There are many skeptics who do not believe ISO 27001 can help protect their information and\/or information systems; one of their main arguments is: \u201cWriting a policy or a procedure surely won\u2019t help against someone who wants to steal your information.\u201d<\/p>\n
And I agree with them \u2013 simply writing a document won\u2019t help.<\/p>\n
For instance, a hacker who has created malicious software and managed to bypass your firewall and anti-virus software doesn\u2019t care if you have a Network security policy or not.<\/p>\n
What\u2019s more, a disgruntled IT employee who wants to delete your data or wants to stop your servers won\u2019t mind your Access control policy<\/a>.<\/p>\n All the same, a competitor who wants to steal your most precious know-how won\u2019t be very impressed with the Classification policy you invested a lot of time in writing.<\/p>\n So really, just having the documents won\u2019t help you a lot. This is why it is important to distinguish between two types of companies: (a) those who use frameworks like ISO 27001 to produce nice documents (in a very short time) and get an even nicer certificate they can show off with; and (b) those who may or may not want the certificate, but who definitely want to improve security in their company.<\/p>\n You can surely guess what the security will look like in (a) type of company, so let\u2019s not waste time on them; the rest of this article concerns the (b) companies.
\n