Showing posts with label Information Security Management System. Show all posts
Showing posts with label Information Security Management System. Show all posts

Thursday, 30 October 2014

Identity and Access Management (IAM)

By Raul Bernardino

Introduction:

Identity and Access Management (IAM) is a framework which is consisting of the technical, policy, and governance components or a framework for business processes that facilitates the management of the electronic identities. The framework is including technology and to support management of the identities. This framework can allow an organization to:

·     identify individuals
·     link identities with roles, responsibilities and affiliations
·     assign privileges, access, and entitlements based on identity and associations

This IAM is certifying data stewards and service providers to control access to the information and/or services, according to an individual's identity, roles and responsibilities.

IAM is covered of four main areas as follows:
·     Credential (assignment of an unique token to an entity needing access to resources)
·     Authentication (act of validating proof of identity)
·     Authorization (act of affording access to only appropriate resources and functions)
·     Accountability (ensuring against illegitimate utilization of an entity’s authority…flows from the first 3 functions)

Below is IAM diagram:

Mosaic Integration
The inclination of individual project teams to address integration concerns on a case-by-case basis is natural. The effort involved in many “one-off”, or “point-to-point”, integration scenarios may seem trivial at first, especially when compared to the effort involved in defining and managing an integration infrastructure (after all,

I can set-up that FTP transfer in a couple lines of Perl (or PHP, or whatever)). Only when looking at the “big picture” can we truly appreciate what a tangled mess these “point-to-point” integrations engender. The metadata concerning “what's connecting to what”, the inconsistent security models, and the tight-coupling of service interfaces with implementations, all contribute to the sort of “brittle” environments discussed above.

Developing a coherent integration infrastructure must be a collaborative effort. In order for this collaboration to be productive, recognition and respect of roles, expertise and “spheres of influence” must be maintained. The SIA team recognizes that the technical leads of the various Mosaic Project initiatives will be responsible for identifying integration concerns, application and business-driven technical requirements. These may include, but are not limited to:
·        data consistency and periodicity of synchronization
·        specification of integration points
·        definition of service interfaces/business objects
·        definition of technical capabilities/limitations within the application environment (e.g., the ability to expose a service via SOAP)

The value that the SIA team brings to the Mosaic project lies in the definition of the infrastructural framework, integration patterns, governance and best practices which can be applied to the aforementioned concerns and requirements. The recognition and support of this “domain expertise” on the part of the Mosaic project teams will be paramount in developing and maintaining a “cross-initiative” integration perspective—substantially reducing the likelihood of falling into the traditional traps of point-to-point integration while bolstering the potential for standardization, optimization and reuse of integration resources.

References List:
Rouse M. (n:n:), Identity Management (ID management), [On-line]. Available from: http://searchunifiedcommunications.techtarget.com/definition/identity-management (Accessed: 13 October 2014)
AN. (11-12 April 2011), Requirements for a Global Identity Management Service, [On-line]. Available from:  http://www.w3.org/2001/03/WSWS-popa/paper57 (Accessed: 13 October 2014)





