Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security...

99

Transcript of Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security...

Page 1: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

Katalog opat�ren��, ISO/IEC 27002

Dodatek p�redn �a�sky Anatomie inform. bezpe�c., ilustra�cn�� v �yklad

PV017 �Bezpe�cnost IT

Jan Staudek

http://www.�.muni.cz/usr/staudek/vyuka/} w���������� ������������ !"#$%&'()+,-./012345<yA|Verze : podzim 2017

Page 2: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

ISO/IEC 27002:2013

2 Information Security Management

X Information technology – Security techniques –Code of practice for information security management

X Informa�cn�� technologie { Bezpe�cnostn�� techniky {Soubor postup �u pro �r��zen�� informa�cn�� bezpe�cnosti

2 Struktura standardu

X Standard obsahuje celkem 11 z �akladn��ch odd��l �u,kter �e jsou d �ale rozd�eleny do 39 kategori�� bezpe�cnosti

X V ka�zd �e kategorii bezpe�cnosti se speci�kuje alespo �n jedno opat�ren��

X Mimo to jsou ve standardu uvedeny z �akladn�� informaceo procesech hodnocen�� a zvl �ad �an�� rizik.

X Odd��ly jsou �c��slovan �e po�rad��m kapitol standarduobsahuj��c��ch jejich popis (5 { 15)

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 1

Page 3: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

ISO/IEC 27002:2013, Odd��ly kategori�� bezpe�cnosti

Ka�zd �y z odd��l �u obsahuje jednu nebo v��ce kategori�� bezpe�cnosti

5) Bezpe�cnostn�� politika

6) Organizace bezpe�cnosti { intern�� organizace, extern�� subjekty

7) Klasi�kace a �r��zen�� aktiv { odpov�ednosti za aktiva, klasi�kace

8) Bezpe�cnost lidsk �ych zdroj �u { p�rijet�� do, pr �ub�eh, ukon�cen�� vztahu

9) Fyzick �a bezpe�cnost a bezpe�cnost prost�red��

10) �R��zen�� komunikac�� a �r��zen�� provozu { vybran �y ilustra�cn�� p�r��klad

11) �R��zen�� p�r��stupu { vybran �y ilustra�cn�� p�r��klad

12) N �akup, v �yvoj a �udr�zba informa�cn��ho syst �emu

13) Zvl �ad �an�� bezpe�cnostn��ch incident �u

14) �R��zen�� kontinuity �cinnost�� organizace

15) Soulad s po�zadavky { pr �ava, politik, smluv, . . . , audit

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 2

Page 4: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

ISO/IEC 27002:2013, Popis kategori�� bezpe�cnosti

2 Popis ka�zd �e z kategori�� bezpe�cnosti obsahuje:

X c��l opat�ren��, ur�cuj��c�� �ceho m�a b �yt dosa�zeno;

X popis jednoho nebo v��ce opat�ren��,kter �a lze pou�z��t k dosa�zen�� stanoven �eho c��le opat�ren��.

2 Popis opat�ren�� je strukturov �an n �asledovn�e:

X Opat�ren�� {

P�resn �a formulace konkr �etn��ho opat�ren��,kter �e vede k napln�en�� c��le opat�ren��.

X Doporu�cen�� k realizaci {

Podrobn�ej�s�� informace a doporu�cen�� na podporu implementacevybran �ych opat�ren��, kter �a vedou k dosa�zen�� c��le opat�ren��.

X Dal�s�� informace {

Dal�s�� informace, kter �e m�u�ze b �yt pot�rebn �e vz��t do �uvahy,ot �azky legislativy, odkazy na dal�s�� relevantn�� normy a p�redpisy, . . .

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 3

Page 5: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10. �R��zen�� komunikac�� a �r��zen�� provozu

Kategorie opat�ren�� spadaj��c�� do odd��lu 10:

2 10.1 Operational procedures and responsibilities

C��l: To ensure the correct and secure operation of informationprocessing facilities.

2 10.2 Third party service delivery management

C��l: To implement and maintain the appropriate level ofinformation security and service delivery in line with thirdparty service delivery agreements.

2 10.3 System planning and acceptance

C��l: To minimize the risk of systems failures.

2 10.4 Protection against malicious and mobile code

C��l: To protect the integrity of software and information.

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 4

Page 6: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10. �R��zen�� komunikac�� a �r��zen�� provozu

2 10.5 Back-up

C��l: To maintain the integrity and availability of informationand information processing facilities.

2 10.6 Network security management

C��l: To ensure the protection of information in networks andthe protection of the supporting infrastructure.

2 10.7 Media handling

C��l: To prevent unauthorized disclosure, modification, removalor destruction of assets, and interruption to business activities.

2 10.8 Exchange of information

C��l: To maintain the security of information and softwareexchanged within an organization and with any external entity.

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 5

Page 7: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10. �R��zen�� komunikac�� a �r��zen�� provozu

2 10.9 Electronic commerce services

C��l: To ensure the security of electronic commerce services,and their secure use.

2 10.10 Monitoring

C��l: To detect unauthorized information processing activities.

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 6

Page 8: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.1. Provozn�� procedury a odpov�ednosti

2 C��l { To ensure the correct and secure operation ofinformation processing facilities.

2 procedura ≡ pracovn�� postup

2 Relevantn�� skupiny opat�ren�� v kategorii 10.1 v odd��lu 10

X Dokumentace provozn��ch procedur

X Zm�enov �e �r��zen��

X Odd�elen�� odpov�ednost��

X Odd�elen�� v �yvoje, test �u a provoz �u

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 7

Page 9: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.1. Dokumentace provozn��ch procedur

2 C��l { Operating procedures shall be documented, maintained, andmade available to all users who need them

2 Provozn�� procedury mus�� vyhovovat po�zadavk �um syst �emu

spr �avy dokument �u organizace (principy viz ISO 9000)

X nutn �e je schv �alen�� relevantn��m veden��m organizace

2 Zve�rejn�en�� provozn��ch procedur

X pro zam�estnance { v intranetu

X pro partnersk �e t�ret�� strany { v extranetu

X po�zadavky: snadn �a �udr�zba, pohotov �a aktualizace

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 8

Page 10: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.1. Dokumentace provozn��ch procedur

2 Nezbytn �e provozn�� procedury pro ISMS identi�kuje

bezpe�cnostn�� politika

X z �aklad skladby provozn��ch procedur tvo�r�� ty procedury,kter �e implementuj�� politiku informa�cn�� bezpe�cnosti

X z �aklad lze doplnit detailn�ej�s��mi provozn��mi proceduramivypracovan �ymi na z �aklad�e doporu�cen�� poradce pro ITSec aodpov�edn �ych provozn��ch pracovn��k �u pro typov �e provozn�� oblasti

X nutn �e je jejich schv �alen�� relevantn��m veden��m organizace

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 9

Page 11: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.1. Oblasti pokr �yvan �e v ISMS provozn��mi procedurami

2 Zpracov �an�� informac�� a nakl �ad �an�� s informacemi

X v�c. po�zadavk �u na d �uv�ernost a klasi�kaci informac��

2 Z �alohov �an�� (detaily viz 10.5)

2 Pl �anov �an�� �cinnost��, (nap�r. z �alohov �an��)

X v�c. n �avaznost�� na jin �e syst �emy

X v�c. nejd�r��v�ej�s��ch a nejzaz�s��ch mo�zn �ych term��n �u proveden��(nap�r. pr �av�e z �alohov �an��)

2 Chybov �e �r��zen�� a �r��zen�� ve v �yjime�cn �ych podm��nk �ach

X v�c. instrukc�� pro omezen �e pou�z��v �an�� syst �emu

X v�c. n �avod �u pro nov �e (a nezku�sen �e) zam�estnance (1. reakce na incident)

X chybov �e �r��zen�� a �r��zen�� ve v �yjime�cn �ych podm��nk �ach je jinak p�redm�etem�cinnosti specialist �u s dostate�cn �ymi zku�senostmi a dovednostmi

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 10

Page 12: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.1. Oblasti pokr �yvan �e v ISMS provozn��mi procedurami

2 Kontaktov �an�� odpov��daj��c�� podp �urn �ych t �ym�u v p�r��pad�e

neo�cek �avan �ych provozn��ch nebo technick �ych obt���z�� a

dokumentov �an�� t �echto kontakt �u

2 Spr �ava speci �aln��ch v �ystup �u (tisk �u)

X v�c. reakc�� na selh �an�� v �ystup �u speci �aln��ch �uloh

2 Restart syst �emu a postupy po v �ypadku syst �emu

2 V�sechny hospod �a�rsk �e/udr�zbov �e �cinnosti

X start a vypnut�� po�c��ta�ce

X �udr�zba za�r��zen��

X vyu�z��v �an�� po�c��ta�cov �eho s �alu, . . .

