Thursday, February 05, 2015

How do we validate a supplier has ISO 27001?

(c) Scott Adams
Most of the questions we get from our clients about ISO 27001, the standard for Information Security Management Systems, are about how they can implement this standard and possibly achieve certification.  We covered some of that in our previous blog.

The "other" question we get asked less often is "how do we validate a supplier or partner that claims to follow ISO27001 or claims to have been certified now or in the past?"
You may be surprised by the answer.


There is no such thing as a complete, current list of ISO 27001 certified companies.

That's right, it is impossible to obtain a definitive list of companies with ISO certification.

The creation of such a central list has been attempted in the past more than once, and for several ISO standards (notably ISO 9000) but such lists have always been incomplete and prone to going out of date. Part of the reason for this is that there is a competitive market between certification companies, they don't want to share their list of clients, or even indicate how many clients in total they might have, or how many might have once held certification which has since expired. Companies go out of business, get acquired, divested of, and restructured, and all these things mean that an ISO certificate issued in the past, may not count for much in the present unless the certified company has kept up with its maintenance audits (surveillance audits as we call them in ISO-speak).

Your best hope is to speak to the certification body the certificate holder used. For example, BSI allows you to query a certificate number against their database of clients to see if it was issued or is current here. Not all certification bodies have such an online service, and if you don't know who issued the certificate then you are out of luck.

360is is able to perform due diligence against your suppliers and partners to determine the strength of their information security, whether or not they have undergone any formal certification. If their technology, processes, or procedures do not provide adequate protection for your sensitive data, we are able to describe and implement improvements. If you are faced with meeting strict information security compliance targets yourself, we can help your formulate an appropriate response and program of improvements to meet expectations. Talk to one of our consultants.

Wednesday, February 04, 2015

ISO 27001, how do we prepare and what does it cost?

Need help preparing for ISO 27001? (c)Scott Adams
ISO/IEC 27001 is a standard providing requirements for an Information Security Management System (ISMS). It is part of the ISO 27000 family of standards, all of which help organisations keep information assets secure.

Like other ISO standards, some organisations choose purely to implement the standard in order to benefit from what it contains, while others decide they also want to get certified to reassure customers or clients that its recommendations have been followed. There are many Information Security standards out there (within specific industries, or for specific countries), ISO 27001 is one of the more widely recognised. 360is have been working to help companies implement the technical controls within ISO 27001 and its predecessors since the mid 90's. While we don't certify you against ISO 27001, we can help you prepare for your certification and pass your annual audits by having a strong Information Security posture.

What is an ISMS?
The Information Security Management System is a system in the broadest sense of the word. It is a mixture of people, processes, and IT systems (hardware, software, products and services) which allow you to manage risks relating to sensitive company information so that it remains secure. An ISMS isn't just a product you buy, or a configurational change you make. Rather like a religion with rites and ceremonies, it is something you must observe every day.

Control-Point Versus Procedural Standards
There are 2 kinds of IT Security standards in this world, there are those that are control-point based and there are those that are procedure-based.  ISO 27001 is control-point based, meaning that it tells you what controls need to be in place to ensure the right outcome. It is not a prescriptive "how-to" for the configuration of your IT. A control-point standard can be said to apply across a broad range of organisations with different sizes and operational patterns because the standard steers clear of the minutiae. Procedure-based standards can struggle to cater for such a broad range of organisations. However, IT staff find control-point standards harder to implement in technical configuration. 360is helps companies translate the control-point objectives of ISO 27001 into practical, technical configuration, procedures, and documentation.

How Much Does ISO 27001 Cost?

The cost of getting ISO 27001 certification depends on:
  • The size of your company and scope of the ISO 27001 certificate
  • The maturity level of your ISMS 
  • The gap between the current state and the desired state of the control environment
  • The in-house capability/capacity to develop the ISMS and close the gaps
  • How quickly the certificate is required
If you are a large organisation, wishing to certify the whole of your operations, and you have not previously invested much in ISMS, or people with the skills to build and operate such a system, then you are going to have to spend more getting ISO 27001. These costs come from 3 places:
  • The first is the cost of getting your ISMS up to scratch, "pre-certification"
  • The second is the certification process itself
  • The third is the cost of your annual certification audit in years 2 and beyond
Given the fact that there are so many variables, we will use a real client of ours as an example:
  • 50 staff, 1 office, in the UK
  • Processes sensitive data, some personally identifiable information, for medium sized banks
  • Co-locates at two UK data centers
  • Provides software (SaaS) at these data centers
  • Has a control environment that, while previously subject to external review, would still be best referred to as immature and non-fully documented
  • Has staff that are technical but not ISO 27001/ISO 27002 aware
  • Pressure from clients for independent attestation, some ask for ISO 27001
  • Need to achieve certificate (without great disruption to business) within 1 year
  • Requires a fair degree of ISO-27001 consulting to prep for the certification audit
The “external” costs to become ISO 27001 certified were:
  • Pre-certification Part 1: £15,000 (Scope Definition, Risk Assessment, Risk Treatment Plan, Gap Assessment, Part 2 Remediation Plan)
  • Pre-certification Part 2: £15,000 (Gap closure (collaboratively), registrar selection, ISMS Artifact development, Risk Management Committee, Incident Response, Internal ISMS Audit, On-site Certification Audit Support)
  • Certification Audit: £15,000
  • Total cost for ISO 27001 certificate: £45,000
To this one-time cost we can add the annual external audit in year 2 (£5000) and internal ISMS audit (£5000) in year 2.

