ISO 27001:2013
- OPERATIONS SECURITY
By DSRC Quality Assurance Group
Documented Operating procedures – Vouch for procedures
and policies.
Installation and configuration of systems
Handling of information
Backup
Error Handling or Issue tracking
Escalation and remedial instructions
Log Management
OPERATIONAL PROCEDURES AND RESPONSIBILITIES
Change Management – Changes which will affect
information security with respect to CIA need to be
controlled.
Identification
Planning and testing
Impact Analysis
Review and Approval
Communication
Fall back process incase of failure
Handling Emergency Changes
OPERATIONAL PROCEDURES AND RESPONSIBILITIES
Capacity Management – for Future use of Resources
Requirement Analysis – Criticality of Business
New Business requirements
Removal of Obsolete Data
Performance Tuning of systems and process
Restriction on Band-width usages during delivery etc
Resource (human) requirement and their
Capacity/Competence
OPERATIONAL PROCEDURES AND RESPONSIBILITIES
Separation of Development, Testing and Operational
Environments– Protection of Operational environment from all
types of Risks.
Segregation of Development, Testing and Operational Systems
Maintenance of production and test data
Handling of Exceptional cases
Segregation of Users based on their activities
Protection of Business critical or highly secured data from Production,
testing and operational process
OPERATIONAL PROCEDURES AND RESPONSIBILITIES
Controls
against Malware – Protection of facilities from
Malware threat
Detect, Prevent and Recover
Protection from Unwanted downloads
Periodical review
Whitelisting and Blacklisting
Fall back process incase of failure
Escalation
PROTECTION FROM MALWARE
Backup – To Protect Loss of Data, DR and BCP.
Clearly defined Backup Policy – Contract Obligation
Plan – Data, Systems and Tools and physical
information's
DR/BCP – Time testing
Periodicity – Retention Period – Media
Storage place and tools
DR site
BACKUP
EventLogging– Recording operational events of information
security
Event logging – Legally viable
When, Where, Whom, What and Why
Attempts of Access, Installation, Configuration
Change
Activation and de-activation of system controls
(antivirus)
LOGGING AND MONITORING
Protection of Log information– Backup of System Logs
Meant for Legal evidence
Protected against, tampering or deletion
Access Restriction
Part of backup schedule
Periodicalreview of Protection Controls in place with
Capacity review
LOGGING AND MONITORING
Administrator
and Operator logs– Recording operational
events of administrator and operator of information facility
Administrator privilege
Privilege access to operators
Critical data/ system access
Intrusion detection system
Clock Synchronization – Meant for accuracy of event logging
which makes the log evidence legally acceptable in terms of
accuracy as per the statutory and regulatory rules or under
court of law
LOGGING AND MONITORING
Ensure Integrity of Operational systems
Trained candidate only authorized to perform changes
Change control need to be applied
Roll back facility need to be done – incase of contingency
Necessary review and approvals before change
Audit log should be maintained
Restricted Access management incase of outside suppliers
CONTROL OF OPERATIONAL SOFTWARE
Information systems audit controls– Minimize the impact of audit
activities on Business operations
Approval to carry out audit on Information systems
Scope of technical audit – to be agreed by stakeholders
Audit access can be given with read-only on data
Separation files - copy for full access - based on NDA
Any trial which affects the operation - should be done after
business hours
Allaudit trails need to be recorded and monitored through
Event log management
INFORMATION SYSTEM AUDIT CONSIDERATIONS
THANK YOU
