ISO/IEC 27040

Last updated

ISO/IEC 27040 [1] is part of a growing family of International Standards published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in the area of security techniques; the standard is being developed by Subcommitee 27 (SC27) - IT Security techniques of the first Joint Technical Committee 1 (JTC 1) of the ISO/IEC. A major element of SC27's program of work includes International Standards for information security management systems (ISMS), often referred to as the 'ISO/IEC 27000-series'.

Contents

The full title of ISO/IEC 27040 is Information technology — Security techniques — Storage security (ISO/IEC 27040:2015)

Overview and introduction

The purpose of ISO/IEC 27040 is to provide security guidance for storage systems and ecosystems as well as for protection of data in these systems. It supports the general concepts specified in ISO/IEC 27001.

This International Standard is relevant to managers and staff concerned with information security risk management within an organization and, where appropriate, external parties supporting such activities. The objectives for this International Standard are to:

ISO/IEC 27040 provides specific, detailed implementation guidance relevant to storage security for the general security controls described in ISO/IEC 27002.

This International Standard is not a reference or normative document for regulatory and legislative security requirements as they vary by country.

History

Work commenced on ISO/IEC 27040 in the fall of 2010, following the SC27 meeting in Redmond, WA. The project was placed on the extended timeline, allowing up to 48 months to develop the standard rather than the normal 36 months. The ISO/IEC 27040 standard was published on January 5, 2015.

Throughout the development of ISO/IEC 27040, organizations such as the Storage Networking Industry Association (SNIA) with its Storage Security Best Current Practices (BCPs), [2] [3] the Trusted Computing Group's (TCG) Storage Working Group with its work on self-encrypting drives, and INCITS' storage-oriented Technical Committees (T10, T11, and T13) provided important comments[ who? ] and contributions.

Eric Hibbard served as the ISO Editor throughout the development of ISO/IEC 27040.

Structure of the standard

27040:2015 has seven short clauses and three annexes, which cover:

1. Scope of the standard
2. A list of other standards that are indispensable to understanding and using ISO/IEC 27040
3. Terminology that is either imported from other standards or defined in this standard
4. A list of used abbreviations and acronyms used in the standard
5. An overview of key storage and storage security concepts as well as information on the associated risks
6. Describes the controls that support storage security technical architectures, including Direct Attached Storage (DAS), storage networking, storage management, block-based storage, file-based storage, object-based storage, and security services.
7. Provides guidelines for the design and implementation of storage security (e.g., design principles; data reliability, availability, and resilience; data retention; data confidentiality and integrity; visualization; and design and implementation considerations)
Annex A. Media-specific guidance for sanitization, including cryptographic erase (parallels NIST SP 800-88r1)
Annex B. Tables for selecting appropriate security controls based on data sensitivity or security priorities (confidentiality, integrity, or availability)
Annex C. Descriptions of important security and storage concepts (mini-tutorials)
Bibliography. A list of standards and specifications that had an influence on materials in ISO/IEC 27040

It is worth noting that the bibliography is one of the more comprehensive lists of references on storage security.

Supporting controls for storage security

A major element of the ISO/IEC 27040 standard is focused on the identification of security controls for different types of storage systems and architectures, including the following:

Design and implementation guidance for storage security

Despite the increased power of personal computers and departmental workstations, there continues to be a dependency on centralized data centers due to needs for data integration, data consistency, and data quality. With the enormous growth of critical data volumes, many organizations have adopted storage-centric architectures for their ICT infrastructure. Consequently, storage security plays an important role in securing this data, and in many instances, it serves as the last line of defense from both internal and external adversaries.

The design of storage security solutions is guided by core security principles while considering data sensitivity, criticality and value. Section 6 of the standard (Supporting Controls) provides guidance on applying storage-relevant controls in implementing the designed solution. The materials in this section are further divided into:

Media sanitization

"Sanitization" is the technical term for assuring that data left on storage at the end of its useful life is rendered inaccessible to a given level of effort. Or to put it another way, sanitization is the process that assures an organization doesn't commit a data breach by repurposing, selling, or discarding storage devices.

Sanitization can take many forms depending on both the sensitivity of the information and the level of effort a likely adversary would invest in attempting to recover the information. Methods used in sanitization range from simple overwrites to destruction of the cryptographic keys for encrypted data (the technique is known as cryptographic erasure) to physical destruction of the storage media. This standard provides guidance to help organizations select the proper sanitization methods for their data.

The specific details on sanitization are provided in a series of tables in Annex A, which were based on NIST Special Publication 800-88 Revision 1. [4] The tables were designed so that vendors can make specific references to them, based on the type of media, instead of using obsolete sources such as DoD 5220.22-M (from 1995).

Selecting appropriate storage security controls

The developers of ISO/IEC 27040 did not intend that all of the guidance had to be implemented (i.e., all or nothing).[ who? ] Consequently, Annex B was created to help organizations select the appropriate controls based on either data sensitivity (high or low) or security priorities, based on confidentiality, integrity and availability.[ who? ] To support this selection, all of the storage security controls in ISO/IEC 27040 are listed in 13 different tables along with information that shows how each control is relevant from both data sensitivity and security prioritization perspectives.

It is worth noting that although Annex B is informative, it is very likely that auditors will use it as a basis for checklists when reviewing the security of storage systems and ecosystems.[ who? ]

Important security concepts

One of the challenges in developing ISO/IEC 27040 was that there were two distinct target audiences: 1) storage professionals and 2) security professionals. To help both communities, Annex C was populated with useful tutorial information[ who? ] for the following:

Related Research Articles

ISO/IEC 7816 is an international standard related to electronic identification cards with contacts, especially smart cards, and more recently, contactless mobile devices, managed jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

<span class="mw-page-title-main">Storage Networking Industry Association</span> Trade association formed to develop standards for storage area networks

The Storage Networking Industry Association (SNIA) is a registered 501(c)(6) non-profit trade association incorporated in December 1997. SNIA has more than 185 unique members, 2,000 active contributing members and over 50,000 IT end users and storage professionals. The SNIA absorbed the Small Form Factor Committee.

