INTERNATIONAL ISO/IEC STANDARD 18028-1

IS0/IEC18028-1:2006(E)13.3.6 Documented Security Conditions for Users of Network ServicesUsers authorized to work remotely should be issued with a documented 'security conditions for users ofnetwork services' document. This should describe user responsibilities for the hardware, software and data inrelation to the network, and its security.13.3.7 Incident ManagementInformation security incidents are more likely to occur, and more serious adverse business impacts to result,where there are network connections (as opposed to where there are none). Further, with networkconnections to other organizations in particular there could well be significant legal implications connectedwith incidents.Thus, an organization with network connections should have a well documented and implemented informationsecurity incident management scheme and related infrastructure in place to be able to respond quickly asincidents are identified, minimize their impact and learn the lessons to attempt to prevent re-occurrence. Thisscheme should be able to address both information security events (identified occurrences of a system,service or network state indicating a possible breach of information security policy or failure of safeguards, ora previously unknown situation that may be security relevant), and information security incidents (a single or aseries of unwanted or unexpected information security events that have a significant probability ofcompromising business operations and threatening information security).Further detail on information security incident management is provided in ISO/IEC 18044.13.4 Network Security Management13.4.1 PrefaceThe management of any network should be undertaken in a secure manner, and indeed provide support forthe overall management of network security. This should be accomplished with due consideration of thedifferent network protocols available and related security services.In furtherance of this, an organization should consider a number of controls, the majority of which can beidentified through using ISO/IEC 17799, and ISO/IEC 13335-2 when published. In addition, remote diagnosticports, whether virtual or physical, should be protected from unauthorized access.13.4.2 Networking AspectsThe various aspects of networking can be categorized as follows:Network Users - personnel who are users and /or administrators of networks. The spectrum of users rangesfrom individuals accessing remote resources via the Internet, dial-up or wireless connections, to individualsusing workstations or personal computers that are attached to a local network. Users connected to localnetworks may also be able to connect to remote resources via inter-network connections that may existbetween their local network and other networks. Such underlying connections may be transparent to the user,End-Systems - computers, workstations and mobile devices (for example, smartphones and PDAs) that areconnected to networks. This includes devices used to access networked facilities (e.g. client systems) anddevices used to provide services (e.g. servers, host computer systems). This category encompasses thehardware, operating system software, and any local applications software, including software used to accessthe network.Networked Applications - applications software, running on networked servers or host systems, and accessedvia computer network connections, to provide, for example:— financial transaction services,— enterprise software services (e.g. CRM, EIS, MRP, etc.),46 © ISO/IEC 2006 - All rights reserved