10. Communications & Operations Management
Operating procedures have been documented, are maintained and are made available to all users who need them
Changes to information processing facilities and systems are controlled
Duties and areas of responsibility are segregated to reduce opportunities for unauthorized or unintentional modification or misuse of organisational assets
1. Risk Assessment Adlin Hisyamuddin - Information Security Manager, Head PKI
2. Authorisation of Controls Mubarak Abdulla Alhiddi - CSO/CIO
3. Change Initiation Ahmed Essa Abualfath - Computer Security Administrator
4. Change Management Shaikh Salman Mohammed Al-Khalifa – Director General of IT
5. Network Management Khalid Al Othman – Chief, Network
6. Network Administration Khalid Ali Al Jalahma – Network Administrator
7. IT Operations Mohammed Al-Yassi – Director IT Operations
8. Software Development Sameh Abo-El-Ela
9. System Testing Osama Khalid Rafai - Computer Security Administrator
10. Employee Administration Hesham Al-Ghatam - Chief, Personnel & Admin’ Development
11. Asset Purchase Khulood Al-Jassim - Supervisor Administration Service
12. Site/Secure Area Security Adel Khalifa Bu-Alai - Chief of Police in Juffair
13. Site/Secure Area Security Mohammed Hamdan Mohammed - Chief of Police in Isa Town
14. Security Audit Osama Khalid Rafai - Computer Security Administrator
15. PKI Manager Adlin Hisyamuddin - Information Security Manager, Head PKI
16. Physical Site Security Yousif Mohammed Ali Muthanna – Site Security Manager
17. Physical Site Security Yousif Mohammed Abdulla – Site Security Manager
Development, test and operational facilities are separated to reduce the risks of unauthorized access or changes to the operational system
Control objective: to implement and maintain the appropriate level of information security and service delivery in line with third party service delivery agreements
The Organization ensures that the security controls, service definitions and delivery levels included in the third party service delivery agreement are implemented, operated and maintained by the third party
The Organisation regularly monitors and reviews the services, reports and records provided by third parties and carries out regular audits
The Organisation manages changes to the provision of services, including maintaining and improving existing information security policies, procedures and controls, taking account of the criticality of business systems and processes involved and re-assessment of risks, and the procedures for doing this are contained in DOC 6.8.
Control objective: to minimize the risks of systems failures
DOC 10.10 sets out the Organisation’s approach to ensuring that the use of resources is monitored, tuned, and projections made of future capacity requirements to ensure the adequate system performance.
Acceptance criteria for new information systems, upgrades and new versions have been established and suitable tests of the system(s) are carried out during development and prior to acceptance, all as specified in DOC 10.10. rotection
Control objective: to protect the integrity of software and information
Detection, prevention and recovery controls to protect against malicious code and appropriate user awareness procedures have been implemented
The execution of mobile code is prohibited in the Trust Centre
Control objective: to maintain the integrity and availability of information and information processing facilities
Back-up copies of information and software are taken and tested regularly in accordance with the agreed back-up policy below
Control objective: to ensure the safeguarding of information in networks and the protection of the supporting infrastructure
Networks are managed and controlled as set out in DOC 10.14, in order to be protected from threats, and to maintain security for the systems and applications using the network, including information in transit
Security features, service levels and management requirements of all network services have been identified and included in the network service level agreement and are managed in line with DOC 10.14.
Control objective: to prevent the unauthorized disclosure, modification, removal or destruction of assets and interruption to business activities
Procedure DOC 10.15 identifies the controls for the management of removable media.
Media are disposed of securely and safely when no longer required, in line with DOC 9.11.
Procedures for the handling and storage of information are set out in DOC 7.6 and DOC 10.15 to protect this information from unauthorized disclosure or misuse
System documentation is protected against unauthorized access, as set out in DOC 10.15.
Control objective: to maintain the security of information exchanged within an organization and with any external entity
Formal exchange policies, procedures and controls are in place to protect the exchange of information through the use of all types of communication facilities
Agreements are established in line with DOC 6.8 for the exchange of information and software between the Organization and external parties
DOC 9.12 sets out how the Organization ensures that media are protected against unauthorized access, misuse or corruption during transportation beyond the Organization physical boundaries
Messaging is outbound only and no inbound email system exists within the CIO Trust Centre
A policy and procedures have been developed and implemented to protect information associated with the interconnection of business information systems.
Control objective: to ensure the security of electronic commerce services, and their secure use
Electronic commerce information passing over public networks is protected from fraudulent activity, contract dispute, and unauthorized disclosure and modification as set out in DOC 10.17.
Information involved in on-line transactions is protected in line with DOC 10.17 to prevent incomplete transmission, mis-routing, unauthorized message alteration, unauthorized message duplication or replay
The integrity of information being made available on a publicly available system is protected in DOC 10.17 to prevent unauthorized modification
Control objective: to detect unauthorized information processing activities
Audit logs recording user activities, exceptions and information security events are produced and kept, in line with DOC 10.18, for a period specified in DOC 15.2 to assist in future investigations and access control monitoring
Procedures for monitoring use of information processing facilities have been established in DOC 10.18 and the results of the monitoring activities are reviewed [regularly]
Logging facilities and log information are protected against tampering and unauthorized access, as required by DOC 10.18
System administrator and system operator activities are logged as required by DOC 10.18
Faults are logged, analysed and appropriate action taken, all in line with DOC 10.18
The clocks of all relevant information processing systems within the organisation are synchronized with an agreed accurate time source as specified in DOC 10.18.
Adlin Hisyamuddin
Information Security Manager
____________________________
On:
08 November, 2007
____________________________
Change history
Issue 1 08 November, 2007 Initial issue