X maj�� b �yt viditeln�e vystaven �e

X zam�estnanci maj�� b �yt �skolen�� na jejich pou�z��v �an��

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 11

Page 13: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.1. Dokumentace provozn��ch procedur, pozn �amky

2 Zbyte�cn�e detailn�� procedury / �r��dce aplikovateln �e procedury {

jakoby by nebyly �z �adn �e

2 P�ri outsourcov �an�� IT slu�zeb mus�� b �yt provozn�� procedury

vy�z �ad �any v kontraktu

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 12

Page 14: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.1. Zm�enov �e �r��zen��

2 C��l { Changes to information processing facilities and systems shallbe controlled.

2 �R��zen�� zm�en za�r��zen�� pro zpracov �an�� informac��,

opera�cn��ch syst �em�u a aplika�cn��ho software

2 Form�aln��, dokumentovan �e postupy

pro v�sechny zm�eny t�echto aktiv

2 Neadekv �atn�� �urove �n zm�enov �eho �r��zen�� {

X v �yrazn �a zranitelnost

X zdroj zbyte�cn �ych n �aklad �u

2 Inova�cn�� zm�ena mus�� b �yt vyvol �ana adekv �atn��mi d �uvody,

mus�� existovat krit �eria pro rozhodov �an�� o inovaci a

relevantn�� �casov �e pl �any postupu

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 13

Page 15: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.1. Zm�enov �e �r��zen��

2 procedura zm�enov �eho �r��zen�� OS a aplika�cn��ch syst �em�u {

typicky 1-str �ankov �y dokument pokr �yvaj��c��X identi�kci v �yznamu zm�eny z pohledu �cinnost�� organizace

(p�r��padn�e dopln�enou o posouzen�� p�r��nosu zm�eny)

X pl �an testov �an�� zm�eny a p�revzet�� zm�eny u�zivatelem

X posouzen�� mo�zn �ych (bezpe�cnostn��ch , . . . ) dopad �u,v�c. dopad �u na jin �y aplika�cn�� �ci provozn�� software a hardware

X form �aln�� odsouhlasen�� zm�eny

X sd�elen�� o zm�en�e v�sem relevantn��m osob �am

X postup pro zru�sen�� zm�eny a n �avrat do p �uvodn��ho stavu

2 Ka�zd �a zm�ena v s��ti by m�ela vyvolat p�rehodnocen�� hlavn��ch

rizik pro bezpe�cnost informac��

X a p�r��padn�e n �asledn �e zm�eny v prohl �a�sen�� o aplikovatelnosti

2 Mus�� se opravit v�sechny dokumenty z �avisl �e na m�en�en �em jevu

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 14

Page 16: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.1. Odd�elen�� povinnost�� (oblast�� odpov�ednosti)

2 C��l { Duties and areas of responsibility shall be segregated toreduce opportunities for unauthorized or unintentionalmodification or misuse of the organization’s assets.

2 Odd�elen�� �r��dic��ch a v �ykonn �ych povinnost�� sni�zuje mo�znosti

proveden�� neopr �avn�en �ych �uprav / zneu�zit�� informac�� /

slu�zeb.

X V mal �ych organizac��ch obt���zn�e dosa�ziteln �e

X v�zdy je nutn �e implementovat separaci v co mo�zn �a nejv�et�s��m rozsahu

X Odd�elen�� �r��zen��, monitoringu a auditu je neobejiteln �e,audit v�zdy mus�� b �yt nez �avisl �y

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 15

Page 17: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.1. Odd�elen�� povinnost�� (oblast�� odpov�ednosti)

2 C��lem je odd�elen�� iniciace ud �alosti od povolen�� jej��ho v �yskytu

2 prevence sp �ach �an�� podvodu bez mo�znosti detekce v oblasti

s jedinou odpov�ednost��, tj. odd�elen�� �cinnost��, kter �e {

X pro sp �ach �an�� podvodu vy�zaduj�� uzav�ren�� tajn �e dohody(nap�r. vystaven�� objedn �avky x potvrzen�� z��sk �an�� zbo�z��)

X pracuj�� s aktivy, kter �e posouzen�� rizik ozna�cilo jako podvodn�emanipulovateln �e a mus�� b �yt do manipulace s nimi zahrnuty alespo �ndva intern�� zam�estnanci (sn���zen�� pravd�epodobnosti konspiraces extern�� osobou)

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 16

Page 18: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.1. Odd�elen�� v �yvojov �ych, testovac�� a provozn��ch prost�red��

2 C��l { Development, test and operational facilities shall be separatedto reduce the risks of unauthorised access or changesto the operational system.

2 relevantn�� po�zadavek pro organizace s vlastn��m v �yvojov �ym

st�rediskem

X p�r��p. s v �yvojem zaji�st'ovan �ym outsourcingem

2 Mus�� b �yt dokumentovan �a pravidla pro p�renos software

z v �yvojov �eho do testovac��ho a

z testovac��ho do provozn��ho prost�red��

2 Jednotliv �a prost�red�� maj�� b �yt implementovan �a na r �uzn �ych

po�c��ta�c��ch / v r �uzn �ych dom�en �ach

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 17

Page 19: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.1. Odd�elen�� v �yvojov �ych, testovac�� a provozn��ch prost�red��

2 Jednotliv �a prost�red�� maj�� pracovat s r �uzn �ymi daty

X v �yvojov �e prost�red�� { um�el �a nebo scramblovan �a �ziv �a data

X testovac�� prost�red�� {

vzorek �ziv �ych dat za podm��nek shodn �ych s provozn��m prost�red��m

X s �ziv �ymi daty pouze v provozn��m prost�red��

2 Mus�� se pou�z��vat odli�sn �e autentiza�cn�� metody v jednotliv �ych

prost�red��ch

2 V �yvoj nesm�� m��t nikdy p�r��stup do provozn��ho prost�red��

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 18

Page 20: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.2. �R��zen�� dod �avek slu�zeb t�ret��ch stran

2 T�ret�� strana { jin �a entita ne�z entita p�r��mo zahrnut �a do

transakc��, �cinnost��, . . . , organizace

X Firma x zakaznıci x t�ret�� strana dod �avaj��c�� slu�zby �rm�e

2 C��l { To implement and maintain the appropriate level ofinformation security and service delivery in line with thirdparty service delivery agreements.

2 Relevantn�� oblasti opat�ren��

X Dod �avky slu�zeb

X Sledov �an�� a p�rezkoum�av �an�� poskytovan �ych dod �avek slu�zeb

X Zm�enov �e �r��zen�� ve slu�zb �ach t�ret��ch stran

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 19

Page 21: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.2. Dod �avky slu�zeb

2 C��l { It shall be ensured that the security controls, servicedefinitions and delivery levels included in the third partyservice delivery agreement are implemented, operated, andmaintained by the third party.

2 Smlouva o dod �avk �ach s t�ret�� stranou mus�� identi�kovat

v�sechna bezpe�cnostn�� opat�ren��, de�nice v�sech slu�zeb a

formy jejich poskytov �an��

2 Outsourcing m�u�ze po�zadovat z�r��zen�� �r��dic��ho t �ymu a

mechanism�u pro sledov �an�� v �ykonnosti

2 Mus�� se pe�cliv�e a detailn�e pl �anovat a dokumentovat p�red �an��

dat t�ret�� stran�e

X v�c. posouzen�� rizik je�st�e p�red uzav�ren��m kontraktu

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 20

Page 22: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.2. Dod �avky slu�zeb

2 Smlouva by m�ela obsahovat dolo�zku o mo�znosti po�zadovat

nav �y�sen�� s��ly bezpe�cnostn��ch opat�ren��

2 V�zdy je nutno v�enovat zvl �a�stn�� pozornost probl �em�um typu

X citliv �e nebo kritick �e aplikace, kter �e by mohly b �yt l �epe �re�seny in-houseX souhlas vlastn��k �u a dodavatel �u softwaru s outsourcingem procesuX dopady na pl �any zachov �an�� �cinnostiX bezpe�cnostn�� standardy, kter �e budou z �avazn �e pro t�ret�� strany,

a jak se m�a soulad s nimi m�e�ritX kter �e �cinnosti a individu �aln�� odpov�ednosti je t�reba sledovatX zvl �ad �an�� bezpe�cnostn��ch incident �u a

zabudov �an�� smluvn��ch procedur do politik organizace

2 D�uraz na smluvn�� z �avazky t�ret�� strany v oblasti bezpe�cnosti

X �r��zen�� p�r��stupu, spr �ava bezpe�cnosti podle dohodnut �ych standard �u, . . .

2 D�ukladn �a dokumentace

X agendy, z �apisy z porad, dodate�cn �e dohody, . . .

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 21

Page 23: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.2. Sledov �an�� a p�rezkoum�av �an�� poskytovan �ych dod �avek slu�zeb

2 C��l { The services, reports and records provided by the third partyshall be regularly monitored and reviewed, and audits shall becarried out regularly.

2 Za dod �avky slu�zeb mus�� b �yt n�ekdo (role/odd�elen��) odpov�edn �y

2 Mezi kl���cov �e odpov�ednosti pat�r��

X sledov �an�� v �ykonu { zaji�st'ov �an��, aby se skute�cn�e dosahovala smluvn���urovn�e slu�zeb, identi�kace nedostatk �u, a dohadov �an�� jak bynedostatky m�ely b �yt opraveny.

X p�rezkoum�av �an�� v�sech z �aznam�u o bezpe�cnostn��ch incidentech(v�cetn�e auditn��ch zpr �av), provozn��ch probl �emech, poruch �ach, z �avad �acha o �cemkoliv jin �em, co m�u�ze generovat riziko pro organizaci a zaji�st �en��,aby byla p�rijata p�r��slu�sn �a n �apravn �a opat�ren��.

To m�u�ze v �est k eskalaci smluvn��ch vztah �u dopln�en��m smluvn��chustanoven�� o mo�zn �em nav �y�sen�� pln�en�� a mana�zersk �y t �ym odpov�edn �yza smlouvu by m�el m��t dovednosti a zku�senosti pro �r��zen�� eskalace .

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 22

Page 24: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.2. Sledov �an�� a p�rezkoum�av �an�� poskytovan �ych dod �avek slu�zeb

2 �Z �adn �y prostor pro nejasnosti { v�se mus�� b �yt dokumentovan �e

2 Mus�� ex. mo�znost p�rezkoum�avat u t�ret�� strany procesy

zm�enov �eho �r��zen��, z �aznamen �av �an�� incident �u a reakc�� na n�e,

identi�kace zranitelnost�� a uplat �nov �an�� opat�ren��

2 Odpov�ednost za zpracov �an�� dat m�a objedn �avaj��c�� strana,

odpov�ednost nelze smlouvou p�rev �ezt na t�ret�� stranu

X m�a-li organizace vyhov�et datov�e orientovan �e legislativ�e,mus�� b �yt adekv �atn�� procesy a syst �emy i u t�ret�� strany

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 23

Page 25: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.2. Zm�enov �e �r��zen�� ve slu�zb �ach t�ret��ch stran

2 C��l { Changes to the provision of services, including maintainingand improving existing information security policies,procedures and controls, shall be managed, taking accountof the criticality of business systems and processes involved andre-assessment of risks.

