Primary Advantages of COBIT, ISO 27000, and NIST

Greg Palmer — Tue, 23 Jan 2018 04:01:31 +0000

The following is a list of the primary benefits of the COBIT, ISO 27000, and NIST frameworks:

COBIT

COBIT allows much broader scope and takes into account all IT management processes.
Geared towards a method of successfully executing key policies and procedures. It is often used to tie together controls, technical issues and risks, within an organization.
COBIT is managed by the Information Systems Audit and Control Association (ISACA) so it is kept up to date with current technology, and is globally accepted.
Allows scope to extend beyond IT and into management of the organization.

ISO 27002

ISO 27002 provides best practice recommendations for an Information Security Management System (ISMS) standard. The 27001 and 27002 are used together to provide a management system, and specify industry-related controls. The ISO 27002 is an IT department focused standard.
Allows system managers to identify and mitigate gaps and overlaps in coverage.
Limited in scope compared to other standards.

NIST

NIST is a Federal Government standard that covers a Risk Management Framework which addresses security controls in accordance with the Federal Information Processing Standard (FIPS) 200. This means that the standard has been through a very stringent review process and is very thorough.
Provides a level of detail for organizations not wanting to do a lot of customization. Comprehensive.
Like the ISO standard, NIST is limited in scope to information security.

When comparing COBIT to the other standards, it does have some appealing advantages. Since it allows for a wide-scope to include management outside of IT, it makes it easier to customize and integrate into the organization. COBIT is a good choice for an organization-wide framework allowing flexibility. Both ISO and NIST are restricted in scope to IT, and are not as flexible. A notable point is that all Government agencies and contractors must adhere to NIST standards. Much depends on the organization, its purpose, and if it is private or Government affiliated. For large private enterprises with no Government ties, COBIT is a desirable framework because of its broad scope, and flexibility.

References

Agnosticator. (2013, December 09). A Comparison of COBIT, ITIL, ISO 27002 and NIST. Retrieved September 9, 2017, from http://agnosticationater.blogspot.com/2013/12/a-comparison-of-cobit-itil-iso-27002.html.

Gallagher, P. D. (2013, April). NIST Special Publication 800-53 Revision 4. Security and Privacy Controls for Federal Information Systems and Organizations. Retrieved September 9, 2017, from http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf.

The post Primary Advantages of COBIT, ISO 27000, and NIST appeared first on .

Information Security Publication Comparison

Greg Palmer — Sat, 26 Nov 2016 04:18:17 +0000

Information Security Publication Comparison

Information Security Publication Comparison

Chart comparing major sections of the USPS Handbook AS-805 – Information Security to NIST Special Publications; 800-12, 800-14, 800-18, 800-26, and 800-30.

Handbook AS-805 – Information Security (USPS, 2015)	NIST Special Publications
Introduction: Corporate Information Security	Generally Accepted System Security Principles (NIST SP 800-14)
Security Roles and Responsibilities	System Security Plan Responsibilities (NIST SP 800-18), (NIST SP 800-14)
Information Designation and Control	Generally Accepted System Security Principles (NIST SP 800-14)
Security Risk Management	Guide for Conducting Risk Assessments. (NIST SP 800-30) (NIST SP 800-14)
Acceptable Use	Generally Accepted System Security Principles (NIST SP 800-14)
Personnel Security	Generally Accepted System Security Principles (NIST SP 800-14)
Physical and Environmental Security	3.10 Physical and Environmental Security (NIST SP 800-14), Physical and Environmental Security (NIST SP 800-12),
Development and Operations Security	1.5 Major Applications, General Support Systems, and Minor Applications (NIST SP 800-18), 3.9 Security Considerations in Computer Support and Operations (NIST SP 800-14)
Information Security Services	3.14 Minimum Security Controls (NIST SP 800-18)
Hardware and Software Security	Several chapters (NIST SP 800-14)
Network Security	2.3 General Support Systems (NIST SP 800-18) Management Control (NIST SP 800-12)
Business Continuity Management	3.6 Preparing for Contingencies and Disasters (NIST SP 800-14),
Security Incident Management	12.0 Computer Security Incident Handling (NIST SP 800-12), 3.7 Computer Security Incident Handling (NIST SP 800-14)
Security Compliance and Monitoring	3.16 Ongoing System Security Plan Maintenance (NIST SP 800-18)

Chart comparing the ISO/IEC 27002 with NIST Publications

ISO27002 (Praxiom web, 2013)	NIST 800-12	NIST 800-14	NIST 800-18	NIST 800-26	NIST 800-30
Security Policy Management	Covered. NIST is more of an overview	Covers many aspects such as security program management.	Covered. Both cover same aspects.	Not directly covered. Program management briefly covered.	Not covered
Corporate Security Management	Covered. NIST is more of an overview	Covered in depth.	Covers duties and responsibilities.	Not covered	Not covered
Personal Security Management	Covers personnel/user issues	Both cover same aspects	Not covered	Covered only as a checklist item	Not covered
Organizational Asset Management	Covered	Not covered	Not Covered	Covered	Not Covered
Information Access Management	Covered Chapter 17	Covered Chapter 3	Not covered	Not covered	Not covered
Cryptography Policy Management	Covered Chapter 19	Covered briefly Chapter 3.14	Not covered	Not covered	Not covered
Physical Security Management	Covered Chapter 15	Covered Chapter 3.10	Not covered	Not covered	Not Covered
Operational Security Management	Covered	Covered. ISO 27002 offers more detail	Covered	Covered	Covered
Network Security Management	Covered only as a control	Covered only as a system	Not covered	Not covered	Not covered
System Security Management	Not covered	Not covered	Covered Chapter 2.3	Covered Chapter 3.1.2	Not covered
Supplier Relationship Management	Covered as overview Chapter 10	Not covered	Not covered	Not covered	Not covered
Security Incident Management	Covered in detail 11 & 12	Covered Chapter 3.7	Not covered	Not covered	Covers threat events and response
Security Continuity Management	Not covered	Covers security reassessment	Covered Chapter 3.16	Covered Chapter 4.3.1	Covers assessment cycle
Security Compliance Management	Covered Chapter 6	Covers as part of policy	Covered Chapter 3.12	Covers compliance reviews	Covered