Data remanence is the residual representation of digital data that remains even after attempts have been made to remove or erase the data. This residue may result from data being left intact by a nominal file deletion operation, by reformatting of storage media that does not remove data previously written to the media, or through physical properties of the storage media that allow previously written data to be recovered. Data remanence may make inadvertent disclosure of sensitive information possible should the storage media be released into an uncontrolled environment.

Authenticated Encryption (AE) is an encryption scheme which simultaneously assures the data confidentiality and authenticity. Examples of encryption modes that provide AE are GCM, CCM.

Information security standards or cyber security standards are techniques generally outlined in published materials that attempt to protect the cyber environment of a user or organization. This environment includes users themselves, networks, devices, all software, processes, information in storage or transit, applications, services, and systems that can be connected directly or indirectly to networks.

Security controls are safeguards or countermeasures to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets. In the field of information security, such controls protect the confidentiality, integrity and availability of information.

Information security management (ISM) defines and manages controls that an organization needs to implement to ensure that it is sensibly protecting the confidentiality, availability, and integrity of assets from threats and vulnerabilities. The core of ISM includes information risk management, a process that involves the assessment of the risks an organization must deal with in the management and protection of assets, as well as the dissemination of the risks to all appropriate stakeholders. This requires proper asset identification and valuation steps, including evaluating the value of confidentiality, integrity, availability, and replacement of assets. As part of information security management, an organization may implement an information security management system and other best practices found in the ISO/IEC 27001, ISO/IEC 27002, and ISO/IEC 27035 standards on information security.

ISO/IEC 27002 is an information security standard published by the International Organization for Standardization (ISO) and by the International Electrotechnical Commission (IEC), titled Information security, cybersecurity and privacy protection — Information security controls.

The ISO/IEC 27000-series comprises information security standards published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

MEHARI is a free, open-source information risk analysis assessment and risk management method, for the use of information security professionals.

ISO/IEC 27005 "Information technology — Security techniques — Information security risk management" is an international standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) providing good practice guidance on managing risks to information. It is a core part of the ISO/IEC 27000-series of standards, commonly known as ISO27k.

Information technology risk, IT risk, IT-related risk, or cyber risk is any risk relating to information technology. While information has long been appreciated as a valuable and important asset, the rise of the knowledge economy and the Digital Revolution has led to organizations becoming increasingly dependent on information, information processing and especially IT. Various events or incidents that compromise IT in some way can therefore cause adverse impacts on the organization's business processes or mission, ranging from inconsequential to catastrophic in scale.

Cloud computing security or, more simply, cloud security, refers to a broad set of policies, technologies, applications, and controls utilized to protect virtualized IP, data, applications, services, and the associated infrastructure of cloud computing. It is a sub-domain of computer security, network security, and, more broadly, information security.

<span class="mw-page-title-main">IT risk management</span>

IT risk management is the application of risk management methods to information technology in order to manage IT risk, i.e.:

ISO/IEC 27001 is an international standard to manage information security. The standard was originally published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in 2005, revised in 2013, and again most recently in 2022. There are also numerous recognized national variants of the standard. It details requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) – the aim of which is to help organizations make the information assets they hold more secure. Organizations that meet the standard's requirements can choose to be certified by an accredited certification body following successful completion of an audit. The effectiveness of the ISO/IEC 27001 certification process and the overall standard has been addressed in a large-scale study conducted in 2020.

Storage security is a specialty area of security that is concerned with securing data storage systems and ecosystems and the data that resides on these systems.

The Open Trusted Technology Provider Standard (O-TTPS) is a standard of The Open Group that has also been approved for publication as an Information Technology standard by the International Organization of Standardization and the International Electrotechnical Commission through ISO/IEC JTC 1 and is now also known as ISO/IEC 20243:2015. The standard consists of a set of guidelines, requirements, and recommendations that align with best practices for global supply chain security and the integrity of commercial off-the-shelf (COTS) information and communication technology (ICT) products. It is currently in version 1.1. A Chinese translation has also been published.

Data sanitization involves the secure and permanent erasure of sensitive data from datasets and media to guarantee that no residual data can be recovered even through extensive forensic analysis. Data sanitization has a wide range of applications but is mainly used for clearing out end-of-life electronic devices or for the sharing and use of large datasets that contain sensitive information. The main strategies for erasing personal data from devices are physical destruction, cryptographic erasure, and data erasure. While the term data sanitization may lead some to believe that it only includes data on electronic media, the term also broadly covers physical media, such as paper copies. These data types are termed soft for electronic files and hard for physical media paper copies. Data sanitization methods are also applied for the cleaning of sensitive data, such as through heuristic-based methods, machine-learning based methods, and k-source anonymity.

References

  1. ↑ "ISO/IEC 27040". ISO Standards Catalogue. ISO. Retrieved 2014-06-15.
  2. ↑ Eric A. Hibbard; Richard Austin (2007). "SNIA Storage Security Best Current Practices (BCPs)". Storage Network Industry Association.
  3. ↑ Eric A. Hibbard (2012). "SNIA Security Tutorial: Storage Security - The ISO/IEC Standard" (PDF). Storage Network Industry Association.
  4. ↑ "Special Publication 800-88r1" (PDF). National Institute of Standards and Technology (NIST).
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.