2 Spr �ava zm�enov �eho �r��zen�� zaji�st'ovan �eho u t�ret�� strany mus��

b �yt �r �adn�e zakotveno ve smlouv�e o outsourcingu

X jedn �a se o mezi-organiza�cn�� procesy

X musej�� b �yt odsouhlaseny oboustrann�e

2 Jedn �a se o v�sechny zm�eny maj��c�� dopad na inf. bezpe�cnost

X mus�� se prov �est posouzen�� rizik n �asledovan �e identi�kac�� aimplementac�� relevantn��ch opat�ren��

2 Zm�enu m�u�ze iniciovat i t�ret�� strana

(podle pravidel ve smlouv�e)

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 24

Page 26: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.3. Pl �anov �an�� a p�rej��m �an�� syst �em�u

2 C��l { To minimize the risk of systems failures.

2 Relevantn�� oblasti opat�ren��

X Spr �ava kapacit

X P�rej��m �an�� syst �em�u

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 25

Page 27: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.3. Spr �ava kapacit

2 C��l { The use of resources shall be monitored, tuned, andprojections made of future capacity requirements to ensure therequired system performance.

2 Organizace m�a sledovat po�zadavky na kapacity a progn �ozovat

jejich v �yvoj

X souborov �e / dom�enov �e servery, tisk �arny, komunika�cn�� spoje, . . .

X zv �y�sen�� aktivit si vy�z �ad �a zv�et�sen�� t �ymu,bude pot�reba v��ce osobn��ch po�c��ta�c �u, . . .

X n �ar �ust webov �ych aktivit p�ri e-komerci

2 Nedostate�cn �e kapacity jsou zdroje bezpe�cnostn��ch incident �u

typu DoS (Denial of Services)

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 26

Page 28: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.3. P�rej��m �an�� syst �em�u

2 C��l { Acceptance criteria for new information systems, upgrades,and new versions shall be established and suitable testsof the system(s) carried out during development andprior to acceptance.

2 Organizace m�a stanovit p�rej��mac�� krit �eria pro nov �e syst �emy,

vylep�sen�� syst �em�u, pro jejich nov �e verze

X p�ri p�rej��m �an�� mus�� prob�ehnout relevantn�� testy

2 P�rej��mac�� krit �eria mus�� b �yt stru�cn �a, jasn �a,

(smluvn�e) odsouhlasen �a a dokumentovan �a

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 27

Page 29: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.3. P�rej��m �an�� syst �em�u

2 P�rej��m �an�� nov �e verze syst �emu vy�zaduje prov �est kontroly

spln�en�� po�zadavk �u dan �ych �cinnost�� organizace na:X na v �ykony po�c��ta�c �u a kapacity

X revize / vytvo�ren�� nov �ych program�u pro obnovu po poruch �ach a restart

X p�repracov �an�� a otestov �an�� rutinn��ch provozn��ch procedur

X implementaci nov �ych bezpe�cnostn��ch opat�ren�� po znovu proveden �emposouzen�� rizik

X vypracov �an�� nov �ych manu �al �u a dokumentovan �ych provozn��ch procedur

X inovaci pl �anu zachov �an�� kontinuity �cinnosti organizace

X pod �an�� d �ukaz �u, �ze nov �e syst �emu nemaj�� nep�r��zniv �y vliv na b�e�z��c��existuj��c�� syst �emy

X pod �an�� d �ukaz �u posouzen��m rizik jak �y m�a dopad nov �y syst �em nacelkovou bezpe�cnost organizace

X za�skolen�� u�zivatel �u na nov �y syst �em a posouzen�� dopadu nauplat �novan �e pracovn�� praktiky

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 28

Page 30: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.3. P�rej��m �an�� syst �em�u

2 M�a se provozovat nov �y syst �em po jistou dobu soub�e�zn�e

s p �uvodn��m syst �emem ?

2 Zvl �a�stn�� pozornost je pot�reba v�enovat p�rej��mac��m krit �eri��m

pro nov �e komunika�cn�� syst �emy

2 Posouzen�� rizik m�u�ze vy�z �adat proveden�� test �u, veri�kac�� a

certi�kac�� nez �avislou t�ret�� stranou

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 29

Page 31: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.4. Ochrana proti �skodliv �ym a mobiln��m program�um

2 C��l { To protect the integrity of software and information.2 Relevantn�� oblasti opat�ren��

X Opat�ren�� proti �skodliv �ym program�um

‘Malware’ is a term that denotes software designed for somemalicious purpose.programy, kter �e na po�c��ta�ci b�e�z�� bez v�edom�� u�zivatele a n�ejak �ymzp �usobem jej po�skozuj��, nebo zhor�suj�� jeho funkci { viry, �cervi,Troj�st�� kon�e, . . . , spyware

X Opat�ren�� proti mobiln��m program�um

‘program that can execute on remote locations with anymodification in the code. [It] can travel and execute from onemachine to another on a network during its lifetime’ { softwaretransferred between systems, e.g. transferred across a networkor via a USB flash drive, and executed on a local systemwithout explicit installation or execution by the recipientActiveX, Java, JavaScript, VBScript, MS Word macros, PostScript, . . .

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 30

Page 32: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.4. Opat�ren�� proti �skodliv �ym program�um

2 C��l { Detection, prevention, and recovery controls to protectagainst malicious code and appropriate user awarenessprocedures shall be implemented.

X ISMS m�a obsahovat politiku a procedury po�zaduj��c�� vyhov�en��softwarov �ym licenc��m a zakazuj��c�� pou�z��vat neutorizovan �y software

X ISMS m�a obsahovat politiku a procedury chr �an��c�� organizaci protiimportu �skodliv �eho software { z �akaz p�r��m �eho p�r��stupu u�zivateli naextern�� disky, CD-ROM, USB pam�eti apod. Data z nich m�u�ze zav �ad�etpouze IT t �ym po kontrole.

X V s��ti organizace m�a b �yt instalovan �y aktualizovan �y,,anti-malware software"

X Bez prodlen�� instalovat opravy (z �aplaty) zve�rejn�en �e v �yrobcemlicencovan �eho software ao v�sech instalac�� z �aplat v �est auditn�� z �aznamy (kdy, kdo, co instaloval)

X Pravideln�e p�rezkoum�avat software a data na v�sech po�c��ta�c��chorganizace a odhalovat a odstra �novat neautorizovan �e programy / data

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 31

Page 33: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.4. Opat�ren�� proti �skodliv �ym program�um

X V�sechny soubory z extern��ch zdroj �u kontrolovat na v �yskyt�skodliv �eho software

X V�sechny p�r��lohy e-mail �u kontrolovat na �rewallu na v �yskyt�skodliv �eho software

X Zam�estnance pro�skolovat v rozpozn �av �an�� potenci �aln�e napaden �yche-mail �u �skodliv �ym software

X Ustanoven�� odpov�ednosti za b�eh ochran proti �skodliv �emu software,detekce incident �u a odtra �nov �an�� d �usledk �u �cinnosti �skodliv �ehosoftware se m�a �re�sit dokumentovan �ymi procedurami

X M�a existovat BCP pro obnovu po �utoku �skodliv �ym software

X Bezpe�cnostn�� mana�ze�ri maj�� m��t p�r��stup ke vhodn �ym a d�uv�eryhodn �ymzdroj �um aktu �aln��ch informac�� o �skodliv �em software

X Maj�� b �yt instalov �any opat�ren�� proti spyware

X Zam�estnanci maj�� b �yt �skolen�� jak z �achazet s webovsk �ymi uzlynapadnut �ymi �skodliv �ym software

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 32

Page 34: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.4. Opat�ren�� proti mobiln��m program�um

2 C��l { Where the use of mobile code is authorized, the configurationshall ensure that the authorized mobile code operatesaccording to clearly defined security policy, and unauthorizedmobile code shall be prevented from executing.

X trivi �aln�� �re�sen�� { politikou zak �azat instalaci a na �rewallu blokovatsoftware obsahuj��c�� mobiln�� k �od

X blokov �an�� lze omezit na vybran �e podez�rel �e uzly

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 33

Page 35: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.5. Z �alohov �an��

2 C��l: To maintain the integrity and availability of information andinformation processing facilities.

2 Relevantn�� oblasti opat�ren��

X Z �alohov �an�� informac��

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 34

Page 36: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.5.Z �alohov �an�� informac��

2 C��l { Back-up copies of information and software shall be taken andtested regularly in accordance with the agreed backup policy.

X Ide �al { v�sechny informace organizace uchov �avat na serverechorganizace a servery pravideln�e (automaticky) z �alohovat

X Povinnost z �alohovat data z p�renosn �ych za�r��zen��ch na serverechorganizace m�a b �yt sou�c �ast�� inici �aln��ho bezpe�cnostn��ho �skolen��zam�estnance

X politika z �alohov �an�� mus�� pokr �yvat v�sechna potenci �aln�� m��staobsahuj��c�� citliv �a data organizace

X z �alohovat je pot�reba data origin �aln�e uchov �avan �a nejen v elektronick �e,ale i v pap��rov �e form�e

X mus�� se ur�cit metody a frekvence z �alohov �an��

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 35

Page 37: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.5.Z �alohov �an�� informac��

X z �alohovan �e informace spole�cn�e s �upln �ymi a p�resn �ymi z �aznamy o tomco je z �alohov �ano a dokumentace procedur obnovy se m�a uchov �avat vevzd �alen �e lokalit �e

X z �aloh �an�� lze �re�sit kontraktem s t�ret�� stranou

X z �alohovac�� cyklus m�a implementovat 3-genera�cn�� postup aplikovan �yna m�es���cn��, t �ydenn�� a denn�� z �alohy:

{ syn: ka�zd �y den v t �ydnu samostatn�e, p�repis ka�zd �y t �yden

{ otec: ka�zd �y t �yden v m�es��c��, p�repis ka�zd �y m�es��c

{ d�ede�cek: ka�zd �y m�es��c v roce, p�repis ka�zd �y rok

X na z �alohy se mus�� aplikovat stejn �a bezpe�cnostn�� opat�ren�� jako naorigin �aln�� data, p�r��padn�e je nav��c utajovat �sifrov �an��m

X z �alohovac�� m �edia je pot�reba pravideln�e testovat na zpracovatelnost

X pravideln�e se maj�� testovat v�sechny obnovovac�� procedurydokumentovan �e v ISMS a v �ysledky test �u se maj�� uchov �avatv dokumentaci BCP

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 36

Page 38: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.5.Z �alohov �an�� informac��

X z �alohov �an�� m �a b �yt p�redm�etem pravideln �eho p�rezkoum�av �an��managementem

X Kritick �e aplikace maj�� b �yt provozovan �e na serverechimplementovan �ych na technologii RAID (ide �aln�e RAID 5)

X m�a b �yt stanovena doba uchov �av �an�� z �aloh podle omezen�� dan �ychpo�zadavkem vyhov�en�� legislativ�e, smluvn��m z �avazk �u a byznys modelu

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 37

Page 39: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.6. S��t'ov �a bezpe�cnost

2 C��l: To ensure the protection of information in networks andthe protection of the supporting infrastructure.

2 Relevantn�� oblasti opat�ren��

X S��t'ov �a opat�ren��{ Internet acceptable use policy, AUP

X Bezpe�cnost s��t'ov �ych slu�zeb

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 38

Page 40: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.6. S��t'ov �a opat�ren��

2 C��l { Networks shall be adequately managed and controlled, inorder to be protected from threats, and to maintain securityfor the systems and applications using the network, includinginformation in transit.