Of these costs, the pre-certification is likely to be by far the greatest, unless you are already well prepared. It is also possible that pre-certification costs for your organisation could be significantly higher than those shown here. We have known organisations need up-to £50,000 of pre-certification work on their existing ISMS. Finally, you should also consider the omissions below carefully:

Omissions: We ignore other associated annual costs such as annual penetration testing, maintenance and support costs of the ISMS infrastructure, and the cost of any staff (new or existing) or training required to operate the ISMS. We ignore the costs of new products (hardware/software) or services which you may need to build an ISMS if you do not already have something suitable to work with. If your organisation is very large or very complex, you will have a lot of Information Security to manage. The cost of the management systems/software may be significant.

Concluding Remarks
ISO 27001 is not a one-time exam, it is more like a religion. It is a commitment to do things the right way every day, and to submit to regular audits to confirm you are observing the religions practices every day, not just when the vicar comes to tea. The total cost of ISO 27001 certification is dependent in large part on the status and strength of your existing ISMS, which should not come as a surprise.

If you would like help preparing for ISO 27001, straightforward advice on improving your Information Security posture, answering Information Security challenges from clients or the regulator, talk to us.

Tuesday, January 20, 2015

High Performance Computing Advisory Council Conference, CSCS Switzerland, March 23rd - 25th

Lugano, Location of the 2015 HPCAC Conference
Three Sixty will be attending the 2015 High Performance Computing conference held in Lugano, Switzerland from March 23rd to 25th.
The conference brings together system managers, researchers, developers, computational scientists, students and industry partners for cross-training and to discuss recent HPC developments and future advancements. This year the topics will be:
High Speed Networks
High Performance & Parallel I/O
Communication libraries: MPI, SHMEM, PGAS
GPU computing, CUDA, OpenCL
Big Data 
There will be practical workshops for clustering, networks, troubleshooting, tuning, and optimisation.

Will we see some British companies there this time?

Three Sixty helps UK organisations adopt new, high performance computing technologies and methods. To find out why it is vital that UK organisations do this, talk to us.


Wednesday, November 05, 2014

Join 360is at PETEX 2014

PETEX 2014
Come and meet 360is at PETEX where we will be talking about Virtualisation & Cloud, Cyber Security, and High Performance IT projects delivered to the Oil & Gas industries. If you are an IT manager or analyst working in the sector, the conference program will include sessions and seminars on a range of topics:

  • 3D workflows
  • Corporate data management
  • National data repositories
  • Modelling at continental scale
  • 4D data processing, storage, and visualisation

The Petroleum Exploration Technology Exhibition is in it’s 25th year and runs from Tuesday 18th November to Thursday 20th November this year at the ExCel, London. For more information and to register go to www.petex.info. If you'd like to chat about a project or requirement and are going to PETEX then let us know via info@360is.com, @three_sixty_is, or in the comments section below.

Thursday, September 11, 2014

360is Builds VDI for InnovateUK

UK Satellite and GIS Imagery
The UK Satellite Applications Catapult (The Catapult) was established to promote growth in commercial applications of satellite technology. Its mission is to accelerate the take-up of emerging technologies by businesses and in so doing, drive UK economic growth. The Catapult offers expertise and facilities that will bring strategic benefit to the community of industrial companies working in the sector.  

How did the project come about? 
Making facilities and information assets easily available to potential users of their services is part of the Catapult's mission. Satellite analysts routinely work with heavyweight applications like ESRI ArcGIS, GE Smallworld, and Raytheon VIIRS. The Catapult wanted to see how such applications performed on a modern, fluid, Virtual Desktop Infrastructure (VDI). 360is was challenged to build a system capable of multi-user, multi-screen VDI for satellite applications using thin clients while providing a dedicated workstation-like experience.

What did 360is do?
After interviewing end users, 360is built a VDI system using Citrix XenDesktop, XenServer, and NVIDIA GPU hardware and a suitable WYSE thin client. This combination of technologies allowed for maximum flexibility.
  • Physical GPUs may be partitioned into virtual GPUs Virtual Desktops are booted on demand.
  • Users are allocated VDI's with different vCPU/vGPU capabilities depending on a profile.
  • The platform may be optimised for user density or performance.
  • Server GPUs work with client GPUs to enable a high-quality end user experience.
  • Network bandwidth is minimised using caching and compression.
As this was a proof of concept demonstration, 360is chose components and settings for maximum stability. End users can quickly form a negative opinion if a new technology is not completely reliable and this system was to be used for live demonstration.

How successful was the platform in meeting the project goals?
Multi-screen multi-user GPU VDI was delivered. 0.5Mb/s to 1.0Mb/s of network bandwidth was required per client while running in excess of 60fps. Up-to 64 concurrent GPU-powered VDI's could be provided by the system, this could be increased to 128 with different choices of hardware. The thin client CPU (capable of driving up-to 6 monitors) proved to be the limiting factor. High-density, GPU VDI is now within the reach of most organisations. Specialist scientific applications no-longer need to be excluded from the virtual desktop projects.

About 360is
360is builds multi-user, multi-monitor, high-resolution and GPU-enabled Virtual Desktop Infrastructure for Scientific Technical and Creative Industry organisations. Our engineers can address all aspects of the project from storage, to networking, to hypervisor configuration and application performance tuning. If you would like to talk to one of our engineers about deploying scientific and GPU applications to demanding users, get in touch via our contact page, Email, or message us on twitter.

If you want to know more about the UK's Satellite Applications Catapult and the great work they are doing to help grow the £7B annual turnover of the UK space sector, take a few minutes to find out more: