SOA - Declaración de aplicabilidad
7
Statement of Applicability LR CO BR/BP RRA Sec Objective/Control 10.1 Operational Procedures and responsibilities 10.1.1 Documented operating Procedures 10.1.2 Change Management 10.1.3 Segregation of Duties 10.1.4 Separation of development and Operations facilities 10.2 Third Party Service Delivery Management 10.2.1 Service Delivery 10.2.2 Monitoring and review of third party services 10.2.3 Manage changes to the third party services 10.3 System Planning and Acceptance 10.3.1 Capacity management 10.3.2 System acceptance Comments (Description of implementation / Justification for exclusion) Reasons for selection LR: legal requirements, CO: contractual obligations, BR/BP: business requirements/adopted best practices, RRA: results of risk assessment ISO 27001:2005 Controls
-
Upload
jhon-hegel-gutierrez -
Category
Documents
-
view
217 -
download
0
Transcript of SOA - Declaración de aplicabilidad
7/27/2019 SOA - Declaración de aplicabilidad
http://slidepdf.com/reader/full/soa-declaracion-de-aplicabilidad 1/7
Statement of Applicability
Sec Objective/Control
10.1 Operational Procedures and responsibilities
10.1.1 Documented operating Procedures
10.1.2 Change Management
10.1.3 Segregation of Duties
10.1.4 Separation of development and Operations facilities
10.2 Third Party Service Delivery Management
10.2.1 Service Delivery
10.2.2 Monitoring and review of third party services
10.2.3 Manage changes to the third party services
10.3 System Planning and Acceptance
10.3.1 Capacity management
10.3.2 System acceptance
Comments (Description of implementation / Justification for e
LR: legal requirements, CO: contractual obligations, BR/BP: business requirements/adopted best practices, RRA: results of risk assessme
ISO 27001:2005 Controls
7/27/2019 SOA - Declaración de aplicabilidad
http://slidepdf.com/reader/full/soa-declaracion-de-aplicabilidad 2/7
Statement of Applicability
Sec Objective/Control
Comments (Description of implementation / Justification for
LR: legal requirements, CO: contractual obligations, BR/BP: business requirements/adopted best practices, RRA: results of risk assessm
ISO 27001:2005 Controls
10.4 Protection against Malicious and Mobile Code
10.4.1 Controls against malicious code
10.4.2 Controls against Mobile code
10.5 Back-Up
10.5.1 Information Backup
10.6 Network Security Management
10.6.1 Network controls NAS, segmentacion, SSL VPN, IPS, FW, …
10.6.2 Security of Network services
10.7 Media Handling
10.7.1 Management of removable media Reglamentado sólo dktte y tapes; no USB, ...
10.7.2 Disposal of Media
10.7.3 Information handling procedures
10.7.4 Security of system documentation
10.8 Exchange of Information
10.8.1 Information exchange policies and procedures LBTR y SICAP
10.8.2 Exchange agreements
10.8.3 Physical media in transit Cintas
10.8.4 Electronic Messaging LBTR, SICAP, SWIFT
10.8.5 Business Information systems LBTR, SICAP, SWIFT, SIMC
7/27/2019 SOA - Declaración de aplicabilidad
http://slidepdf.com/reader/full/soa-declaracion-de-aplicabilidad 3/7
Statement of Applicability
Sec Objective/Control
Comments (Description of implementation / Justification fo
LR: legal requirements, CO: contractual obligations, BR/BP: business requirements/adopted best practices, RRA: results of risk assessm
ISO 27001:2005 Controls
10.9 Electronic Commerce Services
10.9.1 Electronic Commerce
10.9.2 On-Line transactions
10.9.3 Publicly available information
10.10 Monitoring
10.10.1 Audit logging OAV
10.10.2 Monitoring system use
10.10.3 Protection of log information
10.10.4 Administrator and operator logs TIC. Modulo de auditoria del admin.
10.10.5 Fault logging
10.10.6 Clock synchronization
"This work is copyright © 2007, ISO27k implementers' forum, some rights reserved. It is licensed under the Creative Commons Attribution-Noncommerci
reproduce, circulate, use and create derivative works from this provided that (a) it is not sold or incorporated into a commercial product, (b) it is properly a
www.ISO27001security.com), and (c) derivative works are shared under the same terms as this.).
