Securing the National Data Center
The Royal Government of Bhutan is setting up a national data center to host e-government services. The center will house servers for citizen services, land records, and health information. A security audit revealed several issues: (1) default administrator passwords on some database servers, (2) no network segmentation between the web servers and the database servers, (3) logging is enabled but logs are only kept for 7 days, (4) no formal incident response plan, and (5) physical access to the server room is controlled by a single key held by the IT manager. The center has 10 staff, of whom only 2 have security training. The government wants to achieve ISO 27001 certification within 18 months. The IT manager must prioritize remediation actions and justify them to the steering committee, considering budget constraints and the need to maintain service availability.
1. Prioritize the five security issues based on risk (likelihood and impact). Explain your reasoning.
Read the worked answer
Risk = likelihood × impact. Issue (1) default passwords: high likelihood (common attack vector) and high impact (full database compromise, data breach). Highest priority. Issue (2) no segmentation: high likelihood (once web server compromised, attacker moves laterally) and high impact (access to sensitive databases). Second priority. Issue (3) short log retention: medium likelihood of missing evidence, medium impact (hinders investigation). Lower priority but important for compliance. Issue (4) no incident response plan: medium likelihood of incidents, high impact if uncoordinated response leads to extended downtime. Could be third. Issue (5) single key: low likelihood of insider threat but high impact if key lost or copied. Physical security is fundamental; however, with only one key, the risk of loss is moderate. Prioritization: 1) default passwords (immediate fix, low cost), 2) network segmentation (requires configuration, moderate cost), 3) incident response plan (policy and training, low cost), 4) log retention (increase to 90 days, storage cost), 5) key control (implement access log and dual control). This order addresses the most easily exploitable and highest impact issues first, while considering cost and effort.
2. Propose a remediation plan that aligns with ISO 27001 requirements and is feasible within 18 months. Include specific steps and a timeline.
Read the worked answer
ISO 27001 requires an ISMS (Information Security Management System) with risk assessment, policies, and controls from Annex A. A feasible plan: Months 1-3: Fix immediate risks: change all default passwords, enforce strong password policy, implement network segmentation (VLANs and firewall rules) between web and DB tiers. Start incident response plan drafting. Months 4-6: Develop and approve incident response plan, conduct first tabletop exercise. Extend log retention to 90 days (or per legal requirements) and centralize logs. Implement physical access controls: replace single key with electronic access system logging entries, and dual control for sensitive areas. Months 7-9: Formalize risk assessment methodology, document policies (access control, cryptography, operations security). Provide security awareness training to all staff (at least basic). Months 10-12: Implement monitoring (IDS/IPS), vulnerability management, and patch management. Conduct internal audit. Months 13-15: Address gaps from internal audit, implement business continuity and disaster recovery plans. Months 16-18: Pre-certification audit, management review, and certification audit. Given only 2 trained staff, consider hiring a consultant or training more staff. Budget for tools (SIEM, access control) and training. This plan addresses all five issues and builds the necessary documentation for ISO 27001.