This Is An Information Security Consulting Assignment

Question:

Background:

This is an INFORMATION SECURITY CONSULTING assignment. So, assign a tutor who is really good at this subject as this is a really important assignment. The word count is 4000 words. Also, I want a plagiarism report along with the solution.

You will be given a case scenario about a fictional company. You will be required to submit a COMPREHENSIVE CONSULTING PROPOSAL to the company that addresses their needs and concerns.

The proposal should have the following sections (maximum of 9 pages not including title page, references and appendices. Each section must start on a new page):

1. Title page
2. Executive summary (maximum of 1 page)
3. Information security risk management
4. Information security strategy
5. Information security policy
6. Information security education, training and awareness (SETA)
7. References

Further:

Sections 3, 4, 5 and 6 must be divided into two sub-sections:

• Case analysis (The problem)
• Potential consulting services.(A solution from a consultant perspective)

Please do not engage in cost-estimation of any kind, and you can assume that you have access to personnel with the skills required to carry out the proposed services.

Use do not need academic references to support your arguments. However, all references you do use should be formatted in Harvard style.

How does the organization want to protect its primary asset should be the main perspective while drafting the solution. How is it going to deal with the risk of knowledge, that somebody will steal their capability. If you think that their capability can be protected by the IT team by simply putting more controls on the corporate IT Structure and completely ignore the rest of the organization, that is a mistake. Think from every perspective while drafting the answer.

The answer should not be general at all, they should be linked to the case and then explaining the same i.e. substantiate where the answer is coming from, in

terms of theories and principles.

The main answers have to be derived from the case scenario provided only. Just for some additional info i.e. for digging deeper into a problem for a particular answer, I have linked the other 2 documents which are the policies along with the case scenario. Please make sure all the guidelines are followed.

IT Incident Response Plan

This Incident Response Plan is documented to provide a well-defined, organized approach for handling any potential threat to computers and data, as well as taking appropriate action when the source of the intrusion or incident at a third party is traced back to the TextileTech private network. This Incident Response Plan identifies and describes the roles and responsibilities of the Incident Response Team. The Incident Response Team is responsible for putting the plan into action.

Incident Response Team

The Incident Response Team is established to provide a quick, effective and orderly response to computer related incidents such as virus infections, hacker attempts and break-ins, improper disclosure of confidential information to others, system service interruptions, breach of personal information, and other events with serious information security implications.

The Incident Response Team’s mission is to prevent a serious loss of profits, client confidence or information assets by providing an immediate, effective and skilful response to any unexpected event involving computer information systems, networks or databases.

The Incident Response Team is authorized to take appropriate steps deemed necessary to contain, mitigate or resolve a computer security incident. The Incident Response Team is responsible for investigating suspected intrusion attempts or other security incidents in a timely, cost-effective manner and reporting findings to management and the appropriate authorities as necessary. The IT Manager will coordinate these investigations.

Incident Response Team Members

IT Manager

Network Administrator Systems Administrator Help Desk Officer Legal Counsel

Incident Response Team Notification

For ease of reporting, and to ensure a timely response 24 hours a day, seven days a week, the IT Department Help Desk will act as the central point of contact for reporting any incidents.

All computer security incidents reported to Help Desk must be reported to the IT Manager. A preliminary analysis of the incident will take place by the IT Manager that will determine whether Incident Response Team activation is appropriate.

Types of Incidents

There are many types of computer incidents that may require Incident Response Team activation. Some examples include:

• Breach of personal information
• Denial of service/Distributed denial of service
• Excessive port scans
• Firewall breach
• Virus outbreak

Breach of Personal Information — Overview

This Incident Response Plan outlines steps our organization will take upon discovery of unauthorized access to personal information on an individual that could result in harm or inconvenience to the individual such as fraud or identity theft. The individual could be either a client or employee of TextileTech

Personal information is information that is, or can be, about or related to an identifiable individual.

It includes any information that can be linked to an individual or used to directly or indirectly identify an individual. Most information the firm collects about an individual is likely to be considered personal information if it can be attributed to an individual.

Personal information is defined as an individual’s first name or first initial and last name, in combination with any of the following data:

• Driver’s license number or Identification Card number
• Financial account number, credit or debit card number
• Home address or e-mail address
• Medical or health information

Definitions of a Security Breach

A security breach is defined as unauthorized acquisition of data that compromises the security, confidentiality or integrity of personal information maintained by TextileTech. Good faith acquisition of personal information by an employee or agent of our company for business purposes is not a breach, provided that the personal information is not used or subject to further unauthorized disclosure.