X odpov�ednost za provoz s��t �e �re�sit odd�elen�e od administrace po�c��ta�c �u{ viz Odd�elen��/Odd�elen�� povinnost��

X jednozna�cn�e de�novat odpov�ednosti a procedury spr �avy vzd �alen �ychza�r��zen�� v�c. oblast�� vzd �alen �ych u�zivatel �u

X speci �aln�� opat�ren�� se mus�� p�rijato pro ochranu dat p�ren �a�sen �ychbezdr �atov �ymi a ve�rejn �ymi s��t �emi

X v cel �e s��ti mus�� b �yt mus�� b �yt konzistentn�e aplikovan �a opat�ren��de�novan�� v ISMS

X mus�� b �yt dokumentovan �a architektura cel �e s��t �e v�c. detail �ukon�gura�cn��ch nastaven�� a speci�kace v�sech softwarov �ych ahardwarov �ych komponent

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 39

Page 41: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.6. Internet acceptable use policy, AUP

2 Mus�� b �yt v p��semn �e form�e

2 Mus�� b �yt srozumiteln�e sd�elena v�sem zam�estnanc �um

2 Nastavuje povolen �e pou�z��v �an�� jak Internetu, tak i e-mailu,

m �a kombinovat prohl �a�sen�� o pou�z��v �an�� Internetu a

vyu�z��v �an�� e-mailu

2 Speci�lkuje, kter �e pou�z��v �an�� Internetu je zak �azano {

nap�r. stahov �an�� nep�r��stojn �ych dokument �u, pornogra�e a

nez �akonn �ych materi �al �u

2 Sd�eluje, co se monitoruje

2 De�nuje p�rijateln �e on-line chov �an��

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 40

Page 42: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.6. Internet acceptable use policy, AUP

2 Ud�av �a z �ak �azan �e on-line oblasti {

nap�r. pornogra�ck �e / rasistick �e servery

2 Nastavuje pravidla zachov �an�� soukrom�� ve vztahu k ostatn��m

u�zivatel �um p�ri respektov �an�� pr �ava zam�estnavatele

sledovat aktivity zam�estnanc �u

2 Sd�eluje co jsou pravd�epodobn �e disciplin �arn�� d �usledky

poru�sen�� pravidel AUP

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 41

Page 43: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.6. Internet acceptable use policy, AUP

2 �Uvod AUP tvo�r�� souhrnn �e prohl �a�sen��

X M�elo by za�c��t s p�ripomenut��m hrozeb Internetu a �r��ci,�ze organizace nebude odpov�edn �a za jak �ekoli sta�zen �e �ci prohl���zen �emateri �aly. D �ale se m�a sd�elit, �ze pou�z��v �an�� Internetu mus�� b �ytv souladu se standardy pln�en�� �cinnost�� organizace a je sou�c �ast��pracovn��ch povinnost�� zam�estnance.

X Jak �ekoli poru�sen�� AUP m�u�ze v �estk disciplin �arn��mu �r��zen�� a p�r��p. i k ukon�cen�� zam�estn �an��.

X Nez �akonn �e �cinnosti mohou b �yt ozn �ameny p�r��slu�sn �ym org �an �um.

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 42

Page 44: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.6. Internet acceptable use policy, AUP

2 Generick �e body obsahu AUP

X U�zivatelsk �e ID organizace, weby a e-mailov �e �u�cty lze pou�z��vat pouzepro komunikaci schv �alenou organizac��

X Pou�zit�� internetu/intranetu/e-mailu/konverza�cn��ch syst �em�u m�u�ze b �ytp�redm�etem sledov �an�� a u�zivatel �e mohou b �yt p�ri pou�z��v �an��t �echto zdroj �u omezov �ani.

X Distribuce informac�� prost�rednictv��m Internetu(v�cetn�e e-mailu a jin �ych po�c��ta�ci podporovan �ych syst �em�u)m�u�ze b �yt organizac�� kontrolov �ana a organizace si rezervuje pr �avostanovit vhodnosti informace.

X Pou�z��v �an�� po�c��ta�cov �ych prost�redk �u organizace podl �eh �a pr �avu azneu�zit�� bude adekv �atn�e potrest �ano.

X U�zivatel �e nesm�� nav�st�evovat internetov �e str �anky, kter �e obsahuj��vulg �arn��, nen �avistn �e nebo ne�z �adouc�� materi �aly a nesm�� obch �azetopat�ren�� omezuj��c�� prohl���zen�� a na Internet nesm�� u�cinit nebovystavit neslu�sn �e pozn �amky, n �avrhy nebo materi �aly.

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 43

Page 45: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.6. Internet acceptable use policy, AUP

X U�zivatel �e nesm�� rozes��lat e-maily, kter �e nesouvis�� s �cinnost�� organizacenebo pro sv �uj osobn�� prosp�ech, nesm�� odes��lat nebo p�rij��mat jak �ykoliobsc �enn�� �ci hanliv �y materi �al nebo materi �al ur�cen �y k obt�e�zov �an�� nebok zastra�sov �an�� jin �e osoby a nesm�� p�redkl �adat sv �e osobn�� n �azory jakon �azory organizace.

X U�zivatel �e nesm�� ukl �adat, stahovat nebo jinak p�ren �a�set komer�cn��software a/nebo autorsky chr �an�en �y materi �al, pat�r��c�� organizaci nebokter �ekoliv jin �e t�ret�� stran�e

X U�zivatel nesm�� ani odhalit ani zve�rejnit d �uv�ern �e informace(uvede se klasi�ka�cn�� �urove �n) a nesm�� odeslat d �uv�ern �e e-maiybez za�sifrov �an�� na �urovni vy�zadovan �e politikou ISMS.

X U�zivatel �e se nesm�� pokou�set obch �azet politiku prevence uplatn�en���skodliv �eho software a mus�� zachov �avat v�sechny odpov��daj��c�� politikyorganizace,

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 44

Page 46: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.6. Internet acceptable use policy, AUP

X U�zivatel z �am�ern�e nezasahuje do norm�aln�� �cinnosti s��t �e a ani ne�cin���z �adn �e kroky, kter �e by ostatn��m br �anily ve vyu�z��v �an�� s��t �e a nesm��bez explicitn��ho povolen�� zkoumat, m�enit nebo pou�z��vat souboryjin �ych osob nebo jak �ekoli jin �e informa�cn�� aktivum

X U�zivatel �e nesm�� vykon �avat jak �ekoliv jin �e nevhodn �e aktivity,kter �e v jist �ych �casov �ych intervalech ozna�cuje organizace,a nesm�� mrhat �casem neo i jin �ymi zdroji na �cinnosti nesouvisej��c��s �cinnostmi organizace. Mysl�� se t��m stahov �an�� ze server �u soci �aln��chs��t��, servery, objemy dat n �aro�cn �e na �s���rku p �asma, jako jsou nap�r��kladvidea a hudebn�� soubory MP3, sd��len�� digit �aln��ch fotogra��� atd.

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 45

Page 47: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.6. Bezpe�cnost s��t'ov �ych slu�zeb

2 C��l { Security features, service levels, and managementrequirements of all network services shall be identified andincluded in any network services agreement, whether theseservices are provided in-house or outsourced.

2 S��t'ov �e slu�zby m�u�ze poskytovat organizace intern�e nebo

outsourcingem

2 P�r��klady {

application service providers (ASP),

Internet service providers (ISPs),

serverov �e farmy,

slu�zby poskytuj��c�� dedikovan �e informace, . . .

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 46

Page 48: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.6. Bezpe�cnost s��t'ov �ych slu�zeb

2 Je nutn �e identi�kovat a dokumentovat bezpe�cnostn��

charakteristiky s��t'ov �ych slu�zeb

X bezpe�cnostn�� technologie (�sifrov �an��, autentizace,typ sit'ov �eho spojen��, . . . )

X technick �e parametry pro bezpe�cn �e spojen�� s poskytovatelem slu�zby

X procedury pro omezen�� p�r��stupu ke slu�zb �am, existuj��-li

X opat�ren�� vztahuj��c�� se k �udaj �um uchopv �avan �ym v syst �emu(nap�r. osobn�� data)

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 47

Page 49: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.7. Spr �ava m�edi��

2 C��l: To prevent unauthorized disclosure, modification, removal ordestruction of assets, and interruption to business activities.

