Tag: Information security

ISO 27001

ISO 27001 Annex : A.9.1.2 Access to Networks and Network Services

info savvy

Control- ISO 27001 Annex : A.9.1.2 Access to Networks and Network Services Only network and network facilities which have expressly been approved for use will be made available to users.

Implementation Guidance- A policy on the use of networks and network policy should be developed. Following points should be covered in this policy:

  1. networks and network infrastructure to which access is permitted;
  2. Authorization procedures for determining who is permitted to access which networks and Networking services;
  3. Management processes and policies for securing access to network interfaces and network services;
  4. the medium for networking and network services (for example, using VPN or wireless network);
  5. Access to various network services requires user authentication;
  6. Network service usage monitoring.

The network services policy should comply with the access control policy of the organization.

Related Product : ISO 27001 Lead Auditor Training And Certification ISMS

Other information- Unauthorized and insecure network connections will impact the entire organization. Such monitoring is especially essential for network connections to sensitive or vital business applications or users in high-risk environments, e.g. public or external areas beyond the management and control of information security of an organization.

Also Read : ISO 27001 Annex : A.9 Access Control

I dream of Digital India where Cybersecurity becomes an integral part of our National Security-

-PM. Narendra Modi

In order to keep the organization’s assets (including network and networking services) safe, certain access controls are required to prevent unauthorized users from accessing your network. The guidelines that policy for access management, access rights, and limitations of specific user roles on the network are being defined in Annex 9.1.2 of Standard 27002. At Infosavvy, we do have certain standards to follow to ensure that our network system security and that we apply for one of the most important information security certificates. i.e. IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification). Our well-trained and professional trainers will help you by providing you with comprehensive information and several examples to enhance an applicant’s ability to handle network security management, to ensure the right access to the right user and at the right place.

Read More : https://www.info-savvy.com/iso-27001-annex-a-9-1-2-access-to-networks-and-network-services/

Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us – www.info-savvy.com

https://g.co/kgs/ttqPpZ

ISO 27001

ISO 27001 Clause 10.2 Continual Improvement

info savvy

Required Activity

ISO 27001 Clause 10.2 Continual Improvement, The organization continually improves the suitability, adequacy and effectiveness of the ISMS.

Why organization needs to have continual improvement?

Organizations are never static, nor their contexts. In addition, the threats to the information systems, and the ways in which they can be compromised, are rapidly changing. At the end of the day, there’s no ISMS which remains perfect; it always needs to be set on continual improvement; however, the organization and its context are not changing. Here at Infosavvy we are continually talking about how the ISMS is a systematic approach consisting of processes, technology and people that helps us to protect and manage our organisation’s information through effective risk management. It is a topic of discussion in all of our training and we make sure that our trainees also imbibe the same understanding. It has become a second nature. We are constantly looking at making improvements. It’s just not a requirement of an ISMS but need of every organization.

Related Product : ISO 27001 Lead Auditor Training And Certification ISMS

As an example of non-conformity or risk-related improvements, an assessment of an ISMS component (in terms of suitability, adequacy and effectiveness) may show that it exceeds ISMS requirements or is lacking in efficiency. If so, then the ISMS can often be improved by making changes in the management system.

Area of improvements

  • Regular internal audits
  • Regular and proper management review (Clause 9.3 ISO 27001)
  • Regular external audits
  • Understanding the suggestion from the stakeholders and accordingly implementing them in information management system
  • Keeping a check whether organization is following Regulatory policies or not
  • Reviewing security controls
  • Matching the organization activities with requirements of standard ISO 27001

Also, top management can set objectives for continual improvement, e.g. through measurements of effectiveness, cost, or process maturity. ISMS is known as a crucial entity that plays a vital role in business operations. In order to keep pace with the developments, the ISMS is periodically checked for function, efficacy and consistency with the objectives of the organization. This blog addresses clause 10.2 of ISO 27001:2013 Continual improvement, Infosavvy helps you to understand the implementation of the standard and provides in-depth knowledge of IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (training certified by TÜV SÜD)

What all necessary while doing the assessment?

  1. Suitability of the ISMS, considering the external and internal issues, requirements of the interested parties, established information security objectives and identified information security risks are properly addressed through planning and implementation of the ISMS and information security controls.
  2. ISMS adequacy to find the conformity of ISMS processes and information security meets the ultimate goals, practices and processes of the company.
  3. Effectiveness of the ISMS, considering if the intended outcome(s) of the ISMS are achieved, the wants of the interested parties are met, information security risks are managed to satisfy information security objectives, nonconformities are managed, while resources needed for the establishment, implementation, maintenance and continual improvement of the ISMS are commensurate with those results.