Employee Responsibilities

All firm employees must report any suspected or confirmed breach of personal information on individuals to the IT Department immediately upon discovery. This includes notification received from any third-party service providers or other business partners with whom the organization shares personal information on individuals.

The employee reporting the suspected breach will assist in acquiring information, preserving evidence and providing additional assistance as deemed necessary by the IT Manager or other Incident Response Team members throughout the investigation.

Classification / Identification of a Potential Incident

All reports of a potential incident shall be classified as a high/medium/low risk to facilitate the actions to take. Criticality: High

Definition: Incidents that have a monumental impact on the firm’s business or service to clients. Example: Unauthorized system access.

Criticality: Medium

Definition: Incidents that has a significant or has the potential to have a monumental impact on the firm’s business or service to its clients.

Example: Password cracking attempt.

Criticality: Low

Definitions: Incidents that has the potential to have a significant or monumental impact on the firm’s business or service to its clients.

Example: Firewall scanning.

2

Response

Once a potential incident has been reported, the appropriate member of the IT Department should be notified for response. Members of the IT Department will be responsible for performing the initial investigation to determine if an incident has occurred. The following checklist identifies steps that can be used to facilitate in classifying the incident, if one in fact has occurred:

• Collection and review of log files
• Review of installed or running privileged programs
• Inspection for system file tampering
• Sniffer or Network Monitoring Programs reports
• Detection of unauthorized services installed on systems
• Evidence of password file changes
• Review system and network configurations
• Detection for unusual files
• Examination other hosts

Note: In responding to a reported incident, it may be good prudence to shut down any or all systems for the stopping of an attack in real time and/or the preservation of any potential forensic evidence.

Recovery

The main purpose of this Incident Response Program is to ensure an efficient recovery through the eradication of security vulnerabilities and the restoration of repaired systems. Recovery includes the ensuring the attacker’s point of penetration and any associated vulnerabilities have been eliminated and all system operations have been restored.

Periodic Testing & Remediation

It is the responsibility of the IT Department to test and review the Incident Response Plan quarterly. When testing is done, each system should be scanned for the open vulnerability before remediation and then scanned again after the remediation to verify that the vulnerability has been eliminated.

Incident Response Plan Example

This document discusses the steps taken during an incident response plan.

• Anyone who discovers the incident will contact the IT Help Desk. The Help Desk will log:

1. Name of caller or source of incident alert (software notifications).
2. Time of first
3. Nature of the incident.
4. What system(s) or persons were involved?
5. Location of equipment or persons
6. How incident was

• The IT staff member who received the call will refer to their contact list for Incident Response Team to be contacted. The IT Help Desk will contact those designated on the list. The IT Help Desk will contact the IT Manager using both email and phone messages. The IT Help Desk will log the information received. The IT Help Desk could possibly add the following information to the report:

1. Is the equipment affected business critical?
2. What is the severity of the potential impact?
3. Name of systems being targeted, along with operating system, IP address, and3

location.

1. IP address or any other information about the origins of the

• Contacted members of the response team will meet or discuss the situation over the telephone and determine a response

1. Is the incident real or perceived?
2. Is the incident still in progress?
3. What data or property is threatened and how critical is it?
4. What is the impact on the business should the attack succeed? Minimal, serious, or critical?
5. What system or systems are targeted, where are they located physically and on the network?
6. Is the incident inside the trusted network?
7. Is the response urgent?
8. Can the incident be quickly contained?
9. Will the response alert the attacker and do we care?
10. What type of incident is this? Example: virus, worm, intrusion, abuse, damage.

• An incident ticket will be created. The incident will be categorized into the highest applicable level of one of the following categories:

1. High – Incidents that have a monumental impact on the firm’s business or service to clients.
2. Medium – Incidents that has a significant or has the potential to have a monumental impact on the firm’s business or service to its
3. Low – Incidents that has the potential to have a significant or monumental impact on the firm’s business or service to its

• Member of the IT Department will use investigative techniques, including reviewing of system logs, looking for gaps in logs, reviewing intrusion detection or firewall logs and interviewing witnesses to determine how the incident was caused. Only authorized personnel should be performing interview or examining IT systems. A chain of custody must be established and all potential evidence preserved and secured for turnover to proper

• Incident Response Team will recommend changes to prevent the occurrence from happening again or spreading to other systems.

• The IT Department will restore the affected system(s) to the pre-incident state and assess potential

• Post-mortem review of response and update policies – take preventive steps so the incident doesn’t happen
  1. Would an additional policy have prevented the incident?
  2. Was a procedure or policy was not followed which allowed the incident? What could be changed to ensure that the procedure or policy is followed in the future?

1. Was the incident response appropriate? How could it be improved?
2. Was every appropriate party informed in a timely manner?
3. Were the incident-response procedures detailed and did they cover the entire situation? How can they be improved?
4. Have changes been made to prevent another incident? Have all systems been patched, systems locked down, passwords changed, anti-virus updated, email policies set, ?
5. Should any security policies be updated?
6. What lessons have been learned from this experience?

Company Policies

Information Security Policy

TEXTILETECH-61.00

DOCUMENT ID: TEXTILETECH-­‐61.00 Issue 1 Internal Use Only Page 1 of 20

Contents

• Introduction…………………………………………………………………………………….. 3
  • Commitment……………………………………………………………………………….. 3
  • Risk Management and benefits………………………………………………………….. 3
  • Scope……………………………………………………………………………………….. 4
• Requirements for Information Security…………………………………………………… 5
  • Information Security Management……………………………………………………… 6
  • Protection of classified company information………………………………………….. 7
  • Staff Awareness of Information Security………………………………………………. 8
  • Secure Network Architecture…………………………………………………………….. 9
  • Physical and Environmental Security………………………………………………….. 10
  • Security of IT Endpoints………………………………………………………………… 11
  • Security Design in Information Systems……………………………………………… 12
  • Access Control……………………………………………………………………………. 13
  • Information Security Reporting……………………………………………………….. 14
  • Collect and Review Access Logs……………………………………………………….. 15
  • ISMS Monitoring and Review…………………………………………………………… 16
  • Business Continuity Planning…………………………………………………………… 17
• Delegations……………………………………………………………………………………. 18
  • Governance and Support……………………………………………………………….. 18
    • Chief Executive Officer……………………………………………………….. 18
    • Chief Information Security Officer……………………………………………. 18
    • Information Security Manager………………………………………………. 18
  • Implementation…………………………………………………………………………. 18
    • Directors and General Managers……………………………………………. 18
    • All Staff…………………………………………………………………………. 18

Introduction

1.1 Commitment

The management of TEXTILETECH is committed to communicate, implement and enforce the following objectives for information security:

▌ Compliance with the TEXTILETECH Group information security policies and standards including:-

• TEXTILETECH Group Management Policy (GMP) – Information Security Management.
• TEXTILETECH Global Network Security Rules (GNSR), published on the

TEXTILETECH–Group Intranet.

▌ Compliance with Government legislation and regulations including those related to: the privacy of personal information; the protection of company information and financial records; the protection of critical IT Infrastructure and data from theft, tampering or misuse; the protection of copyright and intellectual property rights.

▌ Compliance with industry-standards for Information Security Management Systems and IT Security Controls when this is a critical business and/or customer requirement and is approved by the Executive Management Team. For example:

• ISO/IEC 27001:2013 – Information Security Management

▌ Preserving the confidentiality, integrity and availability of customer-owned or customer-specific data, especially when this has been entrusted to TEXTILETECH for safeguarding as part of a contract or agreement.

▌ Preventing harm to the TEXTILETECH and ARCTICFIBER brands and reputation by taking all reasonable measures to identify, assess and mitigate any serious risks that might cause loss, damage or leakage of sensitive company information.

▌ Developing “good-practice” business-processes related to information security management that are efficient, effective and integrated with normal operational procedures.

1.2 Risk Management and benefits

This company-level policy is designed to mitigate the risk of:

▌ Prosecution or penalty for breach of government legislation or regulation.

▌ Financial penalty or sanction for:

• breach of industry regulation

• non-performance related to contract terms and conditions
• breach of Intellectual Property Rights (IPR) or Copyright

▌ Damage to company reputation or brand due to a media-publicised security- breach.

▌ Loss of:

• business opportunities due to a media-publicised security-breach
• productivity (disruption of business-operations) due to a major security incident
• competitive-advantage or future-revenues due to leakage of