IT Management & Cyber Security

  Control-  ISO 27001 Annex : A.14.1.2 Securing Application Services on Public Networks  Information about application services which pass through public networks should be protected against fraudulent activities, contract disputes, unauthorized disclosure, and modification. Implementation Guidance –  Information security requirements will include the following for application services that cross public networks: Each party requires a level of trust in the identity claimed by each other, for example, through authentication; Authorizations  for those who may authorize the content of key transnational documents, issue or sign them; Ensure that  communication  parties are fully aware of their service provision or usage authorizations; Determination and compliance with the conditions of  confidentiality, integrity , proof that key documents and contracts, for instance, related to contracts and tendering process, have been dispatched and received; The ...

ISO 27001 : Annex 14 System Acquisition , Development and Maintenance in this article is explain  A.14.1  Security Requirements of Information Systems & A.14.1.1  Information Security Requirements Analysis and Specification . A.14.1  Security Requirements of Information Systems Its objective is ensuring the  information management  for the entire lifecycle is an important part of information systems. This also includes the information systems requirements that provide services over a public network. A.14.1.1  Information Security Requirements Analysis and Specification Control-   Information security  requirements for new information systems or enhancements to existing information systems should be included Implementation Guidance –  Information security needs should be defined using various approaches such as derivation of policy and regulation enforcement criteria, threat analysis, incident assessment, and the use of thresholds of...

In this article explain ISO 27001 Annex : A.13.2.3 Electronic Messaging & A.13.2.4 Confidentiality or Non-Disclosure Agreements . A.13.2.3  Electronic Messaging Control-  Electronic messaging information should be adequately protected. Implementation Guidance –   The following should include information security aspects for electronic messages: Protecting messages against unauthorized access, change or denial of services in line with the organization’s  classification  scheme; ensure that the message is correctly addressed and transported; Service reliability and availability; Legal considerations, such as electronic signature requirements; Approval before using external public authorities, such as instant messaging,  social networking  or sharing of files; Stronger standards of publicly accessible network authentication  access management . Other Information –  There are various kinds of messages, such as e-mail systems, an exchange of e...

ISO 27001 Annex : A.13.2  Information Transfer  Its objective  is to maintain the security of information transferred to any external entity and within the organization. A.13.2.1  Information Transfer Policies and Procedures Control-   In order to protect the transferees by using all types of communication facilities, official transfer policies, procedures and controls should be developed. Implementation guidance –  The following items should be addressed in the procedures and controls required to use communications facilities to transmit information: Procedures to prevent interception, copying, altering, misrouting or destruction of transmitted information; Procedures to detect and protect malware from electronic communications which can be transmitted; Procedures for the protection of communicated electronically sensitive information in the form of an attachment; Guidelines or rules specifying an appropriate usage of communication facilities ( refer to 8....