Can we trust this shop with our card?
You buy trainers online and type in your card number. How do you know the shop keeps it safe?
Two big standards help. One shows a firm runs security well. The other is for firms that handle cards.
Each is a badge a firm works to earn.
Key words
| Word | What it means |
|---|---|
| Network | Computers and devices linked so they can share data. |
| Firewall | A gate that lets some traffic in or out and blocks the rest. |
| Malware | Software made to harm a computer or steal data. |
| Vulnerability | A weak point that an attacker could use. |
| Standard | An agreed set of good practice that many organisations follow. |
| ISO 27001 | A standard for running information security in an organisation. A firm can be certified. |
| Certified | Checked by an independent body that it meets a standard. |
| PCI DSS | Payment Card Industry Data Security Standard: rules for any firm that handles card payments. |
| Cardholder data | The details on a payment card, such as the number and the name. |
| Compliance | Following the rules, the law or a standard. |
| Penetration testing | A permitted attack made to find weak points before a criminal does. |
| Risk assessment | Checking what could go wrong, how likely it is and how bad it would be. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can say what ISO 27001 and PCI DSS are for, and how each is applied in the work of an infrastructure team.
Starter: the law
Have a go
Starter: the law
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Law or standard?
A law is made by Parliament. Break it and a court can punish you.
A standard is a set of good practice that firms agree to follow. ISO 27001 is a standard a firm chooses. PCI DSS is a standard the card companies require of every firm that takes cards. Break it and they can fine the firm or stop it taking cards.
Cycle 1: ISO 27001
ISO 27001 is a worldwide standard for managing information security. Its purpose: to give a firm a clear, repeatable way to protect its information.
A firm can be certified. An independent body checks the firm, and then checks again every year.
The spec names the 2017 text. The standard has been updated since: the current edition is ISO 27001 from 2022. The ideas are the same.
How ISO 27001 is applied
| Area | What the firm does |
|---|---|
| Data protection law | Keeps people's data under control, which helps meet the law |
| Information security | Sets rules and controls for people, places and systems |
| Information management | Knows what data it holds, where and who can see it |
| Penetration testing | Tests its own defences on a plan, with permission |
| Risk assessments | Lists the risks, scores them and picks controls |
The cells students fill in are left blank in this preview.
Check: ISO 27001
Have a go
Check: ISO 27001
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.