2 Relevantn�� oblasti opat�ren��

X Spr �ava v �ym�enn �ych m�edi��

X Skladov �ani m �edi��

X Procedury pro manipulac�� s informacemi

X Bezpe�cnost syst �emov �e dokumentace

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 48

Page 50: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.7. Spr �ava v �ym�enn �ych m�edi��

2 C��l { There shall be procedures in place for the managementof removable media.

2 p �asky, disky, kazety, ti�st �en �e zpr �avy

2 ochrana p�red zni�cen��m, kr �ade�z��, neautorizovan �ym p�r��stupem

X manipulaci s USB pam�etmi apod. mus�� de�novat bezpe�cnostn�� politika

X m�edium odstra �novan �e z organizace mus�� b �yt vymaz �ano, pln�e,ne pouze co je vid�et v adres �a�ri

X vyn �a�sen�� m �edia mimo budovu m�a b �yt explicitn�e povolov �ano adokumentov �ano, pravideln �e vyn �a�sen�� (z �alohy) m�a �r��dit procedura

X skladov �an�� m �edi�� mus�� vyhovovat pravidl �um stanoven �ych v �yrobcem

X je nutno respektovat dobu �zivotnosti stanovenou v �yrobcem

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 49

Page 51: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.7. Skladov �ani m �edi��

2 C��l { Media shall be disposed of securely and safely whenno longer required, using formal procedures.

2 ISMS mus�� obsahovat procedury zaji�st'uj��c�� bezpe�cn �e

skladov �an�� m �edi�� obsahuj��c��ch

X listinn �e dokumenty

X hlasov �e a videoz �aznamy

X kop��r �aky

X v �ystupn�� zpr �avy

X tisk �arensk �e p �asky

X USB pam�eti

X CD ROM

X listingy program�u, testovac�� data, dokumentace syst �emu, . . .

2 nutn �e jsou procedury skartace a likvidace

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 50

Page 52: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.7. Procedury pro manipulac�� s informacemi

2 C��l { Procedures for the handling and storage of information shallbe established to protect this information from unauthorizeddisclosure or misuse.

2 procedury mus�� pokr �yvat

X p�revoz m�edi��

X �r��zen�� p�r��stupu

X ur�cen�� autorizovan �eho p�r��jemce dat na b �azi klasi�kace dat

X zaji�st �en�� kompletnosti vstupn��ch dat, zpracov �an��, validace v �ystup �u

X zach �azen�� s m �ediu podle speci�kace v �yrobcem

X distribuci dat vyhovuj��c�� klasi�ka�cn��m sch �emat �um

X pravideln �e p�rezkoum�av �avn�� distribu�cn��ch a autoriza�cn��ch seznam�uzda obsahuj�� aktu �aln�� c��le

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 51

Page 53: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.7. Bezpe�cnost syst �emov �e dokumentace

2 C��l { System documentation shall be protected againstunauthorized access.

X ochrana p�red neautorizovan �ym p�r��stupem

X nejde o ve�rejn�e dostupn �e manu �aly, . . .

X jde o vnit�rn�� dokumentaci organizace popisuj��c�� syst �emy, procesy,struktury dat, autoriza�cn�� procesy, . . .

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 52

Page 54: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.8. V �ym�ena informac��

2 C��l: To maintain the security of information and softwareexchanged within an organization and with any external entity.

2 Relevantn�� oblasti opat�ren��

X Politiky a procedury p�ri v �ym�en�e informac��

X Dohody o v �ym�en�e informac�� a program�u

X Fyzick �a m �edia p�ri p�reprav�e

X Elektronick �e zas��l �an�� zpr �av

X Aplika�cn�� informa�cn�� syst �emy organizace

2 E-mail t �em�e�r zcela nahradil d �alnopis a zjevn�e brzo nahrad�� fax

a tradi�cn�� po�stu.

X E-mail se od b�e�zn �e po�sty odli�suje { m�a vysokou rychlost, jinoustrukturu zpr �av, n��zkou form�alnost, vykazuje mo�znost chybn �ehodoru�cen��, kop��rov �an��, snadn �eho zachycen�� a mo�znost p�renosu p�r��loh.

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 53

Page 55: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.8. Politiky a procedury p�ri v �ym�en�e informac��

2 C��l { Formal exchange policies, procedures, and controls shall bein place to protect the exchange of information through the useof all types of communication facilities.

2 V �ym�ena informac�� formami

X komunika�cn�� linky, e-mail, hlas, fax, video, . . .

2 Opat�ren�� mus�� zaji�st'ovat ochranu proti neautorizovan �emu

X zachycov �an��, kop��rov �an��, modi�kov �an��, p�resm�erov �av �an��, ru�sen��, . . .informac��

2 Pou�zit �e mechanismy

X Vodoznaky, �sifrov �an��, . . . pro zaji�st �en�� d �uv�ernosti, integrity,autenticity, . . .

2 Nutnost respektovat klasi�ka�cn�� sch �ema,

legislativn�� omezen��, . . .

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 54

Page 56: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.8. Politiky a procedury p�ri v �ym�en�e informac��

2 Mus�� se p�rijmout politika ochrany proti �skodliv �emu software

a mus�� se implementovat relevantn�� opat�ren��

2 Citliv �e dokumenty se nesm�� tisknout / ponech �avat ve ve�rejn�e

dostupn �ych tisk �arn �ach / faxech, mus�� b �yt zas��lan �e na

dedikovan �a za�r��zen��

2 Je pot�reba srozumiteln�e identi�kovat hrozbu komunikace

v bezdr �atov �em prost�red�� a do prohl �a�sen��

o aplikovatelnosti d �at adekv �atn�� politiku a opat�ren��

2 Pou�zit�� telefon �u a mobil �u z m��st, kter �a nejsou bezpe�cn �a, nesm��

vyzradit d �uv�ernou informaci (ve�rejn �e prostory, kancel �a�re

s tenk �ymi st�enami, are �al konkurenta, p�repln�en �y vlak . . . )

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 55

Page 57: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.8. Politiky a procedury p�ri v �ym�en�e informac��

2 Nepou�z��vat pro d �uv�ernou v �ym�enu informac�� za�r��zen��, kter �a

lze snadno kompromitovat (telefon v are �alu konkurenta)

nebo jsou automaticky nahr �avan �a (banky, . . . )

2 D�uv�ernou informaci nesd�elovat do hlasov �e schr �anky nebo

pomoc�� SMS

2 E-mail lze snadno chybn�e nasm�erovat,

p�red odesl �an��m se mus�� pe�cliv�e ov�e�rit v�sichni adres �ati

2 D�uv�ern �e informace se nesm�� pos��lat faxem

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 56

Page 58: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.8. Dohody o v �ym�en�e informac�� a program�u

2 C��l { Agreements shall be established for the exchangeof information and software betweenthe organization andexternal parties.

2 Smlouva mus�� speci�kovat bezpe�cnostn�� podm��nky v �ym�en

dan �e sch �ematem klasi�kace informac��

2 Zaveden�� v �ym�en m�u�ze si vy�z �adat proveden�� ohodnocen�� rizik

2 Mus�� se identi�kovat na obou stran �ach kdo je odpov�edn �y za

�r��zen��, oznamov �an��, zahajov �an�� a p�rij��m �an�� v �ym�en

2 Mus�� se de�novat procedury sd�eluj��c�� druh �e stran�e odesl �an�� /

p�rijet�� citliv �e informace a opat�ren�� zaji�st'uj��c��

sledovatelnost a nepopiratelnost

2 Mus�� se ur�cit technick �e standardy pro balen�� a p�renos

informac��

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 57

Page 59: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.8. Dohody o v �ym�en�e informac�� a program�u

2 Mus�� se ur�cit kur �yrn�� identi�ka�cn�� procedury

2 Mus�� se ur�cit odpov�ednosti a ru�cen�� za ztr �atu informac�� nebo

bezpe�cnostn�� incidenty

2 Mus�� se dohodnout syst �em ozna�cov �an��, kter �y zajist��, �ze se

bezprost�redn�e zjist�� a poskytnou odpov��daj��c�� ochrany.

M�el by b �yt shodn �y se syst �emem pou�z��van �ym v organizaci

intern�e.

2 Mus�� ur�cit odpov�ednost za vlastnictv�� informac�� a software,

ochrany dat, autorsk �a pr �ava apod.

2 Maj�� se ur�cit technick �e standardy pro z �apis / �cten�� informac��

2 Mus�� se de�novat speci�ck �a opat�ren�� (nap�r. kryptogra�ck �a),

kter �a mohou b �yt pot�rebn �a pro konkr �etn�� citliv �e informace

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 58

Page 60: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.8. Fyzick �a m �edia p�ri p�reprav�e

2 C��l { Media containing information shall be protected againstunauthorized access, misuse or corruption duringtransportationbeyond an organization’s physical boundaries.

2 Nej�cast�eji se p�repravuj�� CD-ROMy a p �asky

2 Po�sta a ob�casn �a kur �yrn�� slu�zba nejsou bezpe�cn �e p�repravn��

syst �emy

2 Je nutn �e p�rijmout opat�ren�� typu

X �sifrov �an��, pokud m�edium obsahuje citliv �e / osobn�� data

X udr�zovat seznam spolehliv �ych, d �uv�eryhodn �ych kur �yrn��ch slu�zeb,p�r��padn�e pou�z��vat smluvn�e v �azanou kur �yrn�� slu�zbu jako slu�zbuposkytovanou t�ret�� stranou

X Balen�� hardware mus�� respektovat po�zadavky jeho v �yrobce

X P�r��padn�e pou�z��vat fyzick �a opat�ren�� (zamykateln �e kontejnery, . . . )

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 59

Page 61: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.8. Elektronick �e zas��l �an�� zpr �av

2 C��l { Information involved in electronic messaging shall beappropriately protected.

2 Politika bezpe�cn �eho pou�z��v �an�� e-mailu

2 Generick �a rizika e-mailu

X zranitelnost neautorizovan �ym p�r��stupem,neautorizovanou modi�kac�� a �utoky typu DoS

X zranitelnost nespr �avn �ym adresov �an��m, chybn �ym sm�erov �an��ma nespolehlivost�� Internetu

X legislativn�� probl �emy { nejsou dostupn �e d �ukazy p �uvodu, odesl �an�� ap�r��jmu

X neovladatelnost vzd �alen �eho u�zivatele

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 60

Page 62: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.8. Elektronick �e zas��l �an�� zpr �av

2 Politika bezpe�cn �eho pou�z��v �an�� e-mailu by m�ela zajistitX Odpov�ednost zam�estnance nekomprmitovat organizaci zakazuj��c��

pou�zit�� e-mail �u spole�cnosti pro zas��l �an�� hanliv �ych mail �u nebo proobt�e�zov �an��, pro neopr �avn�en �e n �akupy nebo publikov �an�� n �azor �una dodavatele, partnery �ci z �akazn��ky z organizace.

