Phase 1 – Prepare a Project Plan

Gaining ISO 27001 certification can be a long and arduous task. Therefore, to save yourself time and future headaches, be sure to prepare a detailed project plan. During this stage it’s important to set expectations, so that everyone in the team is aware of their roles, responsibilities and project milestones. This is also the time to become familiar with the ISO 27001 standard and the 114 controls detailed in Annex A. Another important consideration to make is whether your team has the skills and experience necessary to achieve certification. Hiring an ISO 27001 consultant to guide you through your Information Security Management System (ISMS) journey may save you time and money in the long run. With all that in mind, it’s not hard to see that a comprehensive and diligently managed project plan can set your business up for success from the get go.

Phase 2 – Determine the Context, Objective and Scope

Your business is unique and your ISMS should reflect that. For this reason, it is important to determine the ‘scope’ of your ISMS. To do this, consider exactly what kind of data your organisation needs to protect. Depending on how sensitive this information is, your ISMS may extend to include the entirety of your organisation or be limited to a specific department, environment or geographical location. The scope will not only be determined by your needs, but also the requirements of your stakeholders (employees, governments and regulatory bodies to name a few). During this phase it is also important that you determine the organisational context, that is all internal and external factors which have the potential to impact upon your information security. This may include (but not necessarily limited to) your company structure, workplace culture, existing systems, current policies and protocols, etc. This evaluation will enable you to pinpoint your ISMS objectives, which will help to set a realistic and achievable project budget and timeframe.

Phase 3 – Conduct a Risk Assessment and Gap Analysis

It is a requirement of the ISO 27001 standard that your business conducts a formal risk assessment. In order to be in compliance, the process must be well planned, with all data, results and analysis meticulously documented. The first step in conducting a risk assessment is to establish the baseline security criteria. This refers to all legal, regulatory and contractual requirements (in relation to information security) your company has an obligation to meet. It is mandatory that your organisation compiles both a Statement of Applicability (SoA) and Risk Treatment Plan (RTA) report, as both will need be reviewed during the registration (certification) audit. Many businesses that lack the in-house expertise to effectively complete a formal risk assessment, will often choose to hire an ISO consultant to provide guidance and guarantee all requirements are being fulfilled.

Phase 4 – Implement Policies and Controls To Mitigate Risks

The risk assessment in Phase 3 will identify the gaps in your current IT infrastructure and any risks that they could possibly result in. In Phase 4, you will have to decide how you will address said risks. The SoA mentioned in the previous phase will identify and summarise the relevant ISO 27001 controls and policies, while the RTA records your organisations response to the risks identified during Phase 3. The ISO 27001 standard outlines four courses of action in dealing with risks:

1. Modify – Minimise the possibility of the risk occurring by the implementing controls
2. Avoid – Prevent the risk from occurring by preventing the circumstances that would enable it
3. Share – Utilise a third party to help deal with the risk, such as outsourcing your cybersecurity needs, purchasing cybersecurity insurance, etc.
4. Accept – Risks may be tolerated when the cost of addressing them outweigh the damage they have the potential to cause.

The response you choose for each risk will inform which policies and controls should then be implemented.

Phase 5 – Provide Education and Training

The ISO 27001 standard shares the responsibility of cybersecurity throughout the organisation. It dictates that companies foster a culture of cybersecurity awareness by providing ongoing training for all employees. This helps to both promote good habits and personal responsibility. It also ensures that each member of your organisation fully understands the importance of data security and remains vigilant in their duties.

Phase 6 – Review and Update All Evidential Documentation

As we’ve discussed, supporting documentation of all evidence is paramount to achieving ISO 27001 certification. An auditor will need to review your records in order to verify that you’ve established the necessary ISMS processes, policies, and procedures, and that they’re functioning per the ISO 27001 standard. To get an idea of how challenging this task can be, here are just SOME of the documentation required:

