DSS05 Manage Security Services

DSS05.01 Protect against malware.

Implement and maintain preventive, detective and

corrective measures in place (especially up-to-date

security patches and virus control) across the enterprise

to protect information systems and technology from

malware (e.g., viruses, worms, spyware, spam).

DSS05.02 Manage network and

connectivity security.

Use security measures and related management

procedures to protect information over all methods

of connectivity.

DSS05.03 Manage endpoint security.

Ensure that endpoints (e.g., laptop, desktop, server,

and other mobile and network devices or software)

are secured at a level that is equal to or greater than

the defined security requirements of the information

processed, stored or transmitted.

DSS05.04 Manage user identity and logical access.

Ensure that all users have information access rights

in accordance with their business requirements and

co-ordinate with business units that manage their own

access rights within business processes.

DSS05.05 Manage physical access to IT assets.

Define and implement procedures to grant, limit

and revoke access to premises, buildings and areas

according to business needs, including emergencies.

Access to premises, buildings and areas should be

justified, authorised, logged and monitored. This should

apply to all persons entering the premises, including

staff, temporary staff, clients, vendors, visitors or any

other third party.

DSS05.06 Manage sensitive documents and

output devices.

Establish appropriate physical safeguards, accounting

practices and inventory management over sensitive IT

assets, such as special forms, negotiable instruments,

special-purpose printers or security tokens.

DSS05.07 Monitor the infrastructure for

security-related events.

Using intrusion detection tools, monitor the infrastructure

for unauthorised access and ensure that any events are

integrated with general event monitoring and

incident management.

Reference: ISACA. (2012). COBIT 5 Enabling Processes. USA: ISACA.