Information Security Certification Fact Sheet
Revision 1	October 1999

In recent years there has been a gradual movement away form closed to open information systems.  The Internet is expanding at an exponential rate along with the value of transactions conducted on–line.  At the same time there is an increase in the number of people using computers and their level of sophistication.  This increases the pool of potential hackers.  If someone wants to learn about hacking there is no shortage of assistance available.  Through the internet tools for hacking are easily accessible along with manuals on how to use them (see http://www.xs4all.nl/~l0rd or http://www.thefuturesite.com/catman/ ).  This is only one threat to an organisations information assets.  Hacking implies a degree of recreational motivation for compromising networks at another level there are others who may have an even greater motivation such as organised crime or fraud.  There is also the risk of malicious damage from ex-employees, disgruntled customers, business partners and suppliers.  At still another level there is the threat of cyberwarfare.  On the 16 September the ABC science program Quantum ran a story on this topic (See http://www.abc.net.au/quantum/stories/s56122.htm).  The Quantum story invited us to 
“Imagine the mayhem if...the lights went out, water supplies dwindled, bank machines shut tight and telephones went dead nationwide. This isn't hacking or the millennium bug - it's "cyberwar" and Australia is at risk.” 
These risks highlight the importance for organisations to provide assurance that they and their  business partners take appropriate measures to provide secure management of sensitive information.  This security assurance involves booth inter and intra organisational information flows.
Contents
Explanation of AS/NZS 4444	2
AS/NZS 4444 Certification Scheme	3
Why have a scheme?	3
Value proposition	3
A step by step approach	3
Structure	3
Roles	3
Indicative Costs	4
Funding	4
Implementation	4
Timeline	4
	
Electronic commerce, greater business to business integration and evolving regulatory requirements for the protection of sensitive information are all drivers of demand for an AS/NZS 4444 certification scheme.
The establishment of an AS/NZS 4444 certification scheme provides organisations with a measurable means of demonstrating to trading partners that they have achieved international information security management best practice represented by compliance to AS/NZS 4444.  Such compliance will facilitate and enhance confidence.
The scheme aims to meet the needs of SME’s as well as large corporations by providing a small and medium business certification program.  In addition a handbook on the application of AS/NZS 4444 for SME’s will be developed.
The benefits that will result from an AS/NZS 4444 certification scheme, and the significance that these benefits have to the national information infrastructure include:
Business to Government
•	The general levels of awareness of the information security risks facing organisations will be increased through greater levels of training and promotion.
•	Establishing trust in e-commerce initiatives, especially by small and medium enterprises consistent with NOIE’s objectives for the information economy (e.g. utilising national authentication infrastructure).
•	Placing Australian industry in a stronger position to respond to the concerns of consumers and the changing global regulatory environment for the protection of information. 
•	Allowing the private sector to improve capabilities for protection of the National Information Infrastructure.
Business to Business
•	A consultative approach to information security through the development of a stakeholder committee overseeing the operation of the certification scheme made up of consumers, government and industry representatives.
•	The development of a recognised logo that organisations and consumers can identify with a high level of information security assurance.
•	Provides organisations and industries a greater degree of confidence when allowing information exchanges by their organisation or industry to be undertaken.
Business to Consumer
•	Allows emerging technologies (e.g. smart-cards and digital signatures) to have an established information security framework in which to operate.
•	Lowering costs and time-frames for Australian business enterprises to establish e-commerce solutions that meet consumers privacy needs both nationally and internationally (especially with Europe and Asia).
Explanation of AS/NZS 4444
AS/NZS 4444 is based on a British standard BS 7799.  BS 7799 had its origins in industry as a result of a group large companies (Shell, Marks and Spencer, Midland Bank, BT, Unilever and BOC) getting together and documenting the best aspects of how they manage security.  The emphasis is on how things work in practice.  It is an industry led initiative based on current best practice.
AS/NZS 4444 - Information Security Management, has been developed with the major aim of promoting information security leading to business confidence in e-commerce.  Concerns over security issues have been one of the major impediments to business and consumer confidence and the widespread adoption of e-commerce. \

At the heart of AS/NZS 4444 is a risk-based approach to managing information security.  The standard requires an organisation to assess, rank and control risks (see diagram below).  Controls must be effectively implemented and monitored on a regular basis.  

AS/NZS 4444 has two has two parts.  

Part 1 is a code of practice for information security management.  It defines in detail how to develop an information security management system.  
Part 2 is the specification for information security management systems and can be used as the basis for certification checklist.
AS/NZS 4444 has three key components:
1 – Confidentiality – ensuring that information is accessible only to those authorised to have access.
2 – Integrity – safeguarding the accuracy and completeness of information and processing methods.
3 – Availability – ensuring that authorised users have access to information and associated assets when required.

