Mindlabs - Information Security

1. What is Information Security?

The process of protecting data from accidental or intentional misuse by persons inside or outside of an organization. Although information security is by no means strictly a technical problem, its technical aspects (firewall's, encryption and the like) are important. Information security is an increasingly high-profile problem, as hackers take advantage of the fact that organizations are opening parts of their systems to employees, customers and other businesses via the Internet.

2. What is BS 7799/ISO 17799?

BS 7799, the British Standard for Information Security Management. This standard provides a comprehensive set of controls comprising best practices in information security. The Certification ensures that the company is well equipped to protect any kind of information threat thus it is a business issue. BS 7799 Part 2:2002, defines the specification for an Information Security Management System (ISMS). The scope of any ISMS includes people, processes, IT systems and policies. Please refer to ISMS section of Information Security Manual (ISM) for details.

Initially developed from BS 7799, ISO 17799, and an international standard that sets out the requirements of good practice for Information Security Management. ISO 17799 ensure that company is ready to approach for the Certification.

3. IS it for you?

Yes, information security is for everyone inside the organization. It is the responsibility of everyone of the organization to protect company's valuable information. Loss of information relates directly/indirectly to the business continuity and thus the growth of the company. When the growth is related to the company and it's people around so it is a combine approach among organization's people.

4. Benefits of BS7799

Comforts to customers, employees, trading partners and stakeholders – in the knowledge that your management information and systems are secure

Demonstrates credibility and trust

Establishes that relevant laws and regulations are being met

Ensures that a commitment to Information Security exists at all levels throughout an organization

5. Certification Approach

Continue implementation of safeguards (control)

Continue Security Forum (SOM) Meeting

Commence process

Continuous review

Continuous documentation

Perform Risk Assessment

Engage internal auditors

To assist in reviewing work to date

To provide an element of increased confidence

To determine any non conformities earlier In process

Engage External (Accredited) Certification Body

6. Basic Steps to secure the information

List of Do's

General & Technical

Always protect the system with screen saver password

Always have a check on the System Files and Folder

Any technical problem or queries do inform to the SOM (System Operations Management) OR Security in-charge

See others are following the same

Follow the System Policies

Update the virus patch twice in a week

Always shutdown the system after using it

File all paper documents properly

Ensure print outs being collected

Always save any file with a different name whenever downloaded from internet

Before saving a file (from internet) please open it from the current location

Always delete files having name with numeric or junk characters (e.g.: 0,1,2 etc. or 124561.* or $*, ~* etc.)

Ensure that backup of all the source code and copy of official communication has been taken by the System Admin and also one copy is available in Document Server

Ensure that all the policies mentioned in “Information Security Manual” is exercised and maintained properly

System Administrator will ensure all the floppy drive is disabled and no CD writer is attached with any of the system except Server room

Administration Dept. (Physical Security)

Always make an entry for the Visitors to keep the track

Ensure that the visitors are allowed/confirmed (verbally/Written) by the staff

Ensure that after finishing the appointment the visitor has signed and the leaving time is entered properly into the log book

Always check whether physical security is ensured on all sensitive items like servers/Cameras/Printers/Routers/racks etc and not accessible by any one other than the person responsible for the same

Ensure that the telephone extensions other than the management cabins are not allowed for outside calls. For any such request for outside calls can be put forward to the reception

Ensure that Any mobile equipments like laptop/pen drive/ wireless docking stations etc. are not moved outside the office without having proper permission from the Administration in charge. The same can be allowed for official purpose only

Ensure that no technical diagrams are displayed in public place

HR Dept

Please ensure that sensitive information regarding employees salary details/Service register etc. are placed in a locked place and not accessible by anyone other than the HR

Before recruiting an employee please go through the past records/origin and other personal details

When sending an email for final round put all other candidates in Bcc

Any received resume can be cancelled if contains worms or any unwanted attachments

Please ensure that all new users of information processing facilities asked to sign formal confidentiality agreements at the time of employment

Finance Dept

Please ensure that all the paper documents are filed and locked

The password of the system would be highly confidential and need to change quarterly

Please ensure that System Administrator has not installed Tally any where other than the authorized systems within the department

Please ensure that the monthly backup for Tally and other sensitive document information is submitted to System Administrator and also the same is published on document server with encrypted password protection

Please ensure that no one except the finance department can enter in cash section

List of Dont's

General & Technical

Never keep any password that others can guess.

Never share any of your drive

Never share your IP address or passwords to any one

Never allow any external/internal person to use your system

Never allow vendors to install their software in your system

Never install any software without approval of SOM

Never keep any document open when you leave the system

Never browse any cracker/Hacker site

Never keep any browser Open for a long time

During browse never accept any questionnaires or pop-ups

Never use official email ID for any kind of registration process

Never use any Mindlogicx email ID to join in Mailing List

During chatting please do not accept any file from any of the remote user

Do not upload any contents to any website having company information

Do not open any attachment having extensions .pif,.zip.exe, .exe, .rar, .hta, .kak

Never open any Email having subject “your balance”, “Call letter” Or any subject contains vulgar words

Avoid opening unknown emails

Any technical information about the Company- it's project, Architecture, IP address, mode of internet access, VSAT connectivity details is not sharable to any one out side the company

No outsider is allowed inside the server room

Administration Dept

Never allow any visitors without prior information.