Wednesday, 16 July 2014

Computing Capability and Connectivity’s

By Raul Bernardino
Introduction:
Nowadays computing technology perspectives are to help and fulfill human society needs. Either, they are from professional’s institution of the computing or from software developers industries, they should understand the grass root problems or issues that society that current faced, the society’s trends of using the technologies, the organizations business operations, and other entities needs. These all will enable industries to develop applications and design proper technologies as an interface for helping society.
The application system has to be effective, efficient, reliable, given the accuracy of the measurements, and easy to use or operate in the daily operation. It is also including the safety of the system configurations, friendly environment system, and in line with the norms, society cultures, and the ethicals.
Some of the computing capabilities are able to track down human movement by using data communication over mobile phones, and currency of uses, and it’s including an immigration data. The researchers are tracking at list hundred thousand of people over last six months, etc.
The storage data capability:
In the early computing technology, the capacities of the computing data storages are from 20 Mb to 40 Mb of the IBM personal computer (PC) hard disks and the floppy disks are from 512 Kb to 1.4 Mb. The evolution of the technology and the demands of have the big storages to archive data on disks become a priority to develop furthermore. Therefore, today storage capacity becomes Giga byte, Terra bytes, and Peta bytes.
The purpose of having storage data is to enable retrieving the data whenever it is needed, such to modify the current data, to print for hard copy signed, to manipulate the data, to have the data for decision making process, for the meeting purposes, for sharing data, and etc. Further development of the data storage in globalization era is a data center and the cloud computing. Another relevant question of the data storage as follows:
How much data to be archive? How much data are relevant to the inclusive decision making processes? What data is relevant for the meeting? And so on so for.

The Memory capability:
The term "memory" is often associated with addressable semiconductor memory, i.e. integrated circuits consisting of silicon-based transistors, used for example as primary memory but also other purposes in computers and other digital electronic devices. There are two main types of semiconductor memory: volatile and non-volatile. Examples of non-volatile memory are flash memory (sometimes used as secondary, sometimes primary computer memory) and ROM/PROM/EPROM/EEPROM memory (used for firmware such as boot programs). Examples of volatile memory are primary memory (typically dynamic RAM, DRAM), and fast CPU cache memory (typically static RAM, SRAM, which is fast but energy-consuming and offer lower memory capacity per area unit than DRAM).
The speed capability:
The speed in the computing technology is an essential part of the system configuration. The processors of the computing have to be fastest. For instance all Integrated Circuit(IC) of processors are on the nanosecond (10-9). This will allow processing multiple applications over the computing system faster. For instance: to process the documents over Microsoft word, Excels and power points.  The Microsoft has template to speed up the power design, made auto calculation on excel sheet, modified existing documents, printing existing document for the meeting , and etc. Here the efficient and effective, including the reliable are the measurement for the speed. If we compare to the old function of type write, we will find difficult in preparing the document. It will be time consuming and not effective.     
The capability of connection:
Today globalization needs lot of communication infrastructures in order to make a link from very isolate societies or communities or remote area to communicate with the cities and metropolitans communities or urban areas. The internet network has made lot of contributions to the world society or communities. The connectivity’s has shared the valuable information and knowledge across the countries without a limitation. People can easily interact with the partners around the world. The digital enable people to learn faster than the day before. People have to go to the class, people have to travel far or across to the country to get the information, and etc. Nowadays, it is not an issue anymore. We can have virtual classes, as on-line study, deliver courses and meeting via videoconferencing and audio conferences and etc.    

The access capability:
The accessibility and reliability of the information or data over computing and networks are becoming one of the computing capability measurements. Today’s global computing access becomes a concern to everyone. Therefore computing access has to be managed in order to be able to monitor and manage the performance of the computer itself. The user has to have the accounts and give the privileges to each of them in order to minimized the risk of data confidentiality, protect privacy, allow public share knowledge, and etc.
The fast calculations result capability:
This computing capability makes human been easy to determining decision such as calculating large and complex of issue in Math in excel. For instance: calculating population growth prediction in the statistic models, weather-forecasting, navigating airplane, and etc.
Beside the capability of computing there is relationship with human being activities or issues such as:
The privacy issues:
Nowadays the global communication such internets and social networks communication are publically available even in very remote area that has mobile signal coverage. This is bringing an issue of the privacy.
“The right to privacy in Internet activity is a serious issue facing society.” Walton T.J. (2000)
“…yet on other occasions society questions the state of their privacy, becoming insecure and untrusting with respect to technology.” Robinson, P., Vogt, H., and Wagealla,W. (2005, p.2.)

The ownership:
It’s also very difficult today in determining the ownership of the information or data the internet or in the social networks. It is appear to be anonymous. However in the universities and academics are still looking for protecting the copy rights, such as intellectual copy rights. In other end people intend to have a PIN to secure their assets.

