IT Management & Cyber Security

  ISO 27001 Annex : A.15.2 Supplier Service Delivery Management  It’s objective  is to maintain, in compliance with supplier agreements, an agreed level of information security and delivery of service. A.15.2.1  Monitoring and Review of Supplier Services Control-  Organizations shall  monitor, review  and audit the provision of service to suppliers on a regular basis. Implementation Guidance –  Monitoring and review of  supplier services  will ensure respect for the terms and conditions of information security of the arrangement and careful monitoring of incidents and issues related to  information security . This will include a process of service management between the client and the supplier: Monitor the level of service performance to verify agreement compliance; Review the supplier’s service reports and schedule progress meetings on a regular basis as required by the agreements; conduct supplier audits and follow-up on reported ...

  In this article explain ISO 27001 Annex : A.14.2.3 Technical Review of Applications after Operating Platform Changes , A.14.2.4 Restrictions on Changes to Software Packages & A.14.2.5 Secure System Engineering Principles this controls. A.14.2.3  Technical Review of Applications after Operating Platform Changes Control-   In changing operating platforms, critical applications of business should be revised and tested to ensure no adverse impacts on business or security. Implementation Guidance –  The following points should be covered in the process: Review of application  control and processes  of integrity to ensure that changes to the operating platform have not compromised them; Ensure that operating platform changes are  communicated  at the right time to enable proper tests and reviews prior to implementation; Ensuring that the business continuity plans are properly amended. Other Information –  Operating environments are operating ...

  ISO 27001 Annex : A.14.2  Security in Development and Support Processes  It’s objective is  ensuring the creation and implementation of  information security  in the information system development process. A.14.2.1  Secure Development Policy Control-  Regulations for software and system development should be laid down and applied to organizational developments. Implementation Guidance –  Secure development includes a safe infrastructure, architecture, software, and system to be developed. The following considerations should be taken into account in a stable technology policy: Environmental development security; security guidelines for the life cycle of software development: security in the methodology for software development; Secure guidelines on code for each language of programming used; Design-phase protection requirements; Security control   points within the milestones of the project; secure repositories; Version control security...

In this article explain ISO 27001 Annex : A.13.2.3 Electronic Messaging & A.13.2.4 Confidentiality or Non-Disclosure Agreements . A.13.2.3  Electronic Messaging Control-  Electronic messaging information should be adequately protected. Implementation Guidance –   The following should include information security aspects for electronic messages: Protecting messages against unauthorized access, change or denial of services in line with the organization’s  classification  scheme; ensure that the message is correctly addressed and transported; Service reliability and availability; Legal considerations, such as electronic signature requirements; Approval before using external public authorities, such as instant messaging,  social networking  or sharing of files; Stronger standards of publicly accessible network authentication  access management . Other Information –  There are various kinds of messages, such as e-mail systems, an exchange of e...