• Scope of the ISMS (Clause 4.3)
• Information security policy (Clause 5.2)
• Information security objectives (Clause 6.2)
• Information security risk assessment process (Clause 6.12)
• Information security risk treatment process (Clause 6.13)
• The Statement of Applicability (Clause 6.13.d)
• Risk Treatment Plan (Clause 6.13.e)
• Risk Assessment Report (Clause 8.2)
• Definition of security roles and responsibilities (Clause A7.1.2)
• Inventory of assets (Clause A8.1.1)
• Acceptable use of assets (Clause A8.1.3)
• Access control policy (Clause A9.1.1)
• Operating procedures for Information Security (Clause A12.1.1)
• Incident management procedure (Clause A16.1.5)
• Business continuity strategy & procedures (Clause A17.1)
• Statutory, regulatory, and contractual requirements (Clause A18.1.1)
• Evidence of competence (Clause 7.2)
• Documented information determined by the organization as being necessary for the effectiveness of the ISMS (Clause 5.5.1)
• Operational planning and control (Clause 8.1)
• Results of the information security risk assessment (Clause 8.2)
• Results of the information security risk treatment (Clause 8.3)
• Evidence of the monitoring and measurement of results (Clause 9.1)
• A documented internal audit process (Clause 9.2)
• Evidence of the audit programs and the audit results (Clause 9.2)
• Evidence of the results of management reviews (Clause 9.3)
• Evidence of the nature of the non-conformities and any subsequent actions taken (Clause 10.1)
• Evidence of the results of any corrective actions taken (Clause 10.1.g)

While collecting and organising all of these records seems overwhelming, documentation templates and compliance automation software for ISO 27001 are available to do (most of) the hard work for you.

Phase 7 – Undergo a Certification Audit

During this phase, an external auditor will conduct a two-part audit to asses whether or not your ISMS is in accordance with the ISO 27001 requirements.

Stage One: ISMS Design Review

The auditor reviews your ISMS documentation to determine that all policies and procedures are compliant with clauses 4-10 of the ISO 27001 ISMS requirements. Any areas of nonconformity and/or potential improvement will also be identified. Any issues must be rectified and any suggested improvements implemented prior to Stage 2’s commencement.

Stage Two: Certification Audit

The auditor will thoroughly assess your business processes and security controls against the ISO 27001 ISMS and Annex A requirements. This detailed assessment will ascertain if your organisation is in accordance with the ISO 27001 standard.

Once your organisation has passed the Stage 1 and Stage 2 audits, you’ll be issued an ISO 27001 certification that is valid for three years. 

Phase 8 – Maintain Compliance

ISO 27001 necessitates continual improvement. This means that the your ISMS must be constantly analysed and reviewed in order to maintain its effectiveness, as well as its compliance with the ISO 27001 standard. In addition, as your business grows so to do the risks. As a result, it’s of the utmost importance that you take every opportunity to make improvements to the existing processes and controls. Periodic audits are key to the ongoing monitoring of your ISMS.

Surveillance audits will need to be conducted multiple times throughout your three year certification period. The purpose of a surveillance audit is to check whether organisation are effectively maintaining their ISMS in adherence to the ISO 27001 standard. They are also done to check that all nonconformists and exceptions found during the certification audit process are resolved.

Recertification audits are done during the final year of your certification term. An external auditor will once again assess your ISMS and determine whether you meet the requirements of ISO 27001. Once completed, another three year ISO 27001 certification will be issued to you.

How long does it take to achieve ISO 27001 certification?

The timespan from the beginning of your ISO 27001 journey to reaching certification can depend on many different variables, such as the resources available, prior experience with the ISO 27001 standard, size and complexity of the ISMS, level of involvement from management, etc. Generally, most small to mid-size businesses achieve certification within 12 months. Any attempts to rush or shortcut the process often result in a sloppy ISMS that does not pass the certification audit, becoming a drain on your time and money until all issues are resolved. It should be noted that auditors look for at least two to three months of documented evidence that speaks to the maturity of your system. So once you get your ISMS up and running you should allow that window of time before seeking certification. Hiring an ISO 27001 consultant can significantly shorten this timeframe, as they have all the tools and knowledge needed to fast-track your success.

How much does ISO 27001 certification cost?

Unfortunately, there is no standardised cost for ISO 27001 certification. The overall cost can differ depending on the specifics of your business and the resources you’re willing to devote to completing this project. In trying to determine your overall budget, it is best to break down the costs into two categories:

1. The costs of setting up the ISMS
2. The costs of getting externally certified

The Costs of Setting up the ISMS

No matter where you are in your ISO 27001 journey, eStorm can help build a path to success and the lasting effectiveness of your information security management system. View our ISO 27001 page to learn more!

