INTERNATIONAL ISO/IEC STANDARD 18028-1

ISO/IEC 18028-1:2006(E)The content of the networking security policy should usually include a summary of the results from the securityrisk assessment and management review (s) (which provide the justification for spend on controls), includingdetail of all security controls selected commensurate with the assessed risks (see Clause 12 above).13.3.3 Security Operating ProceduresIn support of the networking security policy, SecOPs documents should be developed and maintained,covering each network connection as appropriate. They should contain details of the day-to-day operatingprocedures associated with security, and who is responsible for their use and management.13.3.4 Security Compliance CheckingFor all network connections, security compliance checking should take place against a comprehensivechecklist constructed from the controls specified in the:— networking security policy— related SecOPs,— technical security architecture,— security gateway service access (security) policy,— business continuity plan(s),— where relevant, security conditions for connection.This should occur prior to live operation of any network connection, prior to a major new release (related tosignificant business or network related change), and otherwise annually.This should include the conduct of security testing to recognized standards, with a security testing strategyand related plans produced beforehand setting out exactly what tests are to be conducted, with what, whereand when. Normally this should encompass a combination of vulnerability scanning and penetration testing.Prior to the commencement of any such testing, the testing plan should be checked to ensure that the testingwill be conducted in a manner fully compatible with relevant legislation. When carrying out this checking itshould not be forgotten that a network may not just be confined to one country - it may be distributed throughdifferent countries with different legislation. Following the testing, the reports should indicate the specifics ofthe vulnerabilities encountered and the fixes required and in what priority.13.3.5 Security Conditions for ConnectionUnless security conditions for connection are in place and contractually agreed, an organization is in effectaccepting the risks associated with the other end of a network connection outside of its domain. Such risksmay include those related to privacy/data protection, where a connection may be used to exchange personaldata subject to national legislation at one or both ends, and, where the other end of a network connection(outside an organization's domain) is in another country, the legislation may be different.As an example, organization A may require that before organization B can be connected to its systems via anetwork connection, B should maintain and demonstrate a specified level of security for its system involved inthat connection. In this way A can be assured that B is managing its risks in a way that is acceptable. In suchcases A should produce a security conditions for connection document that details the controls to be presentat B's end. These should be implemented by B, followed by that organization signing a binding statement tothat effect and that security will be maintained. A would reserve the right to commission or conduct acompliance check on B.There will also be cases where organizations in a community mutually agree a 'security conditions forconnection' document which records obligations and responsibilities for all parties, including reciprocalcompliance checking.© ISO/I E C 2006 - All rig hts reserved 45