X E-mail by se nem�el pou�z��vat pro komunikaci citliv �e informace s jistouklasi�kac��

X P�r��lohy e-mail �u by m�el b �yt vhodn�e chr �an�eny,(p�r��padn�e) pomoc�� kryptogra�ck �ych kontrol n�ejak �eho typu

X Jak reagovat na viry a podvod zavirovanou zpr �avou

X Velikost schr �anky s p�r��choz�� po�stou mus�� b �yt zaji�st �ena procedurou

X Bez konkr �etn��ho p�redchoz��ho povolen�� nelze pou�z��vat e-mailpro n �akup jm �enem organizace. Pokud lze, pak jen v souladu s aktu �aln��politikou organizace pro n �akupu.

X Firemn�� e-mailov �a adresa nesm�� b �yt pou�zita pro osobn�� n �akupynebo jin �e osobn�� transakce.

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 61

Page 63: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.8. Aplika�cn�� informa�cn�� syst �emy organizace

2 C��l { Policies and procedures shall be developed and implementedto protect information associated with the interconnectionof business information systems.

2 Sou�casn �e distribuovan �e syst �emy dramaticky zvy�suj��

elektronickou komunikaci mezi zam�estnanci a mo�znost

sd��len�� informaci

X F2F komunikace je vrozen�e bezpe�cn�ej�s��

2 Doporu�cen �a opat�ren��

X Jasn�e de�novan �a politika sd��len�� informac�� respektuj��c�� sch �ema

X Jestli�ze nelze zajistit adekv �atn�� ochranu proti p�r��stupu zven�c��organizace, pak chr �an�enou informaci nelze publikovat navnitroorganiza�cn��ch n �ast�enk �ach

X Opat�ren�� zaji�st'uj��c�� bezpe�cnou komunikaci via rizikov �y Internet��

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 62

Page 64: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.8. Aplika�cn�� informa�cn�� syst �emy organizace

X Osobn�� kalend �a�re akc�� zve�rej �novat pouze spolupracovn��k �um naprojektu, . . .

X Pro ka�zd �y aplika�cn�� informa�cn�� syst �em by m�ela b �yt stanovenapo�zadovan �a v �y�se z �aruky za bezpe�cnost a jej�� dosa�zen�� prok �azat evaluac��

X ISMS po�zaduje identi�kovat kategorie zam�estnanc �u a smluvn��chpartner �u s povolen �ym p�r��stupem k syst �em�u a lokality,odkud lze syst �emy zp�r��stup �novat

X ISMS po�zaduje ur�cit p�r��stupov �a pr �ava k aplika�cn��m syst �em�umjednotlivc �um, na z �aklad�e jejich rol�� v organiza�cn��m sch �ematu

X E-mail mus�� rozli�sovat mezi intern��mi a extern��mi adresami,aby u�zivatel �e mohli omezit cirkulaci informac��

X Mus�� b �yt zavedena politka z �alohov �an�� a obnov

X Mus�� b �yt zavedena politika �cinnosti organizace v nouzov �em re�zimu

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 63

Page 65: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.9. Elektronick �e obchodov �an��

2 C��l: To ensure the security of electronic commerce services,and their secure use.

2 Relevantn�� oblasti opat�ren��

X Elektronick �e obchodov �an��

X On-line transakce

X Ve�rejn�e dostupn �e informace

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 64

Page 66: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.9. Elektronick �e obchodov �an��

2 C��l { Information involved in electronic commerce passing overpublic networks shall be protected from fraudulent activity,contract dispute, and unauthorized disclosureand modification.

2 Hlavn�� probl �em elektronick �eho obchodov �an�� {

nepopiratelnost

X nepopiratelnost p �uvodu { jistota pro p�rij��mac�� stranu, �ze odes��latel

nen�� podvodn��k

X nepopiratelnost odesl �an�� { d �ukaz, �ze v jist �em �case v�ec byla odesl �ana

X nepopiratelnost p�rijet�� { d �ukaz, �ze p�rij��mac�� strana skute�cn�e zz��skala

odeslanou v�ec, druhosledov�e kdy a kde

2 Ochrana Web server �u p�red �utoky

2 Ochrana komunikac�� { SSL, IPSec, PKIX, S/MIME, . . .

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 65

Page 67: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.9. Elektronick �e obchodov �an��

2 Opat�ren�� mus�� zajistit, �ze obchodov �an�� p�res ve�rejn �e s��t �e

je chr �an�en �e p�red

podvody, smluvn��mi rozep�remi, neautorizovan �ym

zp�r��stupn�en��m a modi�kac�� d �uv�ern �ych dat

2 Mezi stranami se mus�� dohodnout (p�r��klad pro B2B)

X Autentizace { pos��len�� d �uv�ery mezi z �akazn��kem a obchodn��kem

X Autorizace { strany mus�� v�ed�et �ze smluvn�� vztahy byly domluvenys autorizovanou rol��

X Prodejn�� procesy { s nepopiratelnost��, d �uv�ernost��, integritou,d �ukazy odesl �an�� a p�r��jmu dokument �u

X Jak d �uv�ern �e jsou domluvy o slev �ach

X Jak �a je d �uv�ernost chr �an�en �ych transak�cn��ch detail �u(platba, detaily dod �avky, . . . )

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 66

Page 68: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.9. Elektronick �e obchodov �an��

X Co se mus�� ov�e�rovat na platebn��ch informac��ch

X Nejbezpe�cn�ej�s�� metodu plateb a jak se bude �re�sit podvods pad�elanou platebn�� kartou

X Jak se zabr �an�� duplikac��m a ztr �at �am transakc��

X Kdo nese odpov�ednost za �skody podvodn �ymi transakcemi ajak se �re�s�� poji�st �en��

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 67

Page 69: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.9. On-line transakce

2 C��l { Information involved in on-line transactions shall beprotected to prevent incomplete transmission, mis-routing,unauthorized message alteration, unauthorized disclosure,unauthorized message duplication or replay.

2 Vhodn �a opat�ren��

X Elektronick �e podpisov �an�� { vesm�es pro B2B, �casto nepraktick �e pro C2B

X Zaji�st �en�� d �uv�ernosti transakc�� (pomoc�� SSL),zaji�st �en�� ochrany osobn��ch dat

X Pln �e �sifrov �an�� komunikac��

X Bezpe�cnost mus�� b �yt �re�sena v koncov �ych syst �emech

X Mus�� se respektovat legislativn�� omezen��

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 68

Page 70: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.9. Ve�rejn�e dostupn �e informace

2 C��l { The integrity of information being made available ona publicly available system shall be protected to preventunauthorized modification.

2 Typy opat�ren��

X Informace publikovan �a na webu m�a b �yt odsouhlasen �a p�redem

X Informace z��sk �avan �a z ve�rejn �ych web�u od lid�� sm�� b �yt shroma�zd'ov �anav souladu s omezen��mi dan �ymi legislativou

X Webovsk �e aplikace mus�� �ltrovat u�zivateli dod �avan �a data (viz OWASP)

X Citliv �a data mus�� b �yt p�ri z��sk �av �an�� a ukl �ad �an�� adekv �atn�e chr �an�ena(platebn�� informace z karet apod. { SSL, 3D-Secure, . . . )

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 69

Page 71: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.10. Sledov �an��, monitorov �an��

2 C��l: To detect unauthorized information processing activities.

2 Relevantn�� oblasti opat�ren��

X Po�rizov �an�� auditn��ch z �aznam�u

X Monitorov �an�� pou�z��v �an�� syst �emu

X Ochrana auditn��ch z �aznam�u

X Administr �atorsk �y a oper �atorsk �y den��k

X Den��ky selh �an��

X Synchronizace �casu

2 Detekce odchylek u�cink �u p�rijat �ych opat�ren��

X odchylek od politiky �r��zen�� p�r��stupu

X detekce opakovan �eho zneu�z��v �an��, . . .

2 Z��sk �av �an�� d �ukaz �u pro n �asledn �e �re�sen�� bezpe�cnostn��ch

incident �u a podklad �u pro kontrolu efektivnosti p�rijat �ych

opat�ren��

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 70

Page 72: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.10. Po�rizov �an�� auditn��ch z �aznam�u

2 C��l { Audit logs recording user activities, exceptions, andinformation security events shall be produced and kept foran agreed periodto assist in future investigations andaccess control monitoring.

2 Z �aznamy o v �yjimk �ach ud �alostech souvisej��c��ch s informa�cn��

bezpe�cnost��

2 Mus�� se uchov �avat po stanovenou dobu

X zdroj informac�� o tom co funguje �spatn�e

2 Za veden�� odpov��d �a CISO,

co se sleduje obvykle stanovuje �r��dic�� v �ybor ITSec

2 Sb��rat se mus�� nutn �e informace, ne ,,v�sechny"informace

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 71

||||||||||||||||||||||||

Page 73: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.10. Po�rizov �an�� auditn��ch z �aznam�u

2 Typicky sledovan �e informace, p�r��klady

X ID u�zivatele, doba p�rihl �a�sen�� / odhl �a�sen��

X �usp�e�sn �e a ne �usp�e�sn �e p�r��stupy u�zivatel �u k aktiv �um

X zm�eny v kon�guraci syst �emu

X pou�zit�� aplikac��

X aktivace / deaktivace ochran (anti-vir)

X ve�sker �a naru�sen�� pravidel bezope�cnostn�� politiky

X upozorn�en�� z �rewal �u a syst �em�u detekce pr �unik �u, . . .

2 Auditn�� den��k mus�� b �yt siln�e p�r��stupov�e chr �an�en �y,

slou�z�� mj. pro odhalen�� neautorizovan �ych p�r��stup �u

X jeho veden�� by m�elo zaji�st'ovat Odd�elen�� intern��ho auditu

X IT administr �ato�ri nemaj�� m��t k den��ku p�r��stup a nesm�ej�� m��t mo�znostvyp��nat sv �e sledov �an��

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 72

Page 74: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.10. Monitorov �an�� pou�z��v �an�� syst �emu

2 C��l { Procedures for monitoring use of information processingfacilities shall be established and the results of the monitoringactivities reviewed regularly.