The standard recommends ten controls (see below) that to a greater or lesser degree should be applied by organisations depending on their risk profile.
1.	Security policy
•	Information security policy
2.	Security organisation
•	Information security infrastructure
•	Security of third party access
•	Outsourcing
3.	Asset classification and control
•	Accountability for assets
•	Information classification
4.	Personnel security
•	Security in job definition and resourcing
•	User training
•	Responding to security incidents and malfunctions
5.	Physical and environmental security
•	Secure areas
•	Equipment security
•	General controls
6.	Communications and operations management
•	Operational procedures and responsibilities
•	System planning and acceptance
•	Protection against malicious software
•	Housekeeping
•	Network management
•	Media handling and security
•	Exchanges of information and software
7.	Access control
•	Business requirement for access control
•	User access management
•	User responsibilities
•	Network access control
•	Operating system access control
•	Application access control
•	Monitoring system access and use
•	Mobile computing and teleworking
8.	Systems development and maintenance
•	Security requirements for systems
•	Security in application systems
•	Cryptographic controls
•	Security of system files
•	Security in development and support processes
9.	Business continuity management
•	Aspects of business continuity management
10.	Compliance
•	Compliance with legal requirements
•	Review of security policy and technical compliance
•	System audit considerations
AS/NZS 4444 Certification Scheme
Why have a scheme?
•	Reduce government and business risk.
•	Enabler of electronic commerce by providing confidence in an organisations ability to secure information and transactions.
•	Reduce the need for 2nd party auditing.
•	Raise industry awareness of information security management issues through increased training and expertise.
•	Support government initiatives to protect and fortify the NII.
•	Industry led and controlled initiative.
•	Develops a pool of information security experts.
•	Basis for linking into an international scheme allowing global recognition for trading purposes.
Value proposition
Consumers and Government
•	Industry-led initiative (not regulated by government).
•	Supports government initiatives such as “to trade electronically with 90% of suppliers by 2001”(OGO - 1999).
•	Assurances that private information will be accurate, secure and used in an agreed manner.
•	Ability to identify organisations that have a recognised information security system in place.
•	Assists in purchasing decisions.
•	Place Australian industry at the forefront of e-commerce
Certified Organisations
•	Public recognition of security systems.
•	Gives consumers assurance.
•	Competitive advantage (differentiation).
•	Registered Consultants and Auditors.
•	Reduced insurance premiums (risk management approach).
•	Good approach to ensuring compliance to legislation and accepted industry practice (corporate governance assurance).
•	Assurance for organisations linked through joint ventures, supply chain (vertical systems) or outsourcing.
•	Reduction in losses resulting from information related incidents.
Accreditation and Certifying Bodies
•	Economies of scale.
•	Increased credibility through professional recognition and certification.
•	Protection from unscrupulous operators.
•	More balanced portfolio of accreditation/certification.
•	Greater exposure in the national and international market.
A step by step approach

The scheme will use a multilevel approach to certification.  The basis for  the levels is still under discussion.  The diagram below shows one possible approach. 

Structure

Roles
Scheme Manager
•	Maintain the scheme to meet the evolving needs of customers and other interested parties.
•	Maintain structures commensurate with the needs of the scheme for its proper management.
•	Publish up to date lists of accredited service providers and organisations holding accreditation certificates.
•	Develop auditor protocols.
•	Promote awareness of the scheme.
•	Maintain records related to the scheme.
•	Ensure the schemes' transparency is maintained.
Standards Australia
•	Facilitate the setting up of the AS/NZS 4444 certification scheme.
•	Maintain and distribute base standards to be used for the purposes of accreditation, specifically the following documents;
•	AS/NZS 4444 - Part 1 - Code of practice for information security management.
•	AS/NZS 4444 - Part 2 - Specification for information security management.
Steering Committee
The Steering Committee consists of key stakeholders or enablers from industry, government, consumer groups and Standards Australia.  Some of the responsibilities of the Steering Committee are shown below.   
•	Oversee the operation of the scheme to ensure its continuing ability to deliver value to users.
•	Ensure the transparency of the scheme.
Accreditation Body
•	Accredit third party certifying organisations in accordance to;
•	ISO/IEC Guide 62 - General requirements for bodies operating assessment and certification/registration of quality systems.
•	Accredit Auditor Certification Bodies to the requirements of the schemes auditing protocols.
Certification Bodies
•	Obtain accreditation.
•	Certify organisations in accordance with;
•	ISO/IEC Guide 62 - General requirements for bodies operating assessment and certification/registration of quality systems.
•	Organise and conduct auditor-training courses.
Auditor Certification Body
•	Obtain accreditation.
•	Scrutinize and verify auditor applications.
•	Maintain a register of approved assessors.
•	Monitor auditor conduct and customer complaints.
•	Solicit customer feedback regarding the effectiveness of auditors.
Auditors
•	Obtain Auditor Certification. 
•	Audit as per the schemes auditing protocols.
Supporting consultants
•	Obtain consultant certification.
•	Assist organisations in meeting the requirements of AS/NZS 4444. 
Certified organisations
•	Make appropriate applications.
•	Meet the requirements of AS/NZS 4444.

Indicative Costs

Funding
Costs do not include the licensing or development of any guides.  The scheme is to be self-sufficient after two to three years of operation at this time the role of the Scheme Manager may be discontinued.  Possible sources of revenue include: 
Short term - Industry or government sponsors.  
Long term - Sales of scheme documentation, levies for: certifications, auditors days, training courses and registers

Implementation
Timeline