Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

10/3/2018
02:25 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Information Security Forum Releases Standard of Good Practice 2018

All-in-One guide used by global organizations as primary reference for information security best practices

The Information Security Forum (ISF) has published a major update to its Standard of Good Practice (The Standard) for IT security professionals, the industry's most business-focused, all-in-one guide to information security assurance, presenting business-orientated information security topics with practical and trusted guidance.  The Standard delivers comprehensive coverage of information security controls and information risk-related guidance, providing ISF Members with an internationally recognized set of good practice covering all aspects of cyber resilience, information security and risk management. The latest edition of The Standard includes enhanced coverage of the following hot topics: Agile system development, alignment of information risk with operational risk, collaboration platforms, industrial control systems, information privacy and threat intelligence.

"Managing risk is vital for organizations to deliver their strategies, initiatives and goals. Consequently, information risk management is relevant only if it enables the organization to achieve these objectives, ensuring it is well positioned to succeed and is resilient to unexpected events, such as those caused by sophisticated cyber attacks," said Steve Durbin, Managing Director, ISF. "The Standard is used widely across the ISF membership which consists of many of the leading Fortune 500 and Forbes 2000 global companies. It provides extensive coverage of information security topics including those associated with security strategy, incident management, business continuity, resilience and crisis management. The latest edition enables organizations to improve their resilience against a wide-ranging array of threats and low probability, high-impact events that can threaten the success of the organization."

The Standard addresses the rapid pace at which threats and risks evolve and an organizations' need to respond to escalating security threats from activities such as cybercrime, 'hacktivism', insider threats and espionage. Updated on a biennial basis to reflect the latest findings from the ISF's research program, input from global ISF member organizations, trends from the ISF Benchmark and major external developments including new legislation and other requirements, The Standard is business-friendly and used by many global organizations as their primary reference for information security. The Standard provides comprehensive controls and guidance on current and emerging information security topics enabling organizations to respond to the rapid pace at which threats, technology and risks evolve.

Implementing the latest update of The Standard helps organizations to:

  • Be agile and exploit new opportunities, while ensuring that associated information risks are managed within acceptable levels
  • Respond to rapidly evolving threats, including sophisticated cyber security attacks, using threat intelligence to increase cyber resilience
  • Identify how regulatory and compliance requirements can be best met.

"Effective implementation depends on strong information risk assessment, so that controls described in The Standard are applied in line with risk," continued Durbin. "The best practices defined in The Standard will typically be incorporated into an organization's information security policy, business processes, environments and applications, and should be of great interest and relevance to a range of individuals within the organization as well as external stakeholders."

The Standard helps ISF members deliver up-to-date, best practices that can be integrated with their business processes, information security policy, risk management and compliance arrangements. As a result, The Standard helps the ISF, and its members, maintain their position at the leading edge of best practices in information security. Available at no cost to ISF member companies, The Standard can also be purchased by non-members. For more information on The Standard or any aspect of the ISF, please visit the ISF website, https://www.securityforum.org/.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3738
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
CVE-2019-3739
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.
CVE-2019-3740
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
CVE-2019-3756
PUBLISHED: 2019-09-18
RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions.
CVE-2019-3758
PUBLISHED: 2019-09-18
RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts with insufficient credentials. Unauthenticated attackers could gain unauthorized access to the system using those accounts.