8 - Kuwait Oil Company

Security practices entail theidentification of an organization’sinformation system assets andthe development, documentationand implementation ofpolicies, standards, proceduresand guidelines that ensureconfidentiality, integrity andavailability of information systemresources.To ensure the security of aserver and the supporting overallserver infrastructure, KOC hasimplemented the followingpractices:Organizational InformationSystem Security PolicyA security policy should specifythe basic information systemsecurity tenets and rules anddefine their intended internalpurpose. The policy should alsooutline who in the organizationis responsible for particular areasof information security (e.g.,implementation, audit, review).The policy must be enforcedconsistently throughout theorganization to be effective.Configuration/Change Controland ManagementThe process of controllingmodifications to a system’sdesign, hardware, firmware andsoftware provides sufficientassurance that the system isprotected against the introductionof an improper modificationbefore, during and after systemimplementation. Configurationcontrol leads to consistency withthe organization’s informationsystem security policy.Risk Assessment andManagementRisk assessment is the processof analyzing and interpretingrisk. It involves determiningan assessment’s scope andmethodology, collecting andanalyzing risk-related data, andinterpreting the risk analysisresults. Collecting and analyzingrisk data requires identifyingassets, threats, vulnerabilities,safeguards, consequences and theprobability of a successful attack.Risk management is the processof selecting and implementingcontrols to reduce risk to a levelacceptable to the organization.Standardized ConfigurationsDevelop standardized secureconfigurations for widely usedoperating systems and serversoftware. This will providerecommendations on how toconfigure systems securelyand ensure consistencyand compliance with theorganizational security policy.Contingency, Continuityof Operations and DisasterRecovery PlanningContingency plans, continuityof operations plans and disasterrecovery plans are established inadvance to allow an organizationor facility to maintain operationsin the event of a disruption.End UsersEnd users should not have accessto data that is beyond what theyare authorized to view to completetheir jobs and duties. End usersshould especially be monitoredwhen they have access to sensitivedata and access should be revokedwhen they move to a differentdepartment in which such accessis not needed or required. In thiscase, the onus falls on the originaldepartment to inform IT to stop ordelete such access.End users should only haveaccess to the database through28 April-June 2012