Using Reflex Disknet Pro to Aid Compliance with BS 7799 & ISO/IEC ...

More documents

Recommendations

Info

1. Asset classification and control [5] By identifying assets and nominating an owner who will have responsibility for that asset, it is possible to assign an appropriate level of control. 1.1. Inventory of assets – physical assets [5.1.1 (c)] Magnetic media and other removable storage devices can be accounted for using RDP by implementing the Removable Media Manager. This control mechanism identifies individual devices and will either allow or deny access to them dependant on the policy in force for that particular user. If the policy allows access to the device, there is a process of authorisation that must be undertaken. Fig. 1 All requests to access any removable memory device will first be checked against the policy in force. If access is possible, the device is checked for a unique RDP identifier. However, if this is not present the authorisation mode commences. This may include the scanning of the device with a third party anti-virus tool to check for known viruses and/or a scan of the device with RDP’s own content scanner. This content scanner is used to ensure that only data can be imported. It can be configured further to ban particular data file types, such as .MP3 for instance. © Reflex Magnetics Ltd 6
From within the RDP administration management console a security profile can be built to apply to a user, or more usually a group of users. By selecting “Profile Templates” a range of policy decisions can be enforced. Fig. 1 above shows the Removable Media Manager tab from within the profile template of a “standard user” 2. Physical and environmental security [7] This section deals with unauthorised access, damage and interference to business premises and information. RDP addresses issues raised under clause 7.2 Equipment security. 2.1. Security of equipment off-premises [7.2.5 (a) & (c)] The standard maintains that “regardless of ownership, the use of equipment outside an organisation’s premises for information processing should be authorised by management. The security provided should be equivalent to that for on-site equipment used for the same purpose, taking into account the risks of working outside of the organisation’s premises.” RDP ensures that the last security profile template in force when that equipment (PC/laptop) was last used inside the organisation’s premises, will apply to the equipment when used outside of the premises. If the PC/laptop was never connected to the network where a security profile template would be automatically applied or had specifically imported onto it a security profile template, then the default “lock-down” template would apply. In this way, controls can be applied to mobile workers consistent with those controls that apply to members of the organisation’s LAN. This clause also raises the issue of media left unattended. The risk here is the unauthorised access to information. It is essential that the information contained on the local hard disk of the PC/laptop be protected, either by access control mechanisms or encryption. Equally, the security of removable media needs to be addressed, especially since modern portable storage devices can hold vast amounts of data. The 2Gig memory stick is a reality. RDP manages this risk by providing a centrally managed encryption system. Users and groups can be automatically supplied with keys to encrypt and decrypt all information stored on removable devices. Fig. 2 below shows the EPM (Encryption Policy Manager) tab from within the profile template. Using the options on this tab, an administrator can create a policy where all removable media is encrypted by default. Segregation of information can also be achieved by dictating if the user can view information written by another user. The system also allows the off-line access to encrypted information via the input of the users personal password, where desirable. This is achieved without the need to install any additional software on the host machine. © Reflex Magnetics Ltd 7
Page 1 and 2: Using Reflex Disknet Pro to Aid Com
Page 3 and 4: 6.1. SOFTWARE COPYRIGHT [12.1.2.2]
Page 5: Meeting and Retaining the Standard
Page 9 and 10: RDP through the use of it’s Progr
Page 11 and 12: that make use of the products zero
Page 13 and 14: 3.7. Disposal of media [8.6.2 (a)]
Page 15 and 16: 5.4. Change control procedures [10.

Using Reflex Disknet Pro to Aid Compliance with BS 7799 & ISO/IEC ...

Create successful ePaper yourself

Delete template?

Save as template?