7/27/2019 SOA - Declaración de aplicabilidad
http://slidepdf.com/reader/full/soa-declaracion-de-aplicabilidad 4/7
Statement of Applicability
Sec Objective/Control
11.1 Business Requirement for Access Control
11.1.1 Access control Policy
11.2 User Access Management
11.2.1 User Registration
11.2.2 Privilege Measurement
11.2.3 User password management
11.2.4 Review of user access rights
11.3 User Responsibilities
11.3.1 Password Use
11.3.2 Unattended user equipment
11.3.3 Clear Desk and Clear Screen Policy
11.4 Network Access control
LR: legal requirements, CO: contractual obligations, BR/BP: business requirements/adopted best practices, RRA: results of risk assessment
ISO 27001:2005 Controls Comments (Description of implementation / Justifica
7/27/2019 SOA - Declaración de aplicabilidad
http://slidepdf.com/reader/full/soa-declaracion-de-aplicabilidad 5/7
Statement of Applicability
Sec Objective/Control
LR: legal requirements, CO: contractual obligations, BR/BP: business requirements/adopted best practices, RRA: results of risk assessm
ISO 27001:2005 Controls Comments (Description of implementation / Just
11.4.1 Policy on use of network services
11.4.2 User authentication for external connections
11.4.3 Equipment identification in networks
11.4.4 Remote diagnostic and configuration port protection
11.4.5 Segregation in networks
11.4.6 Network connection control
11.4.7 Network Routing control
11.5 Operating System Access Control
11.5.1 Secure Log-on procedures
11.5.2 User identification and authentication
11.5.3 Password Management system
11.5.4 Use of system utilities
11.5.5 Session Time-out
11.5.6 Limitation of connection time
11.6 Application access control
11.6.1 Information access restriction
11.6.2 Sensitive system isolation
11.7 Mobile Computing and Teleworking
11.7.1 Mobile computing and communication
11.7.2 Teleworking
"This work is copyright © 2007, ISO27k implementers' forum, some rights reserved. It is licensed under the Creative Commons Attribution-Noncomme
and create derivative works from this provided that (a) it is not sold or incorporated into a commercial product, (b) it is properly attributed to the ISO27k
shared under the same terms as this.).
7/27/2019 SOA - Declaración de aplicabilidad
http://slidepdf.com/reader/full/soa-declaracion-de-aplicabilidad 6/7
Statement of Applicability (SOA)
Sec Objective/Control
12.1Security Requirements of Information
SystemsSe especifica como parte de los requerimientos no funcionales en los proyectos de soluciones TI.
12.1.1Security requirement analysis and
specificationsEl análisis y especificación es incipiente, usualmente se deja para el final.
12.2 Correct Processing in ApplicationsSe está tratando de lograr el CMMI Nivel 2 en la gestión de soluciones TI. Las actividades de ingenie
modelo RUP.
12.2.1 Input data validationDe acuerdo a las reglas de negocio por razones de integridad. En las aplicaciones Web se realiza aná
siguiendo los lineamientos OWASP. Aún no se dispone de buenas práticas de codificación segura.
12.2.2 Control of internal processing El proceso de control de calidad sólo se aplica luego de la construcción, y eventualmente está a carg
12.2.3 Message integrity En sistemas sensibles los mensajes son firmados digitalmente.
12.2.4 Output data validat ion No está formalizado, se realiza en forma ad-hoc y a criterio del equipo de desarrollo.
12.3 Cryptographic controls Se hace uso de infraestructura PKI, para sistemas sensibles
12.3.1Policy on the use of cryptographic
controlsEstá contemplado en la política, más no se tiene mayor detalle.
12.3.2 Key Management Se dispone de procedimiento para la gestión de llaves y certificados digitales.
12.4 Security of System Files Usualmente basado en los mecanismos de control de acceso y respaldo de información.
12.4.1 Control of Operational software El acceso está restringido a los administradores y está basado en los mecanismos inherentes a estos
LR: legal requirements, CO: contractual obligations, BR/BP: business requirements/adopted best practices, RRA: results of risk assess
ISO 27001:2005 Controls Comments (Description of implementation / Justification for exclusio
7/27/2019 SOA - Declaración de aplicabilidad
http://slidepdf.com/reader/full/soa-declaracion-de-aplicabilidad 7/7
Statement of Applicability (SOA)
Sec Objective/Control
LR: legal requirements, CO: contractual obligations, BR/BP: business requirements/adopted best practices, RRA: results of risk assess
ISO 27001:2005 Controls Comments (Description of implementation / Justification for exclusio
12.4.2 Protection of system test data No está formalizado, se actúa a pedido del usuario.
12.4.3 Access control to program source library Se hace uso de software de control de versiones (CCC/Harvest), a cargo de su administrador
12.5Security in Development & Support
Processes
12.5.1 Change Control ProceduresEl proceso de desarrollo incluye el manejo de cambios en los proyectos. El Proceso de aseguramient
cumplimiento.
12.5.2 Technical review of applications after Operating system changes
No es prática usual.
12.5.3Restrictions on changes to software
packagesProcedimiento de control de cambios.
12.5.4 Information Leakage Está en proyecto la implementación de mecanismos DLP.
12.5.5 Outsourced Software Development Se trabaja con fábricas de software, pero no está establecido lo referente a propieda intelectual.
12.6 Technical Vulnerability ManagementEn las aplicaciones Web se realiza análisis de vulnerabilidades siguiendo los lineamientos OWASP. A
práticas de codificación segura.
12.6.1 Control of technical vulnerabilitiesEn las aplicaciones Web se realiza análisis de vulnerabilidades siguiendo los lineamientos OWASP. A
práticas de codificación segura.
"This work is copyright © 2007, ISO27k implementers' forum, some rights reserved. It is licensed under the Creative Commons Attribution-Noncommer
reproduce, circulate, use and create derivative works from this provided that (a) it is not sold or incorporated into a commercial product, (b) it is properly a
www.ISO27001security.com), and (c) derivative works are shared under the same terms as this.).
