Shell's Trust Domain Infrastructure Security Certification - Linking security management to business objectives.
Pieter van Dijken · Network Security · 2001
Shell companies worldwide completed in 2000 a security programme, covering certification of their IT infrastructure against a subset of ISO 17799 and related ISO standards on certification and audit. Objective was to provide the Shell Group with a secure environment to do (”e”) business in, i.e. sharing of knowledge, enabling support for global applications and supporting virtual teamworking. The scheme is now up and running in more than 160 countries and 240 Shell companies. In this presentation I will describe background considerations on the Scheme as an example of business linked information security management. I will go as well into practical issues regarding roll-out and implementation of a global scheme like this. I will conclude with outlook for the Scheme, planned activities and issues. Pieter van Dijken (51, Dutch) manages the global information security consultancy team in Shell Services International. This team operates from locations around the world in support of the information security requirements of the Royal Dutch/Shell Group of companies. His team facilitated very recently a strategic, world wide security certification programme, called Trust Domain. Objective of this programme is to establish a common set of information security standards and controls for IT infrastructure throughout the Shell Group, based on a subset of the BS 7799 standard. Benefits of having such a common set are numerous, e.g. facilitate information sharing across the Shell Group without making Shell companies vulnerable to unauthorised access; having lower cost and more capabilities through the use of standard security 202 ADVANCES IN NETWORK AND DISTR. SYSTEMS SECURITY protocols and tools and finally by avoiding unnecessary security controls between Shell companies. Pieter joined Shell in 1988 and has been involved in numerous international policy and standardisation efforts with regard to trust and confidence in IT since. He was directly responsible for the translation of BS 7799 in Dutch, took part or chaired a host of related initiatives (e.g. the Dutch BS 7799 certification Scheme and many others). Pieter has degrees in business law and police administration and published on criminal justice implications of IT. He lives in the Netherlands with his wive and three children.