Search results

'''DS 5.6 Security Incident Definition'''<br> ...ent process. Characteristics include a description of what is considered a security incident and its impact level. A limited number of impact levels are define ...

...implement, and maintain a best practice, risk management-based information security program.<br> ...implement, and maintain a best practice, risk management-based Information Security Program.<br> ...

...cilities, technology, and user procedures) and ensure that the information security requirements are met by all components. The test data should be saved for a ISO 17799 12.1 Security requirements of information systems.<br> ...

...plied to both new and legacy information systems within the context of the system development life cycle and the organizational enterprise information techno :Categorize the information system and the information resident within that system based on impact. ...

'''DS 5.5 Security Testing, Surveillance and Monitoring'''<br> ...ly. IT security should be reaccredited periodically to ensure the approved security level is maintained. A logging and monitoring function enables the early de ...

::'''1. Risk: Insufficient configuration controls can lead to security and availability exposures that may permit unauthorized access to systems a ...']] System infrastructure, including firewalls, routers, switches, network operating systems, servers and other related devices, is properly configured to preve ...

...ging scheme such that audit logs are securely written to a centralized log system. ## The centralized log system shall provide a mechanism for archiving audit logs in accordance with appli ...

...h management and upgrade strategies, risks, vulnerabilities assessment and security requirements.<br> ...anges in applications and infrastructure technology, which addresses unit, system, integration and user-acceptance-level testing so that deployed systems ope ...

...op and maintain a risk response to ensure that cost-effective controls and security measures mitigate exposure to risks on a continuing basis. The risk respons All accounts that remain following the comparison to current system accounts should be investigated as they are most likely policy violations a ...

...h agency shall have performed an independent evaluation of the information security program and practices of that agency to determine the effectiveness of such ::'''(A)''' testing of the effectiveness of information security policies, procedures, and practices of a representative subset of the agenc ...

=='''Logical Security'''== ...n a computer network or a computer workstation. It is a subset of computer security.<br> ...

...ort issues and upgrades, periodic review against business needs, risks and security requirements.<br> ...anges in applications and infrastructure technology, which addresses unit, system, integration and user-acceptance-level testing so that deployed systems ope ...

...service requirements, service definitions, service level agreements (SLA), operating level agreements (OLA) and funding sources. These attributes are organized ::'''1. Risk: Development and maintenance of system with potential impact to financial reporting bypass processes for identifyi ...

...h agency shall have performed an independent evaluation of the information security program and practices of that agency to determine the effectiveness of such ::'''(A)''' testing of the effectiveness of information security policies, procedures, and practices of a representative subset of the agenc ...

...t Protection Standard, Company protection standards shall include specific security requirements in the following areas: ## Sample Protection Standards must be reviewed by the Information Security Department to ensure vulnerabilities are not introduced into the Company pr ...

...modern computers and receive hundreds of megabytes of data, poses another security headache. A spy (perhaps posing as a cleaning person) could easily conceal ...ains fully present until overwritten at some later time when the operating system reuses the disk space. With even low-end computers being sold with 30 Gigab ...

...is scheme includes details about data ownership, definition of appropriate security levels and protection controls, and a brief description of data retention a ISO 17799 4.1 Information security infrastructure.<br> ...

...user activity and security related events which are reviewed daily by the security administrators.<br> ...revalidations of user group membership and user accounts are performed by security administration.<br> ...

[[DS1.4:| 1.4 Operating Level Agreements]]<br> [[DS5:| '''5 Ensure Systems Security''']]<br> ...

==Security requirements of information systems== The objective of this category is to ensure that security is an integral part of the organization's information systems, and of the b ...