Using Reflex Disknet Pro to Aid Compliance with BS 7799 & ISO/IEC ...

For teleworkers who normally connect via a VPN to the organisations network, their
profile template will be delivered in the usual way. Dynamic updates to this profile
template can also be achieved as though the computer was connected locally.
5. Systems development and maintenance [10]
This clause deals with the security of the system itself, but not limited to the operating
system and those applications that run on it.
5.1. Policy on the use of cryptographic controls [10.3.1]
Where an organisation has developed a policy on the use of cryptographic controls
these will need to be managed.
RDP makes management of a cryptographic policy with regard to removable media
very simple. The most onerous part of implementing cryptography is the
management of crypto keys. RDP’s Encryption Policy Manager takes care of this
aspect automatically. Once the policy has been invoked, any user accessing
removable media will have a key pair produced for them without the need to ask.
Should the user be part of a larger group who need to be able to share information
stored on the removable media, group keys will also be added to facilitate this.
Additionally a management escrow key will also be used so that management can
access any data encrypted by the system.
Users are authenticated by their operating system logon (user ID and password). In
this way no further passwords are required by the system, unless the user has been
granted the ability to access stored information on an encrypted device off-line. In
this case the user will be prompted to choose and enter a password. Rules
concerning password quality are also set by EPM and are viewable by users.
All technical aspects of the encryption process such as algorithm used and key
length are hard coded by the system, using industry standards.
5.2. Security of system files [10.4]
Access to system files should be controlled. By maintaining system file integrity, a
degree of confidence can be assumed.
By implementing RDP’s Program Security Guard (PSG) all existing system
executable files are locked as “read only” and therefore can not be modified or
replaced by anyone but the designated system administrator.
5.3. Control of operational software [10.4.1 (a) (c)]
Controls should be in place to allow only nominated personnel the freedom to update
operational program libraries, and furthermore, executable code should not be
allowed on to an operational system until it has been tested and authorised.
PSG can be used to enforce this policy.
© Reflex Magnetics Ltd 14