Exchange of Information

Objective

Secure the information and software exchanged within the organization and with any external entity.

Policy

Secure methods shall be implemented for exchanging information with external organizations. Controls shall be implemented to safeguard information in transit between the corporation and any external organizations including physical transport of information and/or software or electronic transport of information and/or software.

Standard

A. Users shall be made aware, through a variety of methods including electronic, verbal, and written communication of the security risks associated with information exchange.

B. Forwarding of Enterprise e-mail containing sensitive information to external e-mail accounts should not be executed, unless security options are included to encrypt information in attached files, or to provide limited information that requires verbally communicated additional information to utilize the sensitive information.

C. Cryptographic methods shall be used to protect the confidentiality, integrity, and availability of sensitive information.

D. Users shall be informed of clear-screen / clear desk practices in order to avoid unintentional and/or unauthorized disclosure of information when systems or work areas are left unattended.

E. Only verifiable, auditable, and secure means of transport shall be used when it is necessary to send information via courier.

F. Blind copying should be used for mass email distributions that include third party accounts. NOTE: Blind copying is a good practice for all mass email distribution, including those sent to internal addresses.

H. Sensitive information shall only be transmitted according to the requirements documented above in item B.

I. Intellectual property shall be safeguarded in accordance with legislative, regulatory, contractual and organizational requirements.

Monitoring

Objective

Detect unauthorized information processing activities.

Policy

System activity shall be monitored. Additional steps shall be taken to monitor system administration activity and systems faults.

Standard

A. Audit logs shall be produced that record user activities, exceptions, and information security events.

B. Activities of privileged users and of the system operators shall be logged and made available for review.

Guideline

A. Security events to be logged may include:

i. Failed access attempts

ii. Abnormal values being assigned to data values

iii. Attempts to change sensitive information

iv. Excessive use of data

v. Invalid entries into the event log

vi. Access using rarely used IDs or access to IDs that are generic

vii. Changes to system configurations

viii. Alarms raised

ix. Use of monitored system utilities or privileges.

B. Audit and event logs shall be reviewed using tools to assist with log collection, parsing and alerting.

C. Logs may be collected by a centralized log server or media.

D. Intrusion detection and prevention engines shall be updated on a regular basis.