The control:
In order to have full control of things that we have, we have to start to control the connection from our own computer or electronic device; it is including controlling the accessibility of the information or data that we have stored into the technology media. Nowadays, the hacker and crackers are very active in looking for the possibilities such back doors, phishing, and etc., in order to control your machines that have attached wide area network.  Some e.g. is DNS poisoning.

The accuracy:
The global connectivity’s has allowed us to reach and gets right information that we needs in matter of the second. Lot of the internet information has not had preapproval examined from the institutions such university or from the producers. For instance:  We had several issues computer driver that we bought. First we have to consult with the support sited from the producer in order to get the right version of the drivers that we are looking for. We can also ‘Google’ it, in order to get the same information; however its most probably to direct us to other sites that may not solve the problems.
The security:
The security topics are hot issue in today business. The organizations that intend to protect their own information or data is busy investigating solutions for their security requirements. It is including the copyrights and privacies. One of the classic examples is your house. The stranger people can’t enter you house unless you are the one open the door for this stranger. Your door key is your “security key”. So don’t share it to the stranger people.
The global communication and connectivity’s has forced the organizations, companies, and other institutions, to have the information technology policies. This policy is to ensure the security, privacy, and operability of the computing technology in their daily business locations. It is also including establishing the IT standards for the organization and the most important is that the policy is in line with the business need.  It is also need to have IT Master Level Agreement and Server Level Agreement in the organization.
 References:
Adams, A.A. & McCrindle, R.J. (2008) Pandora’s box: Social and professional
issues of the information age. West Sussex, England: John Wiley & Sons, Ltd.
Hall, P. A.V. & Fernandez-Ramil, J. (2007) Managing the Software Enterprise:
Software Engineering and Information Systems in Context. London: Thomson Learning.
Maths Fast Calculation Software Freeware, [Online]. Available from:
Robinson,P.  Vogt,H.  and Wagealla,W., (2005), Privacy, Security and
Trust within the Context of Pervasive Computing, Springer Science + Business Media, Inc. , [Online]. Available from: http://books.google.com.sg/books?id=ya6tY8Mz9OYC&pg=PA23&dq=privacy+in+the+computing&hl=en&ei=HlotTeyoKYaycMav4PAH&sa=X&oi=book_result&ct=result&resnum=3&ved=0CDQQ6AEwAg#v=onepage&q&f=true (Accessed:  16 July 2014)
Stensland, D. and Humanitech(d:d): Merging Humanity with Technology,
[Online]. Available from: http://www.cc.gatech.edu/features/merging-humanity-with-technology (Accessed:  16 July 2016)

Technology On Way To Forecasting Humanity's Needs, [Online]. Available from:

Walton,T.J., (2000), Internet Privacy Law, [Online]. Available from:
Wikis (A.N.) Computer Memory, [Online]. Available from:
          http://en.wikipedia.org/wiki/Computer_memory (Accessed:  16 July 2014)



Tuesday, 27 May 2014

Audit Report template

Audit Report
For
Lake Dale Contact Center (LDCC)

By Bernardino, Raul

Audit Objective:
LDCC intent to get ISO 27001:2013 certification

Audit Scope:
Information Security Management System (ISMS) applies to the provision of Telephony services, the management of information and business support services at our only site in Mumbai (India), in accordance with the ISMS Statement of Applicability (SoA) revision 03, dated 21/Sept/2014. The scope of this ISMS excluded all IS outsources process (as there is not controlled by LDCC)

Audit Criteria:
ISO/IEC 27001:2013

Conclusion:
The audit team found that there are several NCs during the auditing process. The audit team decided to not process the ISO 27001:2013 certification to LDCC yet until those NCs are corrected in the LDCC.
We encourage the Management Review to have a closed monitoring with the relevant risks owners in order to do a corrective and correction action and continual improve.

