usegalaxy.eu’s information security is certified – we passed the annual audit!

Did you know that the computer center, usegalaxy.eu runs on, has been ISO 27001 certified since 2021? This means the Freiburg University computer center has implemented an information security management system (ISMS), a structured framework of policies, processes, and controls to systematically manage and protect sensitive information. By improving cybersecurity and availability, this certification benefits the whole Galaxy Europe community and serves as proof of our information security practice to partners and funders. The annual surveillance audit was successfully completed last week – a good opportunity, therefore, to raise awareness about it.

What is ISO 27001 about? What are the requirements?

The requirements of the ISO 27001 standard can be seen as three pillars that are examined when an organization is evaluated. The standard’s requirements are organized in seven clauses (4-10): Context of the organization, Leadership, Planning, Support, Operation, Performance Evaluation, and Improvement, but summarizing them in three pillars makes it more explainable. In the first pillar, the organization defines security objectives, strategies, and responsibilities, often supported by an information security policy and operational guidelines.
The second pillar is about systematically assessing assets and risks and documenting them. In ISMS, the focus is on potential consequences and the likelihood of loss of confidentiality, integrity, and availability of information. These three principles are called ‘the CIA triad’ and assessing the risks threatening them is a very important part, because it gives the whole operation sight.
To address these risks, in the third pillar, the organization defines risk treatment options and determines the controls necessary to implement and monitor them. Measurable objectives and monitoring support the comparison of progress as well as continuous improvement that is required by the standard, meaning an ISMS is not a rigid construct but is instead regularly reviewed and adjusted.

ISMS in practise – a short example

Since all of this is very abstract, let me apply the previously introduced pillars to a practical example.
A typical risk to the CIA triad is that people could gain physical access to the servers of the computer center and steal or manipulate data (translates to confidentiality and integrity). The person could also push the emergency power button, and then this would likely affect availability. Now we have to assess the risk in detail; where could the person enter the building? Through the door, the window? By using a fake identity? All these possibilities have to be taken into account. How do we prevent unauthorized access? This is where the third pillar comes in: What options do we have? Can we buy an alarm system? Do we need to train the access control staff to detect fake ID cards? You get the picture—the whole process is about analyzing operations, finding risks, and trying to handle them accordingly.
While many people might argue that they are following good practice, this could mean something completely different for different people, making security difficult to assess and result in invisible risks. Additionally, this management framework can help improve communication with higher management levels, allowing them to allocate appropriate resources for information security by translating technical details into more abstract risks and making treatments measurable. As you can see, ISMS does not solely focus on technological cybersecurity but on employees’ behavior and management involvement. What improves security is more than technical measures – it is a cultural shift in the organization.

Thank you to Jan, our former ISMS officer

In order to be certified, the organization has to undergo an initial certification process with an external certification body, that is an expensive and time-consuming two-stage process, which tests first the readiness and then the formal conformity. The certification body evaluates results of these two audits and then announces the final decision (this happened in January 2022). After the initial certification, a three-year cycle begins, with surveillance audits every first and second year and a re-certification audit every third year. If discrepancies are identified, the certified organization must rectify them and ensure that processes and management are corrected. On behalf of the entire Galaxy Europe team, I would like to extend a special thank you to our former ISMS Officer, Jan Leendertse, who made the ISO certification possible and dedicated significant effort to maintaining it.