Over 50% of IT professionals agree that phishing attacks are one of the biggest cybersecurity concerns currently affecting both individuals and businesses. Lapses in cybersecurity protocols and weak infrastructure allow phishing attacks to access highly sensitive information, including passwords, financial details and personal information. Criminals are using every communication method at their disposal, including email, social media and phone calls, to ensure their victims. Their deceptions have also become sneakier and more convincing over time, pretending to be trusted friends, coworkers, institutions and even governments. Unfortunately, one click can be all that stands between your private data and a hacker. With over 90% of data breaches being attributed to phishing attacks, it’s only a matter of time before you or your organisation becomes an unwitting target. Therefore, it’s important to know how to prevent, identify and manage any phishing attempts.

How Does Phishing Work?

A phishing scam will attempt to persuade the intended target to undertake an action (such as open an attachment, click on a link, fill out a form, or reveal personal information), by posing as a trustworthy individual or reputable organisation. Once the action is completed, a number of consequences may result. A cybercriminal will most likely use a phishing scam to try to:

• Gain total control of your device and its contents by infecting it with malware
• Access private information that can be used to steal your money and/or identity
• Obtain log in details for your online profiles including email, social media, banking, online shopping and other platform accounts
• Trick you into willingly sending money or other valuables through deception

Phishing attacks can take many forms. Some are swift and encourage you to urgently complete a specific action, while others can be a long drawn out process, building a connection with the intended victim over an extended period of time. Only after a trusting relationship has been established (and the victim is lulled into a false sense of security) does the scammer take advantage of the situation.

Unfortunately, even if you exercise extreme caution, it can be the people closest to you who pose the most danger. If someone close to you has their email, contact list or social media compromised by a phishing attack, then the hacker may hijack their account. From there, it’s an easy feat for the hacker to spam friends, family and coworkers with phishing messages seemingly from an account they know and trust.

Types of Phishing Attacks

The sad truth is that cybercriminals who use phishing attacks are good at what they do. They’re savvy liars, who know how to craft believable stories and design legitimate appearing communications. They’re so good that over 40% of employees have admitted to not following best practice guidelines and engaged in some for of dangerous action while online (ie. clicking on an unfamiliar link, downloading a file or exposing personal data). If you’re an act first and think later kind of person, then you’re an easy target for phishing scams.

The good news is that phishing is much easier to recognise once you know what to look for. Although phishing attacks can take many forms, they most commonly fall into one of the following categories:

• Phishing emails are carefully designed to resemble a valid email address, individual, company or organisation. It may include personal information the cybercriminal has gathered about you (such as your name, employer or geographical location), in order to appear more legitimate. It will likely also include a request to follow a link, open an attachment, change a password, send a payment or reply with private information.
• Phone/Voice phishing (vishing) occurs when a scammer impersonates a person or company over the phone. They may use a number of methods to call your number directly, such as Voice over Internet Protocol (VoIP) technology. In other cases, a fisher might try to mask their own phone number by sending out an automated message that redirects the intended victim. In any case, the visher will say and do everything they can to keep you on the phone. The longer you talk to them, the more likely you are to fall into their trap.
• SMS phishing (smishing) is very similar to vishing, but will take place over text exchanges and messaging apps.
• Social media phishing involves cybercriminals either posting or directly messaging phishing links on social media platforms. The links can take a variety of forms: fake news articles, free giveaways or sketchy “official” charitable organisations with urgent requests. Referred to as “clickbait”, the links will be as sensationalised and dramatic as possible in order to entice people. If any of your social media contacts fall for the trap, then the scammer can then impersonate them and use their account to spread the nefarious link.
• Clone phishing takes place when an existing message from a legitimate contact is duplicated, with all of the original attachments and links replaced by the scammer. While this method most commonly appears in email attacks, it has also been used by social media and SMS phishing scams.
• Domain spoofing is a popular technique used to impersonate brands, businesses and organisations. Cybercriminals will mimic valid email addresses by using a domain that very closely resembles the one used by the real company. For instance @netflix.com may be modified to @netflix-support.com in order to fool Netflix subscribers. Alas, people who fall for this scheme may not realise their mistake until it’s too late.
• Email account takeover takes place when a cybercriminal acquires the email credentials of an executive member of an organisation. They use this to impersonate them and target any colleagues, team members, clients and customers who have dealings with this individual. The scammer capitalises on their high profile and position of authority, sending out phishing emails to other targets who report to and/or trust the original email account holder.

