Summary
The main objectives of BS ISO/IEC 13335 are:
to define and describe the concepts associated with the management of IT security
to identify the relationships between the management of IT security and management of IT in general
to present several models which can be used to explain IT security
to provide general guidance on the management of IT security.
Contents
Foreword Introduction Scope Definitions Security concepts and relationships Objectives, strategies and policies Organizational aspects of ICT security ICT security management functions
Government and commercial organizations rely heavily on the use of information to conduct their business activities. Compromise of confidentiality, integrity, availability, non-repudiation, accountability, authenticity and reliability of an organization as assets can have an adverse impact. Consequently, there is a critical need to protect information and to manage the security of ICT systems within organizations. This requirement to protect information is particularly important in todays environment because many organizations are internally and externally connected by networks of ICT systems not necessarily controlled by their organizations. As well, legislation in many countries requires that management take appropriate action to mitigate risk related to the business and the use of ICT systems. Such legislation may cover not only privacy/data protection but also healthcare and financial markets, among others. BS ISO/IEC TR 13335 Part 1 provides ...