ISO 27001 controls – Infosavvy Cyber Security & IT Management Trainings

ISO 27001 Annex : A.12.2 Protection from Malware It’s objective is ensuring that malware protection is provided to information and information processing facilities.

A.12.2.1 Controls Against Malware

Control- In combination with appropriate user awareness, the detection, prevention, and recovery controls to protect against malware should be implemented.

Malware protection should be supported by malware detection and repair software, awareness of the safety of information, and adequate system access and management reviews on changes. The guidance should be considered as follows:

Implementation guidance

a create formal policy barring the use of unauthorized software;
Implementation of controls preventing or detecting the use of unauthorized software;
Implement controls which avoid or detect the use of malicious websites known or suspected (e.g. blacklisting);
Create a structured risk management policy, which indicates what protective measures should be taken to secure obtaining file and information, either from or through external networks;
Reducing malware-exploitable vulnerabilities, e.g. by management of technical vulnerabilities;
conduct frequent software and data quality reviews of applications that help critical processes; a formal investigation will take place into the existence of unapproved files or unauthorized amendments;
Installing and regularly updating malware and repair software as precautionary or routine test for scanning computers and media; Administered scanning should include:

scan for malware before using any files received via networks or any storage device;
Scanning of E-mail attachments and downloads for malware; the scan will be performed in different places, e.g. electronic mail servers, mobile computers and when accessing the organization’s network;
Malware scanning of web pages;

define malware protection procedures and responsibilities on systems, training in their use, reporting and recovery from malware:
Establishing appropriate business continuity plans, including all necessary software backup and recovery arrangements to recover from malware attacks;
implementation of information gathering procedures, such as a subscription to mailing lists or websites providing new malware information;
Implementing malware information verification procedures to ensure the accuracy and information quality of advisory bulletins; managers should ensure the differentiation between rogues and real malware is achieved using a qualified source, e.g. reputable journals, reliable internet sites or software suppliers;
Isolate environments that could result in catastrophic effects.

“One single vulnerability is all an attacker needs”
– Window Synder

The organization wishes to maintain the CIA triads. They also ensure that the operation in their business have been implemented with proper security controls to protect the confidentiality, authenticity and/or integrity of the organization’s information and information processing facilities, and also free from virus or malware attacks. This malware protection control is covered in Annex 12.2 of ISO 27001. This famous certification of lead auditor and lead implementer covers all the annexes to the security of information by implementing appropriate access controls to ensure authorized access to protect the organization’s critical information. Infosavvy, a Mumbai-based institute, offers certifications and training for multiple-domain-like management of information security, cybersecurity, and many others, including the IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification). This certification covers several audits to keep an organization safe from the intended destructor. Infosavvy will help you to understand and identify the full extent of the security controls of your organization that is necessary to protect the operations and information equipment (assets)of your organization from attacks even at the time of their demise. We have trained trainers who have ample know-how and experience in order to make sure that the information security is effectively handled. The applicant will, therefore, gain the skills needed to conduct the ISMS audit using commonly agreed audit concepts, procedures and techniques.

This Blog Article is posted by
Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us – www.info-savvy.com

ISO 27001 Annex : A.6.2 Mobile Devices and Teleworking its objective is to ensure the security of teleworking and the use of mobile devices.

A.6.2.1 Mobile Device Policy

Control- To manage the risks introduced by the use of mobile devices, a policy and supporting safety measures should be adopted.

Implementation Guidance- Special care should be taken when using mobile devices to ensure that business information is not compromised. The policy on mobile devices should take into account the risks of working with mobile devices in unprotected environments.

Related Product : ISO 27001 Lead Auditor Training And Certification ISMS

Mobile device policy should include:-

Registration of mobile devices;
Requirements for physical protection;
Restriction of software installation;
Requirements for mobile device software versions and for applying patches;
Restriction of connection to information services;
Access controls; Cryptographic techniques;
Malware protection;
Remote disabling,
erasure or lockout;
Backups;
Usage of web services and web apps.

Be careful while using mobile devices in public areas like meeting rooms and other not so protected areas. Preventive measures should be taken to avoid unauthorized access, or disclosure of confidential information stored and processed by the devices, eg. cryptographic methods and enforcing the use of secret authentication information

Mobile devices should also be physically secured against theft, particularly when entering, for example, in vehicles and other modes of transport, hotel rooms, convention centers, and public gatherings. A chosen protocol, taking into account the regulatory, insurance, and other security requirements of the organization, should be defined for cases of theft or loss of mobile devices. Devices containing confidential, sensitive, or crucial business information should not be ignored and, if possible, should be physically locked away, or special locks should be used to protect the items.

Training should be provided for workers using mobile devices to increase their understanding of the potential risks emerging from this method of operating and, thereby, the controls that should be implemented. If the mobile device policy allows the use of private mobile devices, it will also include the rules and associated security controls, those are:-

Separate personal and business usage of the devices, including by using software to help the segregation of personal devices and protect business data;
Providing access to business information only after an end-user agreement has been signed that recognizes their duties (physical safeguard, software upgrade, etc.) waives control of the company’s business data and requires remote data wiping by the client for burglary, loss of a device, or no longer authorized to use a service. The Privacy Legislation must be taken into account in this strategy.

Other Information- Wireless networks for mobile devices are similar to other network connections but have significant variations to be taken into account in the detection of controls. Those significant variations are as follows:-

Certain wireless security protocols are immature and have defined weaknesses;
Mobile device storage may not be backed up due to insufficient network bandwidth and even when backup processing is scheduled, devices may not be connected.

Mobile devices generally share common functions, e.g. networking, internet access, e-mail, and file handling, with fixed-use devices. Controls in information security for mobile devices typically consist of those implemented within fixed use systems and those to counter risks raised by their use outside the premises of the organization.

A.6.2.2 Teleworking

Control- To guard the accessed, processed, or stored information at teleworking sites, a policy and supporting security measures should be implemented.

Implementation Guidance- Teleworking organizations should issue a policy defining the guidelines for using teleworking. The following points should be considered where deemed applicable and authorized by law:-

The existing physical security of the teleworking site, taking into account the physical safety of the building and, consequently, the local environment;
the proposed physical teleworking environment;
Communications security requirements, taking into consideration the need for direct access to the internal networks of the organization, the sensitivity of the information to be obtained and transmitted via the contact channel and, thus, the vulnerability of the internal system;
Providing virtual desktop access which prevents information processing and storing on private equipment;
Risk of unauthorized access to information or resources from other persons using the amenities, e.g. family and friends.
Usage of home networks, and requirements or limitations on wireless network access configuration;
Policies and procedures for settling conflicts involving property rights built on privately-owned equipment;
Access to private facilities (to test the security of the device or during an investigation) which may be prohibited by law;
Software License agreements which are such organizations may be responsible on workstations owned privately by staff and/or external parties for licensing for client software;
Requirements for malware protection and firewall.

Also Read : ISO 27001 Annex : A.6 Organization of Information Security

The guidelines and arrangements should include the following:-

The procurement of suitable teleworking facilities and storage furniture, where the use of private devices not under the organization’s regulation is not permitted;
A definition of the work allowed, the hours of work, the classification of the information to be stored and therefore the internal systems and services to which the teleworker is entitled;
Provision of an appropriate communication system, including methods for securing remote access;
Physical security, provision of insurance policies, a requirement of support and maintenance for hardware and software
Rules and guidance on access to equipment and information for families and visitors;
Monitoring of audit and security,
Backup and business continuity planning
Revocation of authority and service privileges and removal of facilities after termination of teleworking operations.

Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us – www.info-savvy.com

https://g.co/kgs/ttqPpZ