2 organizace mus�� m��t zavedeny procedury pro sledov �an��

zpracov �an�� informac��

2 z �aznamy ze sledov �an�� se mus�� pravideln�e zkoumat

X frekvenci zkoum�an�� ur�c�� v �ysledek posouzen�� rizik

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 73

Page 75: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.10. Ochrana auditn��ch z �aznam�u

2 C��l { Logging facilities and log information shall be protectedagainst tampering and unauthorized access.

2 Je nutn �a striktn�� autorizace modi�ka�cn��ch p�r��stupov �ych pr �av

2 Z �aznamy lze pou�z��vat jako d �ukazy p�ri soudn��ch sporech

2 Objemy zaznamen �avan �ych informac�� b �yvaj�� obrovsk �e

X je nutn �e stanovit politiku bezpe�cn �e archivace z �aznam�u

X ide �aln�� �re�sen�� { datov �e trezory

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 74

Page 76: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.10. Administr �atorsk �y a oper �atorsk �y den��k

2 C��l { System administrator and system operator activitiesshall be logged.

2 P�r��klady zaznamen �avan �ych ud �alost��

X spu�st�en�� a zastaven�� �cinnosti, kdo tak u�cinil

X popis akce (zahrnut �e procesy, soubory, . . . )

X chyby syst �emu (co, kdy) a opravn �e akce

X v�se co souvis�� se z �alohov �an��m a obnovou

X jm �eno osoby u�cinv�s�� z �aznam

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 75

Page 77: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.10. Den��ky selh �an��

2 C��l { Faults shall be logged, analyzed, andappropriate action taken.

2 O selh �an��ch maj�� b �yt vedeny z �aznamy, tyto maj�� b �yt

analyzovan �e a z �avady maj�� b �yt odstra �novan �e

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 76

Page 78: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

10.10. Synchronizace �casu

2 C��l { The clocks of all relevant information processing systemswithin an organization or security domain shall besynchronized with an agreed accurate time source.

X Nap�r. zkoum�an�� z �aznam�u o bezpe�cnostn��ch incidentech vy�zadujeinformaci o �case v �yskyt �u ud �alost��

2 Hodiny ve v�sech po�c��ta�c��ch maj�� b �yt synchronizovan �e bud'to

s UCT (Universal Coordinated Time) nebos lok �aln��m standardn��m �casem

X dopad driftu hodin v po�c��ta�c��ch, . . .

2 Maj�� se pou�z��vat standardizovan �e form�aty vyj �ad�ren�� �casu

X nerespektov �an�� letn��ho �casu m�u�ze m��t negativn�� dopad na zkoum�an��auditn��ch z �aznam�u, . . .

X chybn �a interpretace �casu br �an�� zkoum�an�� ud �alost��,p�r��prav�e d �ukaz �u, . . .

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 77

Page 79: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

11. �R��zen�� p�r��stupu { vybran �y ilustra�cn�� p�r��klad odd��lu

2 Odd��l 11. �R��zen�� p�r��stupu obsahuje 7 kategori�� bezpe�cnosti

X 11.1 Po�zadavky na �r��zen�� p�r��stupu { vybran �y ilustra�cn�� p�r��kladkategorie bezpe�cnosti

X 11.2 �R��zen�� p�r��stupu u�zivatel �u

X 11.3 Odpov�ednosti u�zivatel �u

X 11.4 �R��zen�� p�r��stupu k s��ti

X 11.5 �R��zen�� p�r��stupu k opera�cn��mu syst �emu

X 11.6 �R��zen�� p�r��stupu k aplikac��m a informac��m

X 11.7 Mobiln�� v �ypo�cetn�� za�r��zen�� a pr �ace na d �alku

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 78

Page 80: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

11.1 Po�zadavky na �r��zen�� p�r��stupu

2 C��l { �R��dit p�r��stup k informac��m

X P�r��stup k informac��m, prost�redk �um pro zpracov �an�� informac�� aproces �um organizace by m�el b �yt �r��zen na z �aklad�eprovozn��ch a bezpe�cnostn��ch po�zadavk �u organizace

X M�ela by b �yt zohledn�ena pravidla organizace pro �s���ren�� informac�� apravidla, podle nich�z prob��h �a schvalov �an��.

2 V �y�cet opat�ren��

X 11.1.1 Politika �r��zen�� p�r��stupu

X Tato kategorie zav �ad�� jedin �e opat�ren�� { politiku �r��zen�� p�r��stupu

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 79

Page 81: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

11.1.1 Politika �r��zen�� p�r��stupu

2 Opat�ren��

X M�ela by b �yt vytvo�rena, zdokumentov �ana a v z �avislosti na aktu �aln��chbezpe�cnostn��ch po�zadavc��ch p�rezkoum�av �ana politika �r��zen�� p�r��stupu

2 Doporu�cen�� k realizaci

X P�r��stupov �a pravidla a opr �avn�en�� by m�ela b �yt jasn�e stanovenapro ka�zd �eho u�zivatele nebo skupinu u�zivatel �uv seznamu pravidel p�r��stupu.

X Pravidla by m�ela pokr �yvat jak logick �y, tak fyzick �y p�r��stup,oba typy p�r��stup �u by m�ely b �yt �re�seny sou�casn�e.

X U�zivatel �um a poskytovatel �um slu�zeb by m�elo b �yt p�red �ano jasn �evyj �ad�ren�� o provozn��ch po�zadavc��ch, kter �e napl �nuje �r��zen�� p�r��stupu.

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 80

Page 82: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

11.1.1 Politika �r��zen�� p�r��stupu

2 Doporu�cen�� k realizaci (pokra�c.) {

Politika �r��zen�� p�r��stupu by m�ela br �at v �uvahu n �asleduj��c�� hlediska:

X bezpe�cnostn�� po�zadavky jednotliv �ych aplikac�� organizace

X identi�kace v�sech informac�� ve vztahu k jednotliv �ym aplikac��m arizika, kter �ym jsou informace vystaveny

X pravidla pro �s���ren�� informac�� a pravidla schvalov �an��,tj. princip pot�reby zn �at, bezpe�cnostn�� �urovn�e a klasi�kaci informac��

X konzistence p�r��stupov �ych pravidel a klasi�kace informac��pro r �uzn �e syst �emy a s��t �e

X odpov��daj��c�� legislativu a ostatn�� smluvn�� z �avazky ve vztahuk ochran�e p�r��stupu k dat �um nebo slu�zb �am

X standardn�� p�r��stupov �e pro�ly u�zivatel �u pro b�e�zn �e kategorie �cinnost��

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 81

Page 83: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

11.1.1 Politika �r��zen�� p�r��stupu

X �r��zen�� pravidel p�r��stupu v distribuovan �em a s��t'ov �em prost�red��rozezn �avaj��c��m v�sechny mo�zn �e typy p�ripojen��

X odd�elen�� jednotliv �ych rol�� pro �r��zen�� p�r��stupu, nap�r. vy�rizov �an��po�zadavk �u na p�r��stup, schvalov �an�� p�r��stupu, spr �ava p�r��stup �u

X po�zadavky na form�aln�� schv �alen�� �z �adost�� o p�r��stup

X po�zadavky na pravideln �e p�rezkoum�av �an�� p�r��stupov �ych pr �av

X podm��nky a postupy pro odebr �an�� p�r��stupov �ych pr �av

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 82

Page 84: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

11.1.1 Politika �r��zen�� p�r��stupu

2 Dal�s�� informace

X rozli�sovat mezi pravidly, kter �a mus�� b �yt v platnosti v�zdy, a t�emi,kter �a jsou nepovinn �a nebo podm��n�en �a

X stanovit pravidla na z �aklad�e principu,,V�sechno, co nen�� v �yslovn�e povoleno, je zak �az �ano\,ne na z �aklad�e m�ek�c��ho pravidla,,V�sechno, co nen�� v �yslovn�e zak �az �ano, je povoleno\

X zohled �novat zm�eny ve ozna�cov �an�� informac��, kter �e jsou vyvol �anyautomaticky prost�redky pro zpracov �an�� informac��, a zm�eny,kter �e jsou vyvol �any z rozhodnut�� u�zivatele

X zohled �novat zm�eny u�zivatelsk �ych opr �avn�en��,kter �e jsou vyvol �any automaticky prost�redky pro zpracov �an�� informac��,a ty, kter �e jsou vyvol �any administr �atorem

X rozli�sovat pravidla, kter �a vy�zaduj�� schv �alen�� administr �atoremnebo jinou pov�e�renou osobou, a ta, kter �a toto nevy�zaduj��.

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 83

Page 85: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

11.1.1 Politika �r��zen�� p�r��stupu

X Pravidla pro �r��zen�� p�r��stupu by m�ela b �yt podporov �ana zaveden��mform�aln��ch postup �u a jasn�e ur�cen �ych odpov�ednost��

X U�zivatel �e maj�� zn �at c��le �cinnosti organizace,kter �e politika p�r��stupu dosahuje

X Opat�ren�� mohou b �yt jak fyzick �eho, tak i logick �eho typu

X U�zivatel �e maj�� b �yt �skolen�� na pravidla a politiku �r��zen�� p�r��stupu

X Rozd��ln �e aplika�cn�� �cinnosti organizace m��vaj�� rozd��ln �e po�zadavky nabezpe�cnost { kdo m�a nebo nem�a m��t p�r��stup k syst �emu uk �a�zeohodnocen�� rizik

X Vhodn �y je princip ,,need-to-know"

{ Nap�r. referentka zad �avaj��c�� objedn �avku platebn��mu syst �emu nemus��m��t pr �avo p�r��kazce operace proveden�� platby

X Mus�� se respektovt syst �em klasi�kace informac��

{ Po�zadavek konzistence klasi�ka�cn��ch sch �emat a �r��zen�� p�r��stupu ar �uzn �ych s��t��ch t �e�ze organizace

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 84

Page 86: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

11.1.1 Politika �r��zen�� p�r��stupu

X Mus�� se zohled �novat relevantn�� legislativa

X Pro zaveden �e kategorie pracovn��ch funkc�� maj�� b �yt de�novan �estandardizovan �e pro�ly u�zivatelsk �ych p�r��stup �u

X V distribuovan �ych syst �emech je nutn �e �re�sit p�r��stupov �a pr �avajak p�ri lok �aln��m p�r��stupu, tak i vzd �alen �em p�r��stupem jednohoa t �eho�z u�zivatele

X Vhodn �e je dodr�zovat princip separace odpov�ednost��

{ V dostate�cn�e velk �ych organizac��ch v�zdy odd�elit role odpov�edn �e zapln�en�� p�r��stupov �ych po�zadavk �u, za jejich autorizaci a za jejichnastaven��

X Pravideln�e p�rezkoum�avat opat�ren�� �r��dic�� p�r��stupy,p�r��stupy je nutn �e pr �ub�e�zn�e monitorovat

X Ru�sit p�r��stupov �a pr �ava p�ri v �ypov�edi

X N�ekter �a pravidla politiky �r��zen�� p�r��stupu mohou b �yt prosazovan �atrvale, jin �a voliteln�e, p�r��p. podm��ne�cn�e nebo pouze v jist �ych situac��ch

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 85

Page 87: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

11.1.1 Politika �r��zen�� p�r��stupu

X Mus�� b �yt stanovena p�r��stupov �a pr �ava k proveden�� zm�env klasi�kaci informaci, v pravidlech �r��zen�� p�r��stupu,v u�zivatelsk �ych p�r��stupov �ych pro�lech, . . .

