IT Management & Cyber Security

ISO 27001 Annex : A.10 Cryptography in this article explaining Cryptographic controls, Policy on the Utilization of Cryptographic Controls & Key Management. A.10.1 Cryptographic controls Its objective is to  ensure the proper and efficient use of cryptography to protect the confidentiality, authenticity and/or integrity of the information. A.10.1.1 Policy on the Utilization of Cryptographic Controls Control-  A policy on the use of cryptographic controls to secure information should be developed and enforced. Implementation Guidance-  The following should be considered when designing a cryptographic policy: A management guide to the use of cryptographic controls across the organization, including the general principles by which business  information  should be protected; Based on the risk assessment, the necessary level of security should be calculated taking into account the type, strength, and quality of the encryption algorithm necessary...

ISO 27001 Annex : A.9.2.3 Management of Privileged Access Rights & A.9.2.4 Management of Secret Authentication Information of Users these two topic is explained in this article. A.9.2.3 Management of Privileged Access Rights Control-  A.9.2.3 Management of Privileged Access Rights The allocation and usage of exclusive access privileges will be limited and controlled. Implementation guidance-  A structured authorizing procedure in accordance with the appropriate access management  policies  should monitor the allocation and usage of delegated access privileges. Following steps should be taken into consideration: The privileges of access associated with each system or process, e.g. The operating system, the database management system and each application and the users to whom they need to be assigned should be identified; Preferential access privileges would be assigned to users on a need-to-use basis and on an event-to-event basis in accordance wit...