Security

Encryption Wizard for Oracle Encryption Wizard for Oracle- Offering data encryption software for the Oracle RDMBS. The Encryption Wizard can perform DES3 Encryption and obfuscation on a complete schema. ArticSoft ArticSoft- PGP-based file and email encryption and digital signature software. ISMS Online ISMS Online- Cloud service to support implementing, maintaining and improving your ISO/IEC 27001 information security management system. Information Security & Business Continuity Academy Information Security & Business Continuity Academy- Training and consultancy support services for those implementing ISO/IEC 27001 and BS 25999-2 ISMS Manager Software ISMS Manager Software- Software supporting an Information Security Management System SecuraStar SecuraStar- An ISO 27001 consulting firm specializing in Information Security Management Systems (ISMS). ISO/IEC 27000:2014 ISO/IEC 27000:2014- Introduces the ISO/IEC 27000 series of standards and provides a common glossary of information security terms used in the standards. Free download, 2014 editio… NIST Special Publication 800-53 NIST Special Publication 800-53- Recommended Security Controls for Federal Information Systems has a similar scope to ISO/IEC 27002 and cross-references the standard. IT Governance Limited IT Governance Limited- Information, books and case studies on ISO/IEC 27001 and the other ISO27k standards Shared Assessments Shared Assessments- Questionnaire and review process used to assess business partners' information security status using ISO/IEC 27002, COBIT, PCI-DSS and others. Jake Smith Consulting Jake Smith Consulting- Consultant specialising in helping organisations achieve ISO/IEC 27001 compliance and certification. Yahoo! Groups iso-27001 Yahoo! Groups iso-27001- Discussion forum for ISO/IEC 27001 and 27002 Common Criteria Common Criteria- Provides the Common Criteria for Information Technology Security Evaluation. Also published as ISO/IEC 15408-1. The ISO 27000 Directory The ISO 27000 Directory- Information covering the ISO/IEC 27000 series of standards, including updates and consultants directory NERC Reliability Standards NERC Reliability Standards- Information on the development of cyber and information security standards with emphasis on reliability. ISO27k Implementers' Forum ISO27k Implementers' Forum- Google Groups discussion forum for those actively implementing the ISO/IEC 27000-series standards. Wikipedia: ISO/IEC 27000-series Wikipedia: ISO/IEC 27000-series- Open encyclopedia entry for the ISO/IEC 27000 family of information security management system standards, with links to pages on several standards… Praxiom Research Group Praxiom Research Group- Plain English descriptions of ISO/IEC 27001, 27002 and other standards, including a list of the controls. ISO 27000 Toolkit ISO 27000 Toolkit- Commercial package containing the ISO/IEC 27001 and 27002 standards plus supporting materials such as policies and a glossary. ISO 27001 Security ISO 27001 Security- Up to date information and news about the ISO/IEC 27000-series information security standards, with discussion forum, FAQ, implementation support info and link… Information Governance Limited Information Governance Limited- Supplier of Proteus Enterprise security risk management software for compliance with ISO/IEC 27002 and related information security, risk managemen… Privacy Policy Privacy Policy- Google's privacy policy is clearly written. Information Security Policy Information Security Policy- From Euronet Services India. In addition to a page of information security policy statements, it lists roles and responsibilities, plus supporting pol… Email Forwarding Policy Email Forwarding Policy- Email must not be forwarded automatically to an external destination without prior approval from the appropriate manager. Email Policy Email Policy- Policy from Northern Illinois University's IT Services group. Outlines some unacceptable uses. Accidental Disclosure of Confidential Information Policy Accidental Disclosure of Confidential Information Policy- An example policy from a dentistry company concerning the inadvertent disclosure of personal information. ISO27k Toolkit ISO27k Toolkit- Collection of information security policies, procedures etc. aligned with the ISO/IEC 27000-series standards and provided under the Creative Commons license. Providing and Using Information Technology Policy Providing and Using Information Technology Policy- Concerns ownership and rights over corporate IT equipment, in the University of Colorado. This policy includes an explanatory FA… Server Security Policy Server Security Policy- Defines standards for minimal security configuration for servers inside the organization's production network, or used in a production capacity. Electronic Signatures and Records Policy Electronic Signatures and Records Policy- Concerns what systems can be used for electronic signatures, and under what conditions. From Yale University. Information Technology Appropriate Use Policy Information Technology Appropriate Use Policy- Lays down the rules concerning acceptable ways of using the institution's IT facilities. From Yale University. Social Security Numbers Confidentiality Policy Social Security Numbers Confidentiality Policy- Controls to maintain the secrecy of SSNs. From Yale University. Development or Revision and Posting of Policies, Procedures and Forms Policy Development or Revision and Posting of Policies, Procedures and Forms Policy- Formalities around the development or update and publication of policies, procedures and forms. From … Records Preservation Policy Records Preservation Policy- Concerns the need to retain formal records associated with ongoing legal actions. From Yale University. Retention Policy Retention Policy- Covers retention of documents/information for business and compliance purposes. From Yale University Wireless Communication Policy Wireless Communication Policy- Concerns the use of wireless networking devices. Governance Policies Handbook Governance Policies Handbook- Corporate governance policies for Connexis, a power company Electronic Communications Policy Electronic Communications Policy- Policy from the University of Colorado on the use of email and other means of electronic communication for official purposes. Electronic Communications Policy Electronic Communications Policy- Formal policy from the University of California covering email and other electronic communications mechanisms Media disposal policy Media disposal policy- Succinct policy from Oregon State University requires that a competent person signs a release form before disposing of storage media from which the data hav… Whistleblower policy Whistleblower policy- By Euronext N.V. Requires employees to report serious noncompliance incidents, offering whistleblowers protection against disadvantage. Incident Management Policy Incident Management Policy- From Herriot-Watt University. Clarifies the respective roles of students, faculty and administrators in reporting and dealing with information security… Laptop Security Policy Laptop Security Policy- From the National Health Service. [MS Word] Blogging Policy Blogging Policy- From the State of Vermont Agency of Administration. Policy re blogging and microblogging (e.g. on Twitter). Digital Media and Hardware Disposal Policy Digital Media and Hardware Disposal Policy- From the State of Vermont Agency of Administration. Policy on disposing of IT systems and media securely, without carelessly discarding… Teleworking Policy Teleworking Policy- From the University of North Carolina, Greensboro. Covers health and safety and employment issues as well as IT security aspects of home working. Information Security Policy Information Security Policy- From the University of North Carolina, Greensboro. Very succinct - just 5 policy goals. Information Security Policy Information Security Policy- From the New School university in New York. Includes a set of 21 high level principles, cross-referenced to ISO/IEC 27002:2005. Awareness and Training Policy Awareness and Training Policy- From Georgia Perimeter College. Mandates an ongoing and creative general security awareness program supplemented with more specific training where n… IP Network Security Policy IP Network Security Policy- Example security policy to demonstrate policy writing techniques introduced in three earlier articles.