How to Spot a Phishing Email

Approximately 3.4 billion spam emails are sent out every day! While spam filters may stop many phishing attempts from reaching your inbox, there are bound to be some that slip through. Scammers are also continually updating their tactics, doing everything they can to disguise themselves and their intentions. Below are some red flags that can help you spot any phishing emails that have managed to slip into your inbox:

• Warnings of suspicious activity and/or log-in attempts that have been noticed on your account
• Claims that you have an outstanding payment and/or that you need to rectify your payment information
• Requests to confirm your account by disclosing personal information
• Attachments/downloads (such as fake invoices or receipts)
• Statements that you’re eligible for some form of government refund and/or scheme
• Offers coupons/vouchers for free items/services to be redeemed
• Spelling errors and poor grammar
• Unprofessional or amateur looking graphics
• Generic greetings instead of your name (such as Dear Customer or Dear Sir/Madam) 
• Unfamiliar links

What To Do If You Receive a Phishing Email

Unfortunately, many of us don’t think twice when opening emails in our inboxes. In fact, one third of all phishing emails are opened by their recipients! While simply opening the email may not have any ill consequences, it drastically increases the probability that you’ll click on a malicious link or download, whether unintentionally or because curiosity got the better of you. For this reason, if you come across a suspicious looking email than we recommend you follow these simple steps:

1. Delete the email immediately without opening it. Not all phishing emails require you to click on or download something, some can infect your device just by being opened! It’s better to be safe than sorry.
2. Block the sender of the email. If your email provider allows you to manually block incoming emails from specific accounts/domains then be sure to add the sender to your blocked list. If you are using a shared account or someone else has access to your inbox, then this is especially important.
3. Consider purchasing extra security to help monitor for phishing emails, such as antivirus software.

Tips To Protect Yourself From Phishing Attacks

Even for the most cautious person can still fall victim to a phishing attack. As cybercriminals employ more sophisticated tactics and find new ways to create increasingly convincing communications, it’s more important than ever to take preventative steps to avoid becoming the catch of the day.

Here are some basic measures you can use to avoid being scammed:

Be cautious when giving out personal information

A good general rule is never give out your information to a person or website you don’t 100% trust. Be sure to thoroughly verify that every website and/or company you give your information to is both genuine and secure. If the URL of the website doesn’t start with “http” or have a closed padlock icon nest to it, then under no circumstances should you enter your details.

Never trust alarming messages

Phishing scammers are known for trying to scare their victims into handing over their information. No matter what a communication says, it’s important to remember that most reputable organisations (such as governments, banks, insurance companies, etc) will never request account or other sensitive information via email. If you receive a worrying email, delete it and contact the company directly to confirm whether they sent it.

Avoid clicking on embedded links

It’s generally not a good idea to click embedded links in emails, even when you know the sender. At the very least you should hover over the link to see if the destination is what it claims to be. However, in some cases the attack is so sophisticated that the destination URL is indistinguishable from the genuine site. Rather than click on the link, visit the site directly through use your search engine to find the site and visit it directly.

Don’t download any attachments

Never open an attachment from a suspicious or strange email. Many will be mislabelled as Word, Excel, PowerPoint or PDF file types in order to trick you into downloading malware or something else nefarious.

Install anti-phishing add ons

Most internet browsers these days have add-ons available that can discern malicious websites and alert users to known phishing sites.

Install firewalls

Firewalls act as a shield between your device and a cyberattack. A combination of desktop and network firewalls is one of the most effective ways to reduce the chances of a phishing attacks infiltrating your environment.

Regularly update your software and operating systems

Look, we’re all guilty of ignoring update notifications at some point or another. However, patches and updates are necessary to ensure your device can withstand the latest cyberattack methods. Older operating systems and internet browsers some of the most common targets for phishing attacks, so make sure you update, update, update!

