ISO 27001 Annex : A.13 Communications Security in this article explain A.13.1 Network Security Management, A.13.1.1 Network Controls, A.13.1.2 Security of Network Services, A.13.1.3 Segregation in Networks.
A.13.1 Network Security Management
It’s objective is to ensure the security and supporting information processing facilities of the information in a network.
A.13.1.1 Network Controls
Control- To protect information in systems and applications, networks should be managed and monitored.
Implementation Guidance – The monitoring of network information security and the security of connected networks from unauthorized access should be undertaken. The following things will in particular be taken into account:
Networking equipment management responsibilities and procedures should be established;
Network operational responsibility can, where necessary, be segregated from computer operations;
The confidential and integrity of data transmission via public networks and wireless networks and the protected network and applications should be subject to special controls; specific controls may also be essential to maintain the availability of network services and connected computers;
Appropriate logging and monitoring should be used so that actions that may or are relevant to information security can be recorded and detected;
Close coordination of management activities should be provided to improve the service offered to the company and to ensure effective control of all information processing infrastructures;
Authentication of network systems;
Network connection should be restricted to devices.
Other Information – Further network protection information is available in ISO / IEC 27033.
Control- Security protocols, quality of service, and management criteria for all network services, whether in-house or outsourced, should be defined and included in-network services agreements.
Implementation Guidance – It is necessary to determine and regularly supervise the capability of the network service provider to safeguard the agreed services and to agree to audit rights.
The required security structures such as security features, service rates, and management criteria for particular facilities should be defined. It will ensure that these steps are enforced by network service providers.
ISO 27001 Annex : A.12.4 Logging and Monitoring Its objective is recording events and generating evidence.
A.12.4.1 Event Logging
Control- Event logs should be produced, retained, and regularly reviewed to record user activities, exceptions, defects, and information security events.
Implementation Guidance- Where applicable, event logs should include:
IDs of User;
Activities of the system;
dates, times and key events details, such as log-on and log-off;
System ID or location and device recognition where possible;
records of the attempts to access the system successfully as well as rejected ones
successful and unsuccessful data records and other attempts to access resources;
Protective mechanisms such as anti-virus and intrusion detection systems are activated and deactivated as required;
Transaction records done in applications by users.
Event logging inspires automatic control systems capable of producing integrated network monitoringnotifications and warnings.
Other information- Sensitive information and personally identifiable information can be used in event logs. Proper measures in the field of privacy should be implemented. System administrators should not be allowed to delete or deactivate logs of their own activities where possible.
Control- Logging and log information should be secure from intrusion and unauthorized access.
Implementation Guidance- Controls should be designed to protect against unauthorized log information changes and operational logging problem, including the following:
Alterations to the types of messages recorded;
Editing or removing log files;
The logfile media storage space is surpassed, which means either that an event is not registered or that the past events have been over-written.
Certain audit logs may require archiving as part of the retention of records or as a result of collecting evidence and retention requirements.
Other information- System logs also contain a large amount of information, which is largely unique to monitoring information security. The copying automatically to a second log of relevant message types or the use of suitable device utilities or auditing tools to perform file interrogations and rationalizing should be considered to help classify significant events for information security monitoring.
System logs must be protected, because data can create a false sense of security, when often modified or deleted. To safeguard logs, real-time copy of logs to a system outside the control of a system manager/operator.
This Blog Article is posted by Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092
ISO 27001 Annex : A.11 Physical and Environmental Security in this article explain Secure areas, Physical Security Perimeter and Physical Entry Controls.
A.11.1 Secure areas
Its objective is to avoid unauthorized physical access, damage and interference with the organization’s information and information processing facilities.
A.11.1.1 Physical Security Perimeter
Control- Security perimeters should be established in order to secure areas that contain either sensitive or confidential information and information processing facilities.
Implementation Guidance- When appropriate, for physical security perimeters, the following guidelines should be considered and implemented:
Security perimeters should be established and the location and intensity of each perimeter should depend on the security requirements of the assets inside the perimeter and on the results of the risk assessment;
The building or facility perimeters should be physically secure (i.e. there are no perimeter gaps or places where a break-in can easily occur); the site’s exterior buildings, walls, and floors should be securely built and all external doors should be properly secured against unauthorized controlled entry (e.g. bars, alarms, locks); Doors and windows should be locked when the windows are unattended and external security, especially at ground level, should be considered;
There should be a manned reception area or other methods of physical access control for the site or building and only authorized personnel can access to sites and buildings.
Physical barriers to prevent unauthorized physical access and environmental contamination should be built, wherever applicable;
All fire doors should be alerted, monitored and tested alongside walls in order to determine the level of resistance needed in accordance with appropriate state, national and international standards; should act in a failsafe fashion in accordance with the Local Code;
Appropriate intrusion detection systems, according to the national, regional, or international standards shall be installed and tested regularly for the coverage of all exterior doors and accessible windows. Unoccupied areas should be alarmed at all times.
Organization-controlled information management facilities should be segregated physically from those operated by outside parties.
“ When you gambled with safety, you bet your life”
Other Information- The physical protection of the organization’s premises and information processing facilities can be achieved by creating one or several physical barriers. Additional protection is offered by using multiple barriers when a single barrier failure does not immediately affect security.
A protected space may be a closed office or multiple rooms that are enclosed with an internal physical protection restriction. Additional barriers and perimeters for the physical access control between areas with various security requirements within the safety perimeter may be necessary. And in the case of buildings with assets for multiple organizations, special attention to be given to physical security of entry.
The use of physical controls especially for the safe areas, as set out in the risk assessment, needs to be adjusted to the technical and economic circumstances of the organization.
The Organization wishes that its information to remain within the CIA triads. They also ensure that the physical security controls are properly and efficiently implemented to protect the confidentiality, authenticity and/or integrity of the organization’s information and information processing facilities. The physical and environmental protection of the company is covered in Annex 11 of ISO 27002 . This famous certification of lead auditor and lead implementer covers all the annexes to the security of information by implementing appropriate access controls to ensure authorized access to protect the organization. Infosavvy, a Mumbai-based institute, offers certifications and training for multiple-domain-like management of information security, cybersecurity, and many others, including the IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification). This certification covers several audits to keep an organization safe from the intended destructor. Infosavvy will help you to understand and identify the full extent of the physical and environmental security of your organization that is necessary to protect the operations of your organization from attacks. We have trained trainers who have ample know-how and experience in order to make sure that the information security is effectively handled. The applicant will, therefore, gain the skills needed to conduct the ISMS audit using commonly agreed audit concepts, procedures and techniques
Control- Appropriate access controls should protect places to ensure that only authorized employees are allowed access.
Implementation Guidance- The following points should be taken into consideration:
Visitors should be registered on the date and time of their entry and departure and should supervise all visitors, without prior approval of their access; Access should be given for certain approved purposes only, and guidelines should be provided regarding safety and emergency procedures specifications for the region. Visitors’ identity should be authorized using a suitable means;
Access should be limited to areas where information is processed or stored by means of suitable access controls, for example, the introduction of a two-factor authentication system, such as an access card and a secret PIN;
Securely maintaining and monitoring of a physical logbook or electronic audit trail of all access records;
Infosavvy Cyber Security & IT Management Trainings 