Operations security
IZAZI MUBAROK, SST., MSc., MCFE, CHFI, CEH, ACE, OFCE, CISA, CDSS, CCO, CCPA
[email protected]
Telkom University | Teknik Komputer | SMKI © Izazi Mubarok 1
Outline
• Operational procedures and responsibilities
• Protection from malware
• Backup
• Logging and monitoring
• Control of operational software
• Technical vulnerability management
• Information systems audit considerations
Telkom University | Teknik Komputer | SMKI © Izazi Mubarok 2
Operational procedures and responsibilities
Objective: To ensure correct and secure operations of information
processing facilities
Documented operating
procedures Change management
Control Control
• Operating procedures should be • Changes to the organization, business
documented and made available to all processes, information processing
users who need them. facilities and systems that affect
information security should be controlled.
Telkom University | Teknik Komputer | SMKI © Izazi Mubarok 3
Operational procedures and responsibilities
Objective: To ensure correct and secure operations of information
processing facilities
Separation of development, testing
Capacity management and operational environments
Control Control
• The use of resources should be • Development, testing, and operational
monitored, tuned and projections made of environments should be separated to
future capacity requirements to ensure reduce the risks of unauthorized access or
the required system performance. changes to the operational environment.
Telkom University | Teknik Komputer | SMKI © Izazi Mubarok 4
Protection from malware
Objective: To ensure that information and information processing
facilities are protected against malware
Controls against malware
Control
• Detection, prevention and recovery
controls to protect against malware
should be implemented, combined with
appropriate user awareness..
Telkom University | Teknik Komputer | SMKI © Izazi Mubarok 5
Backup
Objective: To protect against loss of data.
Information backup
Control
• Backup copies of information, software
and system images should be taken and
tested regularly in accordance with an
agreed backup policy.
Telkom University | Teknik Komputer | SMKI © Izazi Mubarok 6
Logging and monitoring
Objective: To record events and generate evidence.
Event logging Protection of log information
Control Control
• Event logs recording user activities, • Logging facilities and log information
exceptions, faults and information security should be protected against tampering
events should be produced, kept and and unauthorized access.
regularly reviewed.
Telkom University | Teknik Komputer | SMKI © Izazi Mubarok 7
Logging and monitoring
Objective: To record events and generate evidence.
Administrator and operator logs Clock synchronisation
Control Control
• System administrator and system • The clocks of all relevant information
operator activities should be logged and processing systems within an organization
the logs protected and regularly reviewed. or security domain should be
synchronised to a single reference time
source.
Telkom University | Teknik Komputer | SMKI © Izazi Mubarok 8
Control of operational software
Objective: To ensure the integrity of operational systems
Installation of software on
operational systems
Control
• Procedures should be implemented to
control the installation of software on
operational systems.
Telkom University | Teknik Komputer | SMKI © Izazi Mubarok 9
Technical vulnerability management
Objective: To prevent exploitation of technical vulnerabilities
Management of technical Restrictions on software
vulnerabilities installation
Control Control
• Information about technical vulnerabilities • Rules governing the installation of
of information systems being used should software by users should be established
be obtained in a timely fashion, the and implemented.
organization’s exposure to such
vulnerabilities evaluated and appropriate
measures taken to address the
associated risk.
Telkom University | Teknik Komputer | SMKI © Izazi Mubarok 10
Information systems audit considerations
Objective: To ensure that information and information processing
facilities are protected against malware
Information systems audit
controls
Control
• Audit requirements and activities involving
verification of operational systems should
be carefully planned and agreed to
minimize disruptions to business
processes.
Telkom University | Teknik Komputer | SMKI © Izazi Mubarok 11
Implementation guidance?
Telkom University | Teknik Komputer | SMKI © Izazi Mubarok 12
Terima kasih
Telkom University | Teknik Komputer | SMKI © Izazi Mubarok 13