The 2022 Australian Cyber Conference has kicked off in Canberra and eStorm is there to give you insider access! Held by the The Australian Information Security Association (AISA), the three day event started yesterday the 31st of May, and will run until the 2nd of June. The goal of the conference is to raise awareness and promote a better understanding of cyber security issues in the community.

With over 7700 members, the AISA is the premier industry body for information security professionals in Australia, and has played an essential role in developing the information security sector. As a nationally recognised not-for-profit, the AISA aims to protect the safety of the Australian public, by aiding businesses and government organisations in advancing their cyber security knowledge and adopting better cyber security practices. The AISA advocate for inclusivity and have strived to make this conference a safe and enjoyable environment for all.

This year, the AISA have developed a robust event program that caters to a diverse range of specialisations. The Australian Cyber Conference 2022 itinerary includes keynotes, panel sessions and live demonstrations spearheaded by leading authorities in the IT industry. By learning from experts in the field, attendees are gaining valuable insights into managing current threats and preparing to face future challenges.

Delegates from a broad variety of industries are in attendance. The lineup includes company directors, managers, public servants, lawyers, risk professionals, software architects, and cyber security consultants. Professionals working in everything from education, finance, government, healthcare, manufacturing, mining, and transportation sectors are there to learn, share their own expertise, and network with cyber security practitioners. With a variety of activities planned to take place, including interactive workshops, plenary sessions and social events, this conference is shaping up to be a can’t-miss event for anyone working in the current business climate.

Here’s a few behind the scenes moments we’ve managed to capture so far!

Cyber crime is a serous threat to organisations across all sectors. Unfortunately for not-for-profits, cyber criminals are opportunists and are indiscriminate in their attacks. Additionally, unlike for-profit businesses, not-for-profits generally don’t have the funds or resources to spend on IT departments or elaborate cybersecurity systems. So we’ve put together this list of useful tips to help not-for-profits increase their cybersecurity…without breaking the bank!

Restrict Access

One of the easiest ways not-for-profits can improve their cybersecurity is restricting access to information. By limiting the number of people who can access sensitive information, not-for-profits can greatly reduce the chances of any cybersecurity breaches and data leaks. As a general rule, every staff member, volunteer, donor, client and external partner should only need to access to the resources pertaining to their individual roles. High-level access to confidential information and essential digital resources should only be granted to a few trusted personnel.

Protect Devices

The best way to protect devices is to only conduct official not-for-profit business on them. That means not engaging in activities such as surfing the net, online gaming, downloading videos, etc. Separate computers, mobile devices and online accounts should be allocated for personal and business use. This is of paramount importance when individuals outside of the organisation have access to the device, especially children or other family members. Sensitive business activities such as online banking and record keeping should only be carried out on organisational devices. Likewise, any confidential information should never be sent to personal email addresses. Therefore, it is best to avoid connecting any untrustworthy hardware into computers, mobile devices or networks. However, if this is not a feasible option, disabling the “AutoRun” feature for the CD, DVD and USB drives can prevent malicious programs from installing.

Install Cybersecurity Software and Encryption Tools

Antimalware, firewalls, network monitors and intruder detection systems are great cybersecurity programs that can help stop unauthorised access to networks, as well as alert users of any strange activity. They are also great deterrents, as they hinder employees and volunteers from misusing not-for-profit devices and networks. However, it is important to do due diligence when installing any software, program or application. Proper research should be done prior to any downloads, especially when using freeware or shareware. Never download from an unknown or suspicious web page. Regular updates are also crucial to ensuring an up-to-date cybersecurity system. Newer versions of software typically include more effective security policies and protocols. Vendors may also release patches to address potential security vulnerabilities within their software. In addition, encrypting data and software applications (especially those that are cloud-based), is an effective method in guarding valuable information. This helps reduce the risks of exposure, manipulation and data theft.

Be Cautious When Using The Internet

Caution should be exercised when conducting any and all online business. A secure browser connection is a must and will be indicated by a small lock icon visible in either the window’s lower right hand or upper left corner. It is also recommended that the web browser cache, temporary internet files, cookies and internet history be cleared as often as possible. Erasing this data (especially when it includes commerce or internet banking details) prevents it from being stolen if the system is compromised by a cyber attack. Also remember to never respond to any suspicious pop up windows! Pop up blockers can halt any harmful pop ups, while still permitting ones from trusted websites to appear.

