AI3.2:: Difference between revisions

From HORSE - Holistic Operational Readiness Security Evaluation.
Jump to navigation Jump to search
No edit summary
No edit summary
Line 18: Line 18:
<br>
<br>
'''Risk Association Control Activities:'''<br>
'''Risk Association Control Activities:'''<br>
<br>
 
::'''3.2.1: Infrastructure'''<br>
::'''3.2.1: Infrastructure'''<br>
:::[[3.2.1.1: Routers|'''3.2.1.1: Routers''']]<br>
:::[[3.2.1.1: Routers|'''3.2.1.1: Routers''']]<br>
Line 25: Line 25:
:::[[3.2.1.4: Managed Switches|'''3.2.1.4: Managed Switches''']]<br>
:::[[3.2.1.4: Managed Switches|'''3.2.1.4: Managed Switches''']]<br>
:::[[3.2.1.5: Intrusion Detection or Prevention System|'''3.2.1.5: Intrusion Detection or Prevention System''']]<br>
:::[[3.2.1.5: Intrusion Detection or Prevention System|'''3.2.1.5: Intrusion Detection or Prevention System''']]<br>
<br>
 
::'''3.2.2: Operating Systems'''<br>
::'''3.2.2: Operating Systems'''<br>
:::[[3.2.2.1: Unix|'''3.2.2.1: Unix''']]<br>
:::[[3.2.2.1: Unix|'''3.2.2.1: Unix''']]<br>

Revision as of 18:26, 2 May 2006

AI 3.2 Infrastructure Resource Protection and Availability

Control Objective:

Implement internal control, security and audit ability measures during configuration, integration and maintenance of hardware and infrastructural software to protect resources and ensure availability and integrity. Responsibilities for using sensitive infrastructure components should be clearly defined and understood by those who develop and integrate infrastructure components. Their use should be monitored and evaluated.

Applicability:

Sarbanes-Oxley
HIPAA
GLBA
PCI
FISMA
NIST SP 800-66
Ditscap
Control Exception
User Defined


Risk Association Control Activities:

3.2.1: Infrastructure
3.2.1.1: Routers
3.2.1.2: Firewalls
3.2.1.3: VPN
3.2.1.4: Managed Switches
3.2.1.5: Intrusion Detection or Prevention System
3.2.2: Operating Systems
3.2.2.1: Unix
3.2.2.2: Windows
3.2.2.2: Mainframe
3.2.2.4: As/400