Using Reflex Disknet Pro to Aid Compliance with BS 7799 & ISO/IEC ...

More documents

Recommendations

Info

Introduction Just like any other business asset information has a value, and consequently we should as organisations look at protecting that most valuable of assets. Having a recognised standard to work toward is both desirable and effective. Since compliance with a recognised standard will clearly identify to others that you have seriously considered the subject in question. The ISO (International Organisation for Standardisation) and the IEC (International Electrotechnical Commission) form the specialised system for worldwide standardisation. Numerous national bodies make up the membership of these organisations developing and publishing internationally recognised standards. Gaining accreditation of BS 7799 or ISO/IEC 17799:2000 is fast becoming the accepted minimal standard for Information Security. More and more companies are demanding that their suppliers and partners become compliant, thereby indicating that they have taken credible steps to implement information security. Why is information security required and what is causing so many organisations to sign-up to this standard? Confidentiality, integrity and availability of information are probably the main drivers, which are directly linked to competitive edge, cash-flow, profitability, legal compliance and not least commercial image. Executive Overview Since BS 7799 was converted into the international standard ISO/IEC 17799:2000 it has become almost a prerequisite when implementing information security. This standard or code of practice covers all aspects of IT including such elements as; Security Policy, Organisational Security, Physical and Environmental Security, Systems Development and Maintenance and Business Continuity Management. The standard is divided into twelve main sections, each section sub-divided to allow all aspects of this vast subject to be considered. For any organisation either looking to implement this standard or for those that have already attained accreditation and require to remain compliant, Reflex Disknet Pro offers a software solution that will enforce policy in six of the twelve main areas: • Asset classification and control • Physical and environmental security • Communications and operations management • Access control • Systems development and maintenance • Compliance Investment in information security and it’s formal acknowledgement via ISO 17799 accreditation is not to be taken lightly. Notwithstanding the benefits already described above, any product which is capable of offering support of this standard whilst in itself providing further benefits in enforcing policy and security in a uniformed and manageable way, is worthy of consideration. The remaining pages of this document illustrate how Reflex Disknet Pro delivers just that. © Reflex Magnetics Ltd 4
Meeting and Retaining the Standard What follows will be a description of various aspects of the standard complete with an explanation of how Reflex Disknet Pro (RDP) addresses this issue. Screen shots have been included for completeness, however it is not essential that the reader have a thorough knowledge of RDP. Reviewing this document will give the reader an understanding of how RDP can be used to achieve this compliance. RDP is a software product that is constructed around client>server architecture. The client element being installed on all PCs connected to the network. These PCs can be removed from the network, as in the case of a mobile user’s and still be part of the security shield that RDP provides. The server element communicates with the client and pushes security profiles onto the client PCs. It also receives information from the client with regard to audit information and security alerts. Management of this software is conducted through a Microsoft Management Console (MMC), which can either be sited on the server machine, or any other PC connected to the network. This software itself has been submitted for Common Criteria accreditation ( http://csrc.nist.gov/cc/ ). To aid reference with ISO/IEC 17799 each aspect discussed below will have the relevant numbering convention of that standard in brackets after the section heading. © Reflex Magnetics Ltd 5
Page 1 and 2: Using Reflex Disknet Pro to Aid Com
Page 3: 6.1. SOFTWARE COPYRIGHT [12.1.2.2]
Page 7 and 8: From within the RDP administration
Page 9 and 10: RDP through the use of it’s Progr
Page 11 and 12: that make use of the products zero
Page 13 and 14: 3.7. Disposal of media [8.6.2 (a)]
Page 15 and 16: 5.4. Change control procedures [10.

Using Reflex Disknet Pro to Aid Compliance with BS 7799 & ISO/IEC ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?