AI3.2:: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
No edit summary |
||
| (8 intermediate revisions by the same user not shown) | |||
| Line 18: | Line 18: | ||
<br> | <br> | ||
'''Risk Association Control Activities:'''<br> | '''Risk Association Control Activities:'''<br> | ||
::'''3.2.1: Infrastructure'''<br> | ::'''3.2.1: Infrastructure'''<br> | ||
:::'''3.2.1.1: Routers'''<br> | :::[[3.2.1.1: Routers|'''3.2.1.1: Routers''']]<br> | ||
:::'''3.2.1.2: Firewalls'''<br> | :::[[3.2.1.2: Firewalls|'''3.2.1.2: Firewalls''']]<br> | ||
:::'''3.2.1.3: VPN'''<br> | :::[[3.2.1.3: VPN|'''3.2.1.3: VPN''']]<br> | ||
:::'''3.2.1.4: Managed Switches'''<br> | :::[[3.2.1.4: Managed Switches|'''3.2.1.4: Managed Switches''']]<br> | ||
:::'''3.2.1.5: Intrusion Detection or Prevention System'''<br> | :::[[3.2.1.5: Intrusion Detection or Prevention System|'''3.2.1.5: Intrusion Detection or Prevention System''']]<br> | ||
::'''3.2.2: Operating Systems'''<br> | |||
:::'''3.2.2.1: | :::[[3.2.2.1: Unix|'''3.2.2.1: Unix''']]<br> | ||
::: | :::[[3.2.2.2: Windows|'''3.2.2.2: Windows''']]<br> | ||
:::[[3.2.2.3: Mainframe|'''3.2.2.2: Mainframe''']]<br> | |||
:::[[3.2.2.4: OS/400|'''3.2.2.4: OS/400''']]<br> | |||
::: | |||
Latest revision as of 17:19, 7 June 2006
AI 3.2 Infrastructure Resource Protection and Availability
Control Objective:
Implement internal control, security and audit ability measures during configuration, integration and maintenance of hardware and infrastructural software to protect resources and ensure availability and integrity. Responsibilities for using sensitive infrastructure components should be clearly defined and understood by those who develop and integrate infrastructure components. Their use should be monitored and evaluated.
Applicability:
- Sarbanes-Oxley
- HIPAA
- GLBA
- PCI
- FISMA
- NIST SP 800-66
- Ditscap
- Control Exception
- User Defined
Risk Association Control Activities:
- 3.2.2: Operating Systems
- 3.2.2: Operating Systems