Using Reflex Disknet Pro to Aid Compliance with BS 7799 & ISO/IEC ...

From within the RDP administration management console a security profile can be
built to apply to a user, or more usually a group of users. By selecting “Profile
Templates” a range of policy decisions can be enforced. Fig. 1 above shows the
Removable Media Manager tab from within the profile template of a “standard user”
2. Physical and environmental security [7]
This section deals with unauthorised access, damage and interference to business
premises and information. RDP addresses issues raised under clause 7.2 Equipment
security.
2.1. Security of equipment off-premises [7.2.5 (a) & (c)]
The standard maintains that “regardless of ownership, the use of equipment outside
an organisation’s premises for information processing should be authorised by
management. The security provided should be equivalent to that for on-site
equipment used for the same purpose, taking into account the risks of working
outside of the organisation’s premises.”
RDP ensures that the last security profile template in force when that equipment
(PC/laptop) was last used inside the organisation’s premises, will apply to the
equipment when used outside of the premises. If the PC/laptop was never
connected to the network where a security profile template would be automatically
applied or had specifically imported onto it a security profile template, then the default
“lock-down” template would apply. In this way, controls can be applied to mobile
workers consistent with those controls that apply to members of the organisation’s
LAN.
This clause also raises the issue of media left unattended. The risk here is the
unauthorised access to information. It is essential that the information contained on
the local hard disk of the PC/laptop be protected, either by access control
mechanisms or encryption. Equally, the security of removable media needs to be
addressed, especially since modern portable storage devices can hold vast amounts
of data. The 2Gig memory stick is a reality.
RDP manages this risk by providing a centrally managed encryption system. Users
and groups can be automatically supplied with keys to encrypt and decrypt all
information stored on removable devices. Fig. 2 below shows the EPM (Encryption
Policy Manager) tab from within the profile template. Using the options on this tab, an
administrator can create a policy where all removable media is encrypted by default.
Segregation of information can also be achieved by dictating if the user can view
information written by another user.
The system also allows the off-line access to encrypted information via the input of
the users personal password, where desirable. This is achieved without the need to
install any additional software on the host machine.
© Reflex Magnetics Ltd 7