Recommendations:
The Audit team recommend to the Management Representative (MR) to take more serious on the Major Non-Conformities (NCs) and liaise with Risk Owner to take a Corrective Action and Correction Action of the findings.
The MR shall ensure all Risk Owner approvals are approved and accepted the risks.
The MR shall liaise with internal auditor to do internal audit periodically or as per internal auditing plan.

The MR should produce effectiveness report towards to the implementation the correctives of the NCs.
The external auditor will perform the follow up auditing process in next 60 days.

Description of Audit Process:
The Audit team consists of Mr. Dino, the Lead Auditor, Mr. Toha, the Auditor team member, and Ms. Qory, the Auditor team member. The audit team has held with Mr. Sanchez, as a Management Representative and the meeting happened as per agreed schedule.

The lead auditor greeted the Management Representative, Mr. Sanches and introduced auditor team members. The lead auditor explained the objective of the meeting and Mr. Sanchez was most welcoming the auditor team members. The situation was friendly or conducive for both auditors and auditee.

The lead auditor started with brief interviews the MR and followed with questions that were focusing on clause 6. For instant, how do you prevent or reduce your effects? 
MR replied that they had a risks assessment, risk evaluation, risk analysis, and risk evaluation toward to the external and internal issue. They had seriously tackling the issues which are compliance the ISMS standards.  Why in some risks, the RO did not sign or approved the risks? MR replied that because that staffs were on leave once the return the will signed.

The auditor team member was questioning how LDCC set the Risk criteria? MR replied to the team that they just use Low, Medium, High us their parameter’s. Ms. Qory has follow up question how if the risk owner change and the person does know the situation and adjusting with wrong judgment? MR replied they will know that.

Other auditor team member was questioning the SoA document which based on assets and not on the control. MR replied that they have a procedure for that.
The lead auditor was question about lot of loss on documents and unorganized file? MR replied that just lock the door when they out of office; the follow up question was how about Janitor has the key and access the room and looking the confidentiality files or documents? MR persistent that once they locked the door no one can access it;    
During this interviewed, auditor team members found several NCs and they are in the following section.

Non Conformity (NC):
1.     Risk Owner (RO) – [Minor-NC]:
Based on the Risk Assessment template ISO 27001 - D13 – issue 1, we found that some of “Risk Owner” did not approved, especially in the section A1 and A18.
During the audit process, the Management Representative (MR) stated that the Risk Owner did not approved because they were on leave
This is against requirement of standard of ISO 27001:2013 in clause 6.1.3 (f), which is to ‘obtain Risk Owner approval of the information security Risk Treatment Plan (RTP) and acceptance of residual information security risks’.
2.     The Statement of Applicability (SoA) document is not effective [Major-NC]
In the SoA document number SoA - D14 - issue 1, which is based on the asset and it is not based control.
This is against the requirement standard of ISO 27001:2013 clause 6.1.3 (d) which is to ‘produce a Statement of Applicability that contains the necessary controls (see also 6.1.3 (b) and (c) and justification for inclusions, whether they are implemented or not, and the justification for exclusions of the control from Annex A’.
3.     Risk Criteria was not effective [Major-NC]
The LDCC did not defined the information security criteria properly based on the document Information Security Risk Procedure - D11- issue 2, there are no brief definition about the scoring level for consequences, likelihood, and occurrence in the procedure. It can be triggered a different assumption from the risk owners.
It is against requirement of the ISO 27001:2013 in clause 6.1.2 (b) which is to ‘ensure that repeated information security risk assessment produce a consistent, valid, and comparable results’.

Observation:
The interviewers and auditee were have more relaxing time and it is created a conducive situation while the flows of questions and answers were no proper implementation was enjoyable.

Schedule for Next external audit:
July 10, 2014

Dated: May 9, 2014

Prepare by,                                                                    Approved by,


Mr. Dino, Lead Auditor                                   Mr. Sanches, MR