Test the Test
1. Have Information Classification Guidelines been documented? Information Classification Guidelines identify the different types of information that flow through an organization and the sensitivity of that information. Based on the organization's needs, the greater the sensitivity, the greater the security requirements. Security levels are placed on the different classifications of information and should represent the appropriate security and control measures needed.
2. Are there Information Labeling and Handling Procedures? Procedures for information labeling and handling are important for ensuring the security of sensitive information. For example, information that is labeled as sensitive or confidential may require encryption.
3. Is there a Clear Desk and Clear Screen Policy? A Clear Desk and Clear Screen Policy ensures that an employee's computer and hard-copy sensitive information is not compromised by an unauthorized user. Screens should be locked when the user leaves their station, and all sensitive or confidential documentation should be stored in a secure place.
4. Are Third Party Contracts used and current? Third-Party contracts are thorough documents that are written to ensure that there is no misunderstanding between an organization and third-party. Description of services, access control, information security, liabilities and legal responsibilities are just a few of the items that should be covered in a third-party contract.
TECH
5. Are USB data ports disabled for those employees that do not need them? Employees with access to USB ports may use flash drives or other removable media to collect sensitive data. Flash drives come in several shapes and sizes, some are as small as a stick of gum. All are a huge risk as they may contain sensitive information and be carried out of the facility in an employee's purse or pocket.
6. Is a Vulnerability Management program in place? Vulnerability Management is critical to the assessment and management of risk. A vulnerability Management Program enables focus, on a consistent basis, on the vulnerabilities facing the organization. Vulnerability scanning is critical, as it alerts the organization of potential holes or weaknesses in the network.
7. Are all system clocks synchronized? All system clocks should be synchronized to ensure accuracy of logs. In the event of a breach, if system clocks are not synchronized, the investigative process could be slowed.
8. Are there restrictions on connection times for high-riskConnection times to high-risk applications should be restricted, and follow a updated policy to safeguard against unauthorized access.
9. Are Non-repudiation services being used? i.e. Digital signatures, timestamps To provide security, protection, and to resolve possible disputes of an event or action, the use of Non-repudiation services should be used. Non-repudiation may serve as proof that the information within a file or application was or was not created, altered or transmitted at a particular time or by a particular individual. i.e. Digital Signatures and Timestamps.
PHYSICAL
10. Is cabling protected from interception or damage? Protecting the cables from interception helps ensure that eavesdroppers are not able to easily access sensitive information being transmitted.
11. Is there separation of development, test and operational Separating development, test and operational facilities is important to achieve segregation of the roles involved. Development and testing activities may cause unintended changes to software and information if they share the same computing environment. Separating development, test and operational facilities is therefore desirable to reduce the risk of accidental change or unauthorized access to operational software and business data.
12. Do Removal of Property Procedures exist? Removal of Property Procedures are written and practiced to ensure that equipment or media potentially containing sensitive information is not taken from the premises by unauthorized persons.
