Security Appendix - Revision history

Tam Tran Thanh: /* Employee access control measures to the information system (authentication using identifiers, strong passwords) */

2019-07-24T17:01:41Z

Employee access control measures to the information system (authentication using identifiers, strong passwords)

← Older revision		Revision as of 17:01, 24 July 2019
Line 23:		Line 23:
	[https://docs.google.com/document/d/1ipbV1zPnUtkQxCJl4bjtQLeFvnwPAvoTPuKrj5Arzts/edit?usp=sharing Remote access policy]		[https://docs.google.com/document/d/1ipbV1zPnUtkQxCJl4bjtQLeFvnwPAvoTPuKrj5Arzts/edit?usp=sharing Remote access policy]

	[https://docs.google.com/document/d/1rXlOsyFSbtK4IVAQWdpBwRTw-FtWtpbdg2RcW55ouvA/edit?usp=sharing ~~password~~ policy]		[https://docs.google.com/document/d/1rXlOsyFSbtK4IVAQWdpBwRTw-FtWtpbdg2RcW55ouvA/edit?usp=sharing Password policy]

	== Traceability of connections and actions==		== Traceability of connections and actions==

Tam Tran Thanh: /* Commitments of confidentiality of the collaborators */

2019-07-24T17:01:24Z

Commitments of confidentiality of the collaborators

← Older revision		Revision as of 17:01, 24 July 2019
Line 1:		Line 1:
	== Commitments of confidentiality of the collaborators==		== Commitments of confidentiality of the collaborators==
	Employees are expected to sign the confidentiality statement signed at the very beginning of their journey		Employees are expected to sign [https://drive.google.com/open?id=1FUAPlI3_lUwEYginzC4PHE3MHxSkNp2b the confidentiality statement] signed at the very beginning of their journey


	== Protection measures for applications and servers==		== Protection measures for applications and servers==

Tam Tran Thanh: /* Employee access control measures to the information system (authentication using identifiers, strong passwords) */

2019-07-24T16:51:11Z

Employee access control measures to the information system (authentication using identifiers, strong passwords)

← Older revision		Revision as of 16:51, 24 July 2019
Line 18:		Line 18:

	== Employee access control measures to the information system (authentication using identifiers, strong passwords)==		== Employee access control measures to the information system (authentication using identifiers, strong passwords)==
	Security Training Awareness		[https://docs.google.com/presentation/d/1tLhfFzQ3F5JRhsA5mton-Pb_dR75tIQTxtCv9t2SgLM/edit Security Training Awareness]
	~~Access control policy~~
	~~Remote access policy~~
	~~password policy~~

			[https://drive.google.com/open?id=11RM-CoDgTPcn6zxtaAF_H-suDVQK9O6U6veJh7WY1es Access control policy]

			[https://docs.google.com/document/d/1ipbV1zPnUtkQxCJl4bjtQLeFvnwPAvoTPuKrj5Arzts/edit?usp=sharing Remote access policy]

			[https://docs.google.com/document/d/1rXlOsyFSbtK4IVAQWdpBwRTw-FtWtpbdg2RcW55ouvA/edit?usp=sharing password policy]

	== Traceability of connections and actions==		== Traceability of connections and actions==

Tam Tran Thanh: /* Protection measures for applications and servers */

2019-07-24T16:49:33Z

Protection measures for applications and servers

← Older revision		Revision as of 16:49, 24 July 2019
Line 4:		Line 4:

	== Protection measures for applications and servers==		== Protection measures for applications and servers==
	Applications: Access control policy & Policy for IT Asset Management		Applications: [https://drive.google.com/open?id=11RM-CoDgTPcn6zxtaAF_H-suDVQK9O6U6veJh7WY1es Access control policy] & [https://docs.google.com/document/d/1cwWh_IaEFti76v-2xsBy06D6BOn8WerWlATAntsB6YI/edit?usp=sharing Policy for IT Asset Management]


	Server & network services:		Server & network services:

	Users Guidelines (Policy) to access Officience network services: Network access guideline		Users Guidelines (Policy) to access Officience network services: [https://docs.google.com/document/d/175tliaOsuAS12FoF5KNiaE3AtyaWA-FlHkqmD5gPGqo/edit?usp=sharing Network access guideline]

	Security controls implemented to protect servers & network services: Network access control - implementation		Security controls implemented to protect servers & network services: [https://docs.google.com/document/d/1xYpCvPqfxwQmB0Q0K78_uPR0LPmlpuTQUJr4IBsaHUA/edit?usp=sharing Network access control - implementation]

	Vulnerabilities scanning & management for the information infrastructure( servers, desktops, network devices, web applications,..): Vulnerability Management Policy		Vulnerabilities scanning & management for the information infrastructure( servers, desktops, network devices, web applications,..): [https://docs.google.com/document/d/1yio-NRfwghpzMWiGM2MCCRsdgzrD07PHXeTsb54nwWU/edit?usp=sharing Vulnerability Management Policy]

	~~Security incidents management: Security Incident Response Policy~~

			Security incidents management: [https://docs.google.com/document/d/1ZK7HPrdD8QCrNcroAkvNOzwtz4YNgVpMPtJEv5anhyU/edit# Security Incident Response Policy]

	== Employee access control measures to the information system (authentication using identifiers, strong passwords)==		== Employee access control measures to the information system (authentication using identifiers, strong passwords)==

Tam Tran Thanh: Created page with "== Commitments of confidentiality of the collaborators== Employees are expected to sign the confidentiality statement signed at the very beginning of their journey == Protec..."

2019-07-24T16:45:29Z

Created page with "== Commitments of confidentiality of the collaborators== Employees are expected to sign the confidentiality statement signed at the very beginning of their journey == Protec..."

New page

== Commitments of confidentiality of the collaborators==
Employees are expected to sign the confidentiality statement signed at the very beginning of their journey

== Protection measures for applications and servers==
Applications: Access control policy & Policy for IT Asset Management

Server & network services:

Users Guidelines (Policy) to access Officience network services: Network access guideline

Security controls implemented to protect servers & network services: Network access control - implementation

Vulnerabilities scanning & management for the information infrastructure( servers, desktops, network devices, web applications,..): Vulnerability Management Policy

Security incidents management: Security Incident Response Policy

== Employee access control measures to the information system (authentication using identifiers, strong passwords)==
Security Training Awareness
Access control policy
Remote access policy
password policy

== Traceability of connections and actions==
=== Log Collects===
At Officience, we implement a central log system (Logstash + Elasticsearch + Kibana) to collect activities log of information facilities. It includes:

- Web server & application access log

- linux server access/system log

- windows server access log

- firewall access/activities log

Log servers are protected & can be accessed only from ITS Desktops as well as from IP that approve and open access rule from ITS

The following we can track in audit log:

- User ID

- Dates, times, details of the events

- System identity and location

- Network address & protocol

- successful or unsuccessful access attempt

- use of privileges

=== Log Review: daily, monthly & on-demand===
Logs are kept on elasticsearch cluster that support failover. They are stored as daily indices, and we keep it for a minimum of 6 months

Servers Clock are synchronized with ntp server. Desktops clock are synchronized with Windows AD server

We implement a nagios monitoring system to monitor the use of the information systems, send alerts to our support team as soon as we got issues. It includes:

- Monitor the running of servers, firewalls, applications

- Monitor WAN interface

- Monitor the use of running systems ( cpu load, hard disk, ..)