard. Industry-specific implementation guidelines for ISO/IEC 27001:2013 and ISO/IEC 27002 offer advice tailored to organizations in the telecomms industry (see ISO/IEC 27011) and healthcare (see ISO 27799).

Most organizations implement a wide range of information security-related controls, many of which are recommended in general terms by ISO/IEC 27002. Structuring the information security controls infrastructure in accordance with ISO/IEC 27002 may be advantageous since it:

Is associated with a well-respected international standard
Helps avoid coverage gaps and overlaps
Is likely to be recognized by those who are familiar with the ISO/IEC standard

Implementation example of ISO/IEC 27002[edit]

Here are a few examples of typical information security policies and other controls relating to three parts of ISO/IEC 27002. (Note: this is merely an illustration. The list of example controls is incomplete and not universally applicable.)

Physical and Environmental security[edit]

Physical access to premises and support infrastructure (communications, power, air conditioning etc.) must be monitored and restricted to prevent, detect and minimize the effects of unauthorized and inappropriate access, tampering, vandalism, criminal damage, theft etc.
The list of people authorized to access secure areas must be reviewed and approved periodically (at least once a year) by Administration or Physical Security Department, and cross-checked by their departmental managers.
Photography or video recording is forbidden inside Restricted Areas without prior permission from the designated authority.
Suitable video surveillance cameras must be located at all entrances and exits to the premises and other strategic points such as Restricted Areas, recorded and stored for at least one month, and monitored around the clock by trained personnel.
Access cards permitting time-limited access to general and/or specific areas may be provided to trainees, vendors, consultants, third parties and other personnel who have been identified, authenticated, and authorized to access those areas.
Other than in public areas such as the reception foyer, and private areas such as rest rooms, visitors should be escorted at all times by an employee while on the premises.
The date and time of entry and departure of visitors along with the purpose of visits must be recorded in a register maintained and controlled by Site Security or Reception.
Everyone on site (employees and visitors) must wear and display their valid, issued pass at all times, and must present their pass for inspection on req

Iso Password Standards