PT Bintang Baru Sukses – IT SECURITY

I. IT Security

 IT is tightly controlled at the factory level

 Of ………. employees, only …….. employees have access to the IT system and
even then, only to restricted areas specific to their job function

o Example – the Production Officer and Quality department have IT

access to the ERP system only to enter data on when the shipment is
ordered (production) and when the garments have been inspected
and approved (Quality)

 Limited Company information in Factory

o The Korean headquarters receives orders for the facility, and although
we are copied on the request, we only interact with our HQ. All
invoices to/from the end customer, i.e.: Ascena, are through HQ and
not from the factory.

o This highly controlled process was developed to further limit loss of

information and potentially violation of intellectual property rights
(IPR)

 Antivirus program is through Microsoft Defender

o Automatic updates of security programs through our subscription

with Microsoft

o It is a comprehensive protection for our system, files and online

activities from viruses, malware, spyware, and other threats.

o Defender includes automatic updates for:

 Virus protection and removal

 Malware protection and removal
 Network inspection
 Real time inspection

Systems-PT. Bintang Baru Sukses

IT Department 1
PT. Bintang Baru Sukses C-TPAT Validation Maret 2020 – © 2020
 PT Bintang Baru Sukses – IT SECURITY
 We use three systems to manage our company data and further limit access
based on job function and then the Microsoft windows operating system
supports our email program.

 External firm, PT. Hanasta Dakara IT security updates and reviews of our
systems on an annual basis for auditing and periodically to manage IT
questions

 IT room is controlled by a keypad with limited access; it is locked at all times

and under the control of security via a camera

 Wifi

o The system passcode for guests is changed daily, and is not provided
to employees; therefore, employees are not using our wifi system for
their personal phones, which is considered a higher security standard.

o The IT Administrator monitors who is using our system during the

day (i.e.: approves guests and non employees)

 There are ……. desktop computers for those authorized to have access to
various systems, and they remain within the facility and are never taken
offsite. The computers are secured within the person’s work station.

o Laptops are issued only to seven senior management employees with

VPN access

 Backup of system

o Back up of system is done weekly; and with a copy held on site and
duplicate copy at PT. Hanasta Dakara; the number of transaction
managed for each order is minimal and a weekly backup is sufficient
for our operations;

o There is a daily back up of all documents manually and maintained in

locked area of warehouse; these are audited periodically by
Indonesian customs as part of the bonded zone operations.

 Passcodes are at least 8 digits with a combination of letters, numbers and

symbols; all passcodes for our main systems are changed every 6 weeks with
the exception of windows email, which is 90 days.

IT Department 2
PT. Bintang Baru Sukses C-TPAT Validation Maret 2020 – © 2020
 PT Bintang Baru Sukses – IT SECURITY

SYSTEM LIMITED ACCESS SECURITY

ERP System (ASA902) 7 people with access Automatic forced passcode change
 GM every 6 weeks
 Production
PIC Each person enters data for their
 Admin portion of the production process;
warehouse
 Admin cutting
 Admin
finishing
 Admin QA
 Admin sewing
 Accounting
 Logistic
HRD System – this is an HR 4 people Automatic forced passcode change
system (attendance only); every 6 weeks
personnel files are hard copy –
daily filing
3 people Automatic forced passcode change
Accounting and Tax system every 6 weeks

Windows and email – email, ……. people Passcode protected

word and excel only Changed every 90 days
Mail server is with PT. BBI

Systems
 Passcode is 10-14 digits (letter, 1 number, 1 symbol)
 Passcodes changed every 6 months
 Employ both internal or external IT workers
 Antivirus? Commoto, Macafee, Symantec
 VPN for laptops
 Back-up system is separate from the server

EVIDENCE OF IMPLEMENTATION

 Passcode configuration procedure

BEST PRACTICE

IT Department 3
PT. Bintang Baru Sukses C-TPAT Validation Maret 2020 – © 2020
 PT Bintang Baru Sukses – IT SECURITY
 Restricted use of guest wifi system with no access to employees
 Restricted access to all systems and company information

o Only 4% of all employees have access to systems;

o Of the 4%, only 7 people (or .5%) have access to the ERP system,
where the majority of company information is kept.

o Key company data is maintained and managed by our corporate

Korean office, further solidifying our IT security

o This highly controlled process was developed to further limit loss of

information and potentially violation of intellectual property rights
(IPR)

IT Department 4
PT. Bintang Baru Sukses C-TPAT Validation Maret 2020 – © 2020