Never entertain any queries from outside (survey) calls regarding the Company Information unless or until you are instructed to do so

Never entertain any queries regarding Security infrastructure of the company. The same can be transferred to Information Security Officer OR any of the SOM team members

Do not allow any visitor to enter into the office premises with bags/luggage

Never allow any office asset to move out of the office without permission from the respective department heads. The same can be entered into the outward register also

Never allow any visitor to use the phone when in the waiting room

Smoking is not allowed inside the Office premises

During holidays/non-office hours any Outside visitor including any staffs/employees are not allowed inside the campus without any prior permission from the administration in charge

HR Dept

Do not compromise any company information unless the candidate is approved by the MD/CEO

Do not mention too many email ID when place a job advertisement on the media

Finance Dept:

Never discuss any financial matters with any outsiders/employees other than the authorized persons

Never use registered email for communicating any confidential finance matters. The same can be communicated through any offline pseudo Email ID/ Hardcopy

Disaster Recovery Planning & Business Continuity Planning

Disasters are a part of every day life, businesses are not immune to disasters be they natural or other. A disaster can be as big as a major flood or hurricane or can be as small as a hard drive failure. The way a business copes with a disaster can be entirely attributed to its BCP (Business Continuity Planning) and DRP (Disaster Recovery Planning). At the end of the day, all responsibility lies on the shoulders of senior management so it is up to them to ensure that effective plans are put in place.

Business continuity planning is different to disaster recovery planning but both go hand in hand. Business continuity planning can be defined as plans that have been created and set in place to restrict or prevent interruptions to the normal everyday running of a business. Important business infrastructures and procedures are protected from the impact of disasters resulting in the minimal loss of information assets and capital. The main goal of business continuity planning is to allow a business to resume unhindered.

When normal business procedures and operations are impeded by a disaster or disruption this should automatically be classed as an information security problem. Information is vulnerable during incidents, it can be vulnerable to external hacker attacks it can also be vulnerable to data loss that can occur in disaster scenarios.

A good business continuity plan will make sure that the following information systems and procedures are protected:

Networks and servers: These include all LAN's, WAN's, plus the servers used to power these networks. This can also include web servers that host the company or organizations website. If a company is web based and relies on the internet for 100 percent of its business (for example a large search engine company), downtime of its web servers could result in losses of millions of dollars.

Software: This includes data that is essential for a business to run. It also includes software applications and programs that can often be irreplaceable. Software licenses are also included in this; you can't rely on the vendor to keep track of your software licenses for you.

Staff responsibilities: Staff responsibilities and duties need to be planned for. It is essential that in the event of a disaster staff members are not left to there own devices. In the case of a large company with hundreds or thousands of employee's it is important that records are kept. Small companies have the advantage of knowing all staff members but if you loose information on who does what in a company, dishonest staff may take advantage of this.

Information back up and storage: It goes without saying that information and data back up are an essential aspect of any business continuity planning. Records need to be kept on the locations of the back ups as well as ensuring that the back ups are made on media that will not degenerate over relatively short time periods.

Individual work areas and workstations: This is an important aspect as it can help protect a whole network of workstations. The ability to remove an infected computer from a network will in some cases stop a virus or worm spreading through the company's network.

Data links and Telecommunication: These include phone lines, fax lines as well as internet connections such as data links and cables. Communication is one of the most essential aspects in modern information systems and business today, ensuring the continuity of these is important.

Human life is the most important aspect of BCP. Human life can never be replaced, everything man made is replaceable, it may take long hours of work to replace something but a human life can never be replaced. This should be the most imperative facet of any BCP. Staff need to be fully trained and aware of this. They need to know the safest evacuations routes as well as other procedures to follow in the event of a disaster.

The Fundamental Stages of Business Continuity Planning are:

Research and establishment: Factors that need to be research include scope as well boundaries. This is the initial stage and can be looked upon as planning for the plan and allocating the tasks involved. Care should be taken to allocate trustworthy staff to these roles and to also to set a time limit on when you expect the task to be finished.

Business impact analysis: Core business areas need to asses what impact a disaster will have on business procedures. All area's need to analyses the effects of disaster on business continuity. Scenario and vulnerability assessment of critical information systems is included in this fundamental. Would your business cope without working computers for more then a few days? How long could your business last without incoming money?

Development of the plan and structures: Compiling all the information and data that has been researched and molding these all together to create the initial plan. This stage also involves bug checking and testing to ensure that nothing unforeseen occurs when the plan is put into use.

BCP maintenance and readiness: This is the final stage. This stage involves final clearance from senior management. Staff training and organization awareness, including training specific staff as to what role they will play in the event of a disaster. Implementation of procedures, software and hardware that may be involved.

Mindlabs provides consultancy on BCP and DRP on case to case basis. The associate consultants at Mindlabs have several man years of experience to customize the plans that best suit the individual needs of the customers.

Contact mindlabs@mindlogicx.com for further details