The assessment can also include an overview of the efficiency of the ISMS and the components of its resources, evaluating whether their usage of resources is appropriate, if there is a possibility of productivity loss or opportunity to achieve greater effectiveness. Area of improvement can also be identified while managing nonconformities with corrective actions.

Also Read: ISO 27001 Clause 10.1 Non conformity and corrective action

Once area(s) of improvement are identified, the organization should be consistent in maintaining them by:-

  1. Evaluate them to determine whether or not they are worth pursuing;
  2. Plan and implement the actions to deal with the opportunities ensuring that benefits are realized, and nonconformities don’t occur or should plan for corrective actions for non-conformities;
  3. Evaluate the effectiveness of the actions.

Read More : https://www.info-savvy.com/iso-27001-clause-10-2-continual-improvement/

————————————————————————————————————————–
Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us – www.info-savvy.com

https://g.co/kgs/ttqPpZ

Uncategorized

What is Information Warfare?& there categories

info savvy

The term information warfare or InfoWae refers to the use of information and communication technologies (ICT) for competitive advantages over an opponent. Examples of information warfare weapons include viruses, worms, Trojan horses, logic bombs, trap doors, nano machines and microbes, electronic jamming, and penetration exploits and tools.
The use of data in warfare to realize operational objectives has forever been associate integral.

Arm of military warfare, be it within the kinds of covert intelligence or open domestic info. However, with the rise in speed and reach of data,any interesting conflict are instantly thrust into the consciousness of the international community, and subjected to scrutiny, debates, and opinions which is able to form the portrayal of the parties concerned within the conflict. Moreover, historically weaker adversaries will leverage on low-cost and without delay out there info technology like social media platforms and video hosting websites, to wield disproportionate influence over domestic and international lots to consistently undermine the legitimacy and morality of the military and additionally mobilize native populations to get up against the offensive military. Hence, fastidiously crafted multifarious info operations, as a vital part of associate degree overall military strategy, can become associate more and more important operational and strategic imperative for winning the battle of perceptions, securing operational battle-space, and achieving strategic finish in current conflicts.
Abstract
What makes warfare within the modern era a departure from the past is that info as warfare has become as necessary as information in warfare. data is not any longer simply a method to spice up the effectiveness of deadly technologies, however exposes the chance of non-lethal attacks which will incapacitate, defeat, deter or hale associate resister. the data age has conjointly expanded the domains of warfare – on the field, within the marketplace, and against the infrastructure of recent society – and its purveyors –individuals and personal teams additionally to national militarizes. however despite these variations, the logic of warfare remains identical – sequencing and coordination attacks to realize lower order technical or ‘cyber’ goals, that are a part of a broader campaign to realize higher order political, material and/or symbolic goals. Moreover, despite the leveling have an effect on of data technology, states and state-sponsored teams can retain sure benefits in waging warfare as a result of a capability for sustained attack still needs A level of organization, intelligence concerning the target, and property unlikely to be possessed by the lone individual.

Martin Libicki has divided information, warfare into the following categories;
Command and control warfare (C2 warfare): In the computer security industry, C2 warfare refers to the impact an attacker possesses over a compromised system or network that they control.
Intelligence-based warfare: Intelligence-based warfare is a sensor-based technology that directly corrupts technological systems. According to Libicki, “intelligence-based warfare” is a warfare that consists of the design, protection, and denial of systems that seek sufficient knowledge to dominate the battle space.
Electronic warfare: According to Libicki, electronic warfare uses radio electronic and cryptographic techniques to degrade communication. Radio electronic techniques attack the physical means of sending information, whereas cryptographic techniques use bits and bytes to disrupt the means of sending information.
Psychological warfare: Psychological warfare is the use of various techniques such as propaganda a -id terror to demoralize one’s adversary in an attempt to succeed in the battle.
Hacker warfare: According to Libicki, the purpose of this type of warfare can vary from shutdown of systems, data errors, theft of information, and theft of services, system monitoring, false messaging, and access to data. Hackers generally use viruses, logic bombs, Trojan horses, and sniffers to perform these attacks.
Economic warfare: According to Libicki, economic information warfare can affect the economy of a business or nation by blocking the flow of information. This could be especially devastating to organizations that do a lot of business in the digital world.
Cyber warfare: Libicki defines cyber warfare as the use of information systems against the virtual personas of individuals or groups. Jt is the broadest of all information warfare and includes information terrorism, semantic attacks (similar to Hacker warfare, but instead of harming a system, it takes the system over and the system will be perceived as operating correctly), and simulate-warfare (simulated war, for example, acquiring weapons for mere demonstration rather than actual use).
Each form of the information warfare, mentioned above, consists of both defensive and offensive strategies.
Defensive Information Warfare: Involves all strategies and actions to defend against attacks on ICT assets.
Offensive Information Warfare: Involves attacks against ICT assets of an opponent.