INTERNATIONAL ISO/IEC STANDARD 18028-1

f'ISO/IEC18028-1:2006(E)event, that have to be addressed. These aspects and requirements should be based on the importance of theconnections to the functioning of the business over time, and the projected adverse business impacts in theevent of a disruption. Whilst connectivity can afford many advantages to an organization, in the event of adisruption, in terms of flexibility and the ability to make use of creative approaches, they can also representpoints of vulnerability and "single points of failure", which could have major disruptive impacts on theorganization.14 Implement and Operate Security ControlsOnce the technical security architecture and the security controls have been identified, documented andagreed, the network security controls should be implemented. Before networking operations are permitted tocommence, the implementation should be reviewed, tested, and any identified security deficiencies dealt with(see also Clause 15 below). Then, once the security has been 'signed off', live operations should commence.Over time, and if significant change occurs, then further implementation reviews should be conducted (seealso Clause 15 below).15 Monitor and Review ImplementationAs reflected in Clause 14 above, the first implementation should be reviewed for compliance with thedocumented technical security architecture and required security controls specified in the followingdocuments:— technical security architecture,— networking security policy,— related SecOPs,— security gateway service access (security) policy,— business continuity plan(s),— where relevant, security conditions for connection.The compliance review should be completed prior to live operation. The review is complete when alldeficiencies have been identified, fixed, and signed off by senior management. Post live operation, ongoingmonitoring and review activities should also be conducted, particularly including prior to a major new releaserelated to significant changes in business needs, technology, security solutions, etc., and otherwise annually.It is emphasized that this should include the conduct of security testing to recognized standards, with asecurity testing strategy and related plans produced beforehand setting out exactly what tests are to beconducted, with what, where and when. Normally this should encompass a combination of vulnerabilityscanning and penetration testing. Prior to the commencement of any such testing, the testing plan should bechecked to ensure that the testing will be conducted in a manner fully compatible with relevant legislation andregulation. When carrying out this checking it should not be forgotten that a network may not just be confinedto one country - it may be distributed through different countries with different legislation. Following thetesting, the reports should indicate the specifics of the vulnerabilities encountered and the fixes required andin what priority, with an addendum confirming that all agreed fixes have been applied. Such reports should besigned off by senior management.58 © ISO/IEC 2006 - All rights reserved