ISO 27001:2013

- OPERATIONS SECURITY

By DSRC Quality Assurance Group

 Documented Operating procedures – Vouch for procedures
and policies.
 Installation and configuration of systems
 Handling of information
 Backup

 Error Handling or Issue tracking

 Escalation and remedial instructions
 Log Management

OPERATIONAL PROCEDURES AND RESPONSIBILITIES

 Change Management – Changes which will affect
information security with respect to CIA need to be
controlled.
 Identification

 Planning and testing

 Impact Analysis
 Review and Approval
 Communication

 Fall back process incase of failure

 Handling Emergency Changes

OPERATIONAL PROCEDURES AND RESPONSIBILITIES

 Capacity Management – for Future use of Resources
 Requirement Analysis – Criticality of Business
New Business requirements
Removal of Obsolete Data
Performance Tuning of systems and process
Restriction on Band-width usages during delivery etc
Resource (human) requirement and their
Capacity/Competence

OPERATIONAL PROCEDURES AND RESPONSIBILITIES

 Separation of Development, Testing and Operational
Environments– Protection of Operational environment from all
types of Risks.
Segregation of Development, Testing and Operational Systems
Maintenance of production and test data
Handling of Exceptional cases
Segregation of Users based on their activities
Protection of Business critical or highly secured data from Production,
testing and operational process

OPERATIONAL PROCEDURES AND RESPONSIBILITIES

 Controls
against Malware – Protection of facilities from
Malware threat
 Detect, Prevent and Recover
 Protection from Unwanted downloads
 Periodical review
 Whitelisting and Blacklisting
 Fall back process incase of failure
 Escalation

PROTECTION FROM MALWARE

 Backup – To Protect Loss of Data, DR and BCP.
 Clearly defined Backup Policy – Contract Obligation
 Plan – Data, Systems and Tools and physical
information's
 DR/BCP – Time testing
 Periodicity – Retention Period – Media
 Storage place and tools
 DR site

BACKUP
 EventLogging– Recording operational events of information
security
Event logging – Legally viable
When, Where, Whom, What and Why
Attempts of Access, Installation, Configuration
Change
Activation and de-activation of system controls
(antivirus)

LOGGING AND MONITORING

 Protection of Log information– Backup of System Logs

Meant for Legal evidence

Protected against, tampering or deletion
Access Restriction
Part of backup schedule
Periodicalreview of Protection Controls in place with
Capacity review

LOGGING AND MONITORING

 Administrator
and Operator logs– Recording operational
events of administrator and operator of information facility
Administrator privilege
Privilege access to operators
Critical data/ system access
Intrusion detection system

 Clock Synchronization – Meant for accuracy of event logging

which makes the log evidence legally acceptable in terms of
accuracy as per the statutory and regulatory rules or under
court of law

LOGGING AND MONITORING

 Ensure Integrity of Operational systems
 Trained candidate only authorized to perform changes
 Change control need to be applied
 Roll back facility need to be done – incase of contingency
 Necessary review and approvals before change
 Audit log should be maintained
 Restricted Access management incase of outside suppliers

CONTROL OF OPERATIONAL SOFTWARE

 Information systems audit controls– Minimize the impact of audit
activities on Business operations
 Approval to carry out audit on Information systems
 Scope of technical audit – to be agreed by stakeholders
 Audit access can be given with read-only on data
 Separation files - copy for full access - based on NDA
 Any trial which affects the operation - should be done after
business hours
 Allaudit trails need to be recorded and monitored through
Event log management

INFORMATION SYSTEM AUDIT CONSIDERATIONS

THANK YOU