View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
  2. Cybersecurity
October 27, 2016updated 12 Dec 2016 4:35pm

6 cyber security standards defining the connected world

Learn about how payment cards, industrial control systems and information are secured in CBR's list of cyber security standards.

By Alexander Sword

Security standards are set up to provide a set of common guidelines for companies that handle customer information. They cover all kinds of transactions and technologies and can be peculiar to particular industries.

CBR looks at some of the major security standards. Absent from the list are the upcoming European cyber security standards from ETSI, which are in development at the time of writing.

1. PCI DSS

Payment Card Industry Data Security Standard (PCI DSS) is a worldwide standard that helps businesses securely process card payments and reduce fraud.

security standardsThe requirements fall into six major categories: building a secure network, protecting cardholder data, maintaining a vulnerability management programme, implementing strong access control measures, regularly resting and monitoring networks and maintaining an information security policy.

Included in the standard are requirements to install a firewall and anti-virus software, encrypt data and restrict access to cardholder data.

2. IASME

This UK-based standard for small-to-medium enterprises (SMEs), defined here as businesses with capitalisation of £1.2 billion or less.

It aims to allow these SMEs to achieve an accredited measurement of their cyber security readiness to provide to their customers, clients or partners, with a lower complexity, cost and administrative overhead.

Content from our partners
Unlocking growth through hybrid cloud: 5 key takeaways
How businesses can safeguard themselves on the cyber frontline
How hackers’ tactics are evolving in an increasingly complex landscape

female-business-travellerThe cost of the certification depends on the number of employees in the company, and can be based upon a self-assessment through a questionnaire or a third-party assessment.

IASME is one of four Cyber Essentials accreditation bodies appointed by the UK Government.

3. FIDO

Fast IDentity Online (FIDO) takes advantage of features on a smart device such as a fingerprint scanner, camera or microphone to allow the user to register their biometric or PIN to the device.

When the authentication is required, the user is authenticated by a client on the device itself and the encrypted key is sent to the server to authenticate the user.

https://www.cbronline.com/news/cybersecurity/solutions/fido-secure-authentication-protocol-redefine-online-iot-security/

This is both easier for the user, who doesn’t have to generate and memorise a password for every application they use, and more secure, since passwords can easily be intercepted or broken.

 

4. IEC 62443

Originally called ISA99, this set of standards deals with electronically securing industrial automation and control systems (IACS).

The guidance is aimed at all parties within the supply chain, including the end-user, system integrator, security practitioner and the manufacturers themselves.

industry-1140760_1920The standards were defined by the International Society of Automation (ISA). The first standard was published in late 2007 and serves as the foundation for all subsequent standards in the series.

The standard was renumbered to 62433 in 2010, with the intention being to align the numbering with the corresponding International Electrotechnical Commission standards.

Areas addressed include patch management and wireless systems security.

There is also a focus on the convergence of safety and security and technical requirements at the system and component levels.

5. Common Criteria

The Common Criteria for Information Technology Security Evaluation, abbreviated to Common Criteria or CC, is an international standard that allows users to specify their requirements for security.

common-criteriaSystem users can specify their functional and assurance requirements using Protection Profiles.

Vendors can make claims about the security attributes of products, while testing laboratories can evaluate them according to the same criteria.

CC is also known as ISO/IEC 15408.

 

 

6. ISO/IEC 27001 and ISO/IEC 27002

ISO/IEC 27001 and ISO/IEC 27002 are part of a family of standards that helps organisations secure their information assets on an information security management system (ICMS).

ISO/IEC 27001, the best-known standard in the family, provides a top-down, technology-neutral approach.

The six parts of the planning process include defining a security policy, defining the scope of the ISMS, conducted a risk assessment, managing identified risks, selecting control objectives to be implemented and preparing a statement of applicability.

The standard does not mandate specific controls, but provides a checklist of controls.

The second standard, ISO/IEC 27002, provides a comprehensive set of objectives and a set of good practices.

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how New Statesman Media Group may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.
THANK YOU