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 86

Page 88: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

Skladba opat�ren�� ostatn��ch kategori�� �r��zen�� p�r��stupu

2 11.2 �R��zen�� p�r��stupu u�zivatel �u

X C��l: Zajistit opr �avn�en �y p�r��stup u�zivatel �u a p�redch �azet neopr �avn�en �emup�r��stupu k informa�cn��m syst �em�um.

X Registrace u�zivatele

X �R��zen�� privilegovan �eho p�r��stupu

X Spr �ava u�zivatelsk �ych hesel

X P�rezkoum�an�� p�r��stupov �ych pr �av u�zivatel �u

2 11.3 Odpov�ednosti u�zivatel �u

X C��l: P�redch �azet neopr �avn�en �emu u�zivatelsk �emu p�r��stupu, vyzrazen��nebo kr �ade�zi informac�� a prost�redk �u pro zpracov �an�� informac��.

X Pou�z��v �an�� hesel

X Neobsluhovan �a u�zivatelsk �a za�r��zen��

X Z �asada pr �azdn �eho stolu a pr �azdn �e obrazovky monitoru

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 87

Page 89: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

Skladba opat�ren�� ostatn��ch kategori�� �r��zen�� p�r��stupu

2 11.4 �R��zen�� p�r��stupu k s��ti

X C��l: P�redch �azet neautorizovan �emu p�r��stupu k s��t'ov �ym slu�zb �am.

X Politika u�z��v �an�� s��t'ov �ych slu�zeb

X Autentizace u�zivatele pro extern�� p�ripojen��

X Identi�kace za�r��zen�� v s��t��ch

X Ochrana port �u pro vzd �alenou diagnostiku a kon�guraci

X Princip odd�elen�� v s��t��ch

X �R��zen�� s��t'ov �ych spojen��

X �R��zen�� sm�erov �an�� s��t �e

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 88

Page 90: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

Skladba opat�ren�� ostatn��ch kategori�� �r��zen�� p�r��stupu

2 11.5 �R��zen�� p�r��stupu k opera�cn��mu syst �emu

X C��l: P�redch �azet neautorizovan �emu p�r��stupu k opera�cn��m syst �em�um.

X Bezpe�cn �e postupy p�rihl �a�sen��

X Identi�kace a autentizace u�zivatel �u

X Syst �em spr �avy hesel

X Pou�zit�� syst �emov �ych n �astroj �u

X �Casov �e omezen�� relace

X �Casov �e omezen�� spojen��

2 11.6 �R��zen�� p�r��stupu k aplikac��m a informac��m

X C��l: P�redch �azet neopr �avn�en �emu p�r��stupu k informac��m ulo�zen �ymv po�c��ta�cov �ych syst �emech.

X Omezen�� p�r��stupu k informac��m

X Odd�elen�� citliv �ych syst �em�u

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 89

Page 91: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

Skladba opat�ren�� ostatn��ch kategori�� �r��zen�� p�r��stupu

2 11.7 Mobiln�� v �ypo�cetn�� za�r��zen�� a pr �ace na d �alku

X C��l: Zajistit bezpe�cnost informac�� p�ri pou�zit�� mobiln��v �ypo�cetn�� techniky a za�r��zen�� pro pr �aci na d �alku.

X Mobiln�� v �ypo�cetn�� za�r��zen�� a sd�elovac�� technika

X Pr �ace na d �alku

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 90

Page 92: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

Ilustrativn�� rozpis kategorie 11.4, �R��zen�� p�r��stupu k s��ti

2 C��l: P�redch �azet neautorizovan �emu p�r��stupu k s��t'ov �ym slu�zb �am.

2 Relevantn�� oblasti opat�ren��

X Politika pou�z��v �an�� s��t'ov �ych slu�zeb

X Autentizace u�zivatel �u pro extern�� p�ripojen��

X Identi�kace za�r��zen�� v s��ti

X Ochrana port �u pro vzd �alenou diagnostiku a kon�guraci

X Princip odd�elen�� v s��t��ch

X �R��zen�� s��t'ov �ych spojen��

X �R��zen�� sm�erov �an�� v s��ti

2 Typov �a zabezpe�covan �a prost�red��

X priv �atn�� s��t �e na b �azi pevn �ych priv �atn��ch spoj �u { WAN, LAN

X VPN { alternativa WAN, na b �azi protokolu IPSec ve ve�rejn �e s��ti(VPN pro vzd �alen �y p�r��stup, site-to-site VPN)

X extranety { podpora B2B �cinnost��, VPN technologie

X bezdr �atov �e s��t �e { IEEE 802.11, Bluetooth, mobiln�� s��t �e, . . .

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 91

Page 93: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

Politika pou�z��v �an�� s��t'ov �ych slu�zeb

2 C��l { Users shall only be provided with access to the services thatthey have been specifically authorized to use.

2 Politika ur�cuje

X kter �e s��t �e a kter �e s��t'ov �e slu�zby lze zp�r��stup �novat

X adekv �atn�� auutoriza�cn�� procedury pro z��sk �an�� pr �ava p�r��stupu

X kter �a opat�ren�� mus�� chr �anit s��t'ov �a p�ripojen��

2 Politika mus�� vyhovovat politice �r��zen�� p�r��stupu

2 Bezpe�cnostn�� perimetr s��t �e vymezuj�� sm�erova�ce a �rewally

X k aplikac��m, �udaj �um a slu�zb �am b�e�z��c��m v s��ti mohou p�ristupovatpouze autentizovan�� u�zivatel �e

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 92

Page 94: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

Autentizace u�zivatel �u pro extern�� p�ripojen��

2 C��l { Appropriate authentication methods shall be used tocontrol access by remote users.

2 Zranitelnost vzd �alen �eho p�r��stupu

X vyt �a�cen �a (komutovan �a) spojen��

X bezdr �atov �a spojen��

2 Bezpe�cn �y vzd �alen �y p�r��stup z internetu zajist�� nap�r.

protokol Kerberos

2 Na vyt �a�cen �ych spojen��ch lze pou�z��t zp�etn �a vol �an��

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 93

Page 95: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

Identi�kace za�r��zen�� v s��ti

2 C��l { Automatic equipment identification shall be considered asa means to authenticate connectionsfrom specific locations and equipment.

X nutn �e implementovat, pokud ohodnocen�� rizik indikuje, �ze je d �ule�zit �ezajistit, aby se relace otev��rala pouze z konkr �etn��ho m��sta �ci po�c��ta�ce

X nap�r. bankovn�� p�resuny pen�ez lze prov �ad�et pouze z . . .

2 Nesta�c�� zn �at adresu portu kabelu vedouc��ho k termin �alu

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 94

Page 96: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

Ochrana port �u pro vzd �alenou diagnostiku a kon�guraci

2 C��l { Physical and logical access to diagnostic and configurationports shall be controlled.

X vzd �alen �y p�r��stup si vynucuje po�zadavek mo�znostikon�gura�cn��ho nebo opravn �eho z �asahu

X porty lze chr �anit fyzicky, z �amkem,zp�r��stupn�en�� podle ISMS procedury �re�s�� obsluha po�c��ta�ce {

po n �ale�zit �e autentizaci port na ur�cenou dobu odemknea u�cin�� o tom auditn�� z �aznam

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 95

Page 97: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

Princip odd�elen�� v s��t��ch

2 C��l { Groups of information services, users, and informationsystems shall be segregated on networks.

2 Odd�elen��

X Odd�elen�� p �usobnost�� jist �e slu�zby m�u�ze redukovat dopadnaru�sen�� slu�zby

X Bezdr �atov �e s��t �e maj�� b �yt odd�eleny a s jinak bezpe�cnou zb �yvaj��c�� s��t��propojeny jedin �ym bezpe�cn �ym spojem (nap�r. �rewallem)

2 Nutnost d �ukladn �e dokumentace

X dom�en, rozm��st�en�� aktiv do dom�en, . . .

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 96

Page 98: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

�R��zen�� s��t'ov �ych spojen��

2 C��l { For shared networks, especially those extending acrossthe organization’s boundaries, the capability of users to connecttothe network shall be restricted, in line with the access controlpolicyand requirements of the business applications.

X spojen�� mus�� vyhovovat politice �r��zen�� p�r��stupu

X n�ekter �a spojen�� mohou podl �ehat �casov �emu pl �anu

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 97

Page 99: Katalog opatren , ISO/IEC 27002 - fi.muni.cz · ISO/IEC 27002:2013 2 Information Security Management X Information technology – Security techniques – Code of practice for information

�R��zen�� sm�erov �an�� v s��ti

2 C��l { Routing controls shall be implemented for networks to ensurethatcomputer connections and information flows do not breachthe access control policy of the business applications.

X sm�erov �an�� mus�� vyhovovat politice �r��zen�� p�r��stupu

Jan Staudek, FI MU Brno | PV017 { Katalog opat�ren��, ISO/IEC 27002 98