confidential – Infosavvy Cyber Security & IT Management Trainings

ISO 27001 Annex : A.14.3 Test data

May 8, 2021 info savvy

ISO 27001 Annex : A.14.3 Test data its objective is to ensure that data used for research are secured.

A.14.3.1 Protection of test data

Control – Careful collection, security, and review of test data should be performed.

Implementation Guidance – It should be avoided the use of operational information containing personal information or any other confidential information for test purposes. Where personal information or otherwise confidential information for testing purposes is used, all sensitive information and content should be protected either by deletion or modification.

When used for testing purposes, the following guidelines should be used for the protection of operational data:

The access management protocols applicable to the running application systems should also refer to the application control systems;
Every time operational information is copied to the test setting, separate authorization should be granted;
Operational information should be deleted immediately after completion of the test environment from a test environment;
In order to include an audit trail, copying and using operational details should be logged.

Other Information – System testing and acceptance testing usually involve significant volumes of test data as close to operational data as possible.

A well-known ISO 27001 Lead Auditor and ISO 27001 Lead Implementer certificate that mainly covers information security clauses and their implementation, i.e., controls which should be implemented by the organization to preserve the CIA triad, Confidentiality, Integrity, and Availability to maintain their critical, sensitive information in a secure manner. Infosavvy, an institute in Mumbai conducts training and certification for multiple domains in Information Security which includes IRCA CQI ISO 27001:2013 Lead Auditor (LA), ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification). Infosavvy will help you to understand and recognize the full scope of your organization’s security checks to protect your organization’s activities and information equipment (assets) from attacks, and also to illustrate the controls for securing system engineering principles and also controls for maintaining and testing software packages and systems. We have trainers with extensive expertise and experience to ensure the efficient handling of the security of information. Consequently, the applicant will gain the necessary skills for the ISMS audit by using commonly agreed audit concepts, procedures and techniques.

This Blog Article is posted by
Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us – www.info-savvy.com

ISO 27001

ISO 27001 Annex : A.13 Communications Security

April 27, 2021 info savvy

ISO 27001 Annex : A.13 Communications Security in this article explain A.13.1 Network Security Management, A.13.1.1 Network Controls, A.13.1.2 Security of Network Services, A.13.1.3 Segregation in Networks.

A.13.1 Network Security Management

It’s objective is to ensure the security and supporting information processing facilities of the information in a network.

A.13.1.1 Network Controls

Control- To protect information in systems and applications, networks should be managed and monitored.

Implementation Guidance – The monitoring of network information security and the security of connected networks from unauthorized access should be undertaken. The following things will in particular be taken into account:

Networking equipment management responsibilities and procedures should be established;
Network operational responsibility can, where necessary, be segregated from computer operations;
The confidential and integrity of data transmission via public networks and wireless networks and the protected network and applications should be subject to special controls; specific controls may also be essential to maintain the availability of network services and connected computers;
Appropriate logging and monitoring should be used so that actions that may or are relevant to information security can be recorded and detected;
Close coordination of management activities should be provided to improve the service offered to the company and to ensure effective control of all information processing infrastructures;
Authentication of network systems;
Network connection should be restricted to devices.

Other Information – Further network protection information is available in ISO / IEC 27033.

A.13.1.2 Security of Network Services

Control- Security protocols, quality of service, and management criteria for all network services, whether in-house or outsourced, should be defined and included in-network services agreements.

Implementation Guidance – It is necessary to determine and regularly supervise the capability of the network service provider to safeguard the agreed services and to agree to audit rights.

The required security structures such as security features, service rates, and management criteria for particular facilities should be defined. It will ensure that these steps are enforced by network service providers.

This Blog Article is posted by

Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092
Contact us – www.info-savvy.com

ISO 27001

ISO 27001 Annex : A.8.3 Media Handling

June 29, 2020 info savvy

ISO 27001 Annex : A.8.3 Media Handling Its objective is to Stop unauthorized release, alteration, deletion, or destruction of information contained in the media.

A.8.3.1 Management of Removable Media

Control- Procedures shall be implemented for the management of removable media in accordance with the classification scheme adopted by the organization.

Implementation Guidance- The following guidelines should be considered for the management of removable media:

If not needed, the contents of any reusable media that are to be removed from the organization should be made unrecoverable;
Where applicable and practicable, authorization should be needed for the removal of media from the company and a record of these removals should be maintained in order to preserve the audit trail;
In compliance with manufacturers’ standards, all media should be kept in a secure and safe environment;
Where confidentiality or integrity of data is important, cryptographic techniques for securing data on removable media must be used;
In order to minimize the possibility of media loss when storage data is still needed, the data should be moved to fresh media before being unreadable;
Multiple copies of important data should be stored in different media to further reduce the possibility of accidental data damage or loss;
Registration of removable media should be taken into account to limit the possibility of data loss;
Removable media drives should only be allowed if there is a business purpose to do so;
Where there is a requirement for the use of disposable media, the movement of data to such media will be supervised.

Where there is a need to use disposable media, the transition of data to such devices will be monitored. Procedures and levels of approval will be reported.

Related Product : ISO 27001 Lead Auditor Training And Certification ISMS

A.8.3.2 Disposal of Media

Control- When not required by specific protocols, media should be disposed of securely.

Implementation Guidance- Formal protocols for the secure disposal of media should be established to reduce the possibility of leakage of sensitive information to unauthorized persons. The protocols for the secure processing of sensitive information media should be proportionate to the sensitivity of that material.

Following should be taken into account:-

Confidential media should be processed and disposed of safely through, e.g. by incineration or shredding, or data erasure for use by another application within an organization.
Procedures should be in place to identify the items that could need safe disposal
Instead of trying to isolate important objects, it could be better to plan to safely collect and dispose of all media items;
Many organizations offer media collection and disposal services; care must be taken to select a suitable external party with adequate controls and experience;
In order to maintain an audit trail, the disposal of confidential items will be logged.

The aggregation effect should be taken into account when collecting media for disposal, and a large number of sensitive information can become vulnerable.

For a healthy business, identifying the assets, making an inventory of the assets, and then secure disposal. At Infosavvy we have our trainers as our assets who are skilled and well-trained in various courses in the field of information security and we are also eligible for one of the most important certificates in the area of information security. i.e. IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification) . Our trainers can empower you to do better asset management by providing you with in-depth information and numerous examples for the same, helping the applicant to improve their skills and do well.

Other Information- Damaged devices containing sensitive data can require a risk assessment to evaluate the physical loss of objects instead of being sent to them for repair or discharge.

Also Read : ISO 27001 Annex : A.8.2.2 Labeling of Information & A.8.2.3 Handling of Assets

A.8.3.3 Physical Media Transfer

Control- Information media should be protected from unauthorized access, misuse or corruption during transportation.

Implementation Guidance- For the safety of media containing information transported, the following guidelines should be considered:

Reliable transport or the use of couriers;
Management should agree on a list of authorized couriers;
procedures should be established for verifying courier identification;
Packaging should probably be sufficient to safeguard the content from any physical damage likely to occur during transit and to protect the content against environmental factors such as exposure to heat, humidity, or electromagnetic fields which could reduce media recovering efficiency.
Logs should be maintained, the content of the media should be established, the security applied, and times of transfer to custodians and reception should be reported at the destination.

Tag: confidential