Use Effective Passwords

User authentication and account security is the first line of defence against cyber attacks. Every member of a not-for-profit organisation should have a unique username and password they use to access devices and applications. Although many devices already come with a default administrator and password, these details are easily discovered by cyber criminals and pose a major security risk. As such, all default passwords should be changed at the earliest opportunity. All passwords should follow best practices guidelines, which are as follows:

1. Contains at least 8 characters, including upper and lowercase letters, numbers and at least one special character.
2. Passwords should be changed ever 3 months.
3. Old passwords should never be reused.

It may also be worthwhile investing in a password management application to create, remember and automatically fill in passwords. However, for some not-for-profits, passwords alone are not secure enough. This is usually the case when accessing highly confidential information such as financial details, health records and government documents. In these situations, a multi-factor authentication (MFA) login method can add another layer of user verification. An MFA requires additional tokens to prove user identity at login (in addition to their regular password). This can come in the form of geolocation, biometrics, or a one-off security code sent to an appointed e-mail account, phone number or authentication app.

Encourage a Culture of Cybersecurity Awareness

The fact of the matter is that the most commonly exploited weakness in cybersecurity is human error. From negligence to an honest mistake, most data breaches could be prevented by fostering a culture of cybersecurity awareness and providing ongoing training. Phishing attacks are one of the biggest cyber threats not-for-profits face, as cyber criminals will attempt to cajole not-for-profit members into revealing confidential information or installing malware through duplicitous means. It is of vital importance that all staff and volunteers be instructed on how to recognise scam emails and other fake communications. Furthermore, every member of a not-for-profit should be educated in cybersecurity best practices, the steps they can take to mitigate risk, and the importance of following data protection guidelines.

Never Disclose Private Information

Beware of social engineering. Social engineering is a type of cyber attack that involves manipulating people into divulging sensitive information, which is then used to gain physical or electronic access to IT systems and private data. The more a cyber criminal knows about an IT system, the easier it is to hack into it. To avoid this happening, never give out information relating to the following; usernames, passwords, operating systems, firewalls, internet browsers, applications, software, programs or anything else that has to do with the organisation’s IT environment.

Regularly Update Your Cybersecurity

According to The Nonprofit Technology Enterprise Network, a shocking 70% of not-for-profits have never assessed their cyber risk profile. Cybersecurity assessments uncover the weaknesses in an organisation’s network and system security. They analyse the potential threats, likelihood of attack and resulting damage. Without knowing the risks, how can you defend against them? For this reason, cybersecurity assessments should be carried out annually. While there are self-assessment resources available to not-for-profits, only an outside expert can give an unbiased perspective. You can read more about cybersecurity assessments here.

Implement an Information Security Management System

Implementing an Information Security Management System (ISMS) can greatly diminish the threat of cyber attacks. A variety of approaches can be taken when implementing an ISMS and will depend on a number of factors including; the risk severity, level of cybersecurity needed, potential fallout caused by a security breach, etc. Once in place, an ISMS can shield information from unauthorised access. ISO27001 is the internationally recognised gold standard for ISMS and is applicable across all business models. Containing 114 controls over 14 sections, obtaining an ISO27001 accreditation can be an arduous task. It requires external auditing and typically takes an internal team many months to achieve full implementation and certification.  However, the ISMS.online platform accelerates this process, saving time and money. ISMS.online even offer a 25% discount for not-for-profits. 

In 2022, The Department of Education, Skills and Employment’s (DESE) introduced the Information Security Management Scheme, which requires providers of employment skills, training, and disability employment services to gain ISO27001 and Right Fit for Risk (RFFR) accreditation. Failure to secure these certifications can result in the loss of future tenders and funding. You can read more about Right Fit For Risk here.

Back-up Everything

Maintaining a reliable back up system eliminates the danger of losing data, even in a worst case scenario. It ensures that all organisational information is readily available, even when affected by cyber attacks, accidental deletion, hardware failure and even natural disasters. A cloud-based storage system that secures information outside of a physical location also guarantees that, even if every device onsite fails at once, important data can still be recovered.

Concerned about your cybersecurity or looking to implement an ISMS? Contact the friendly eStorm team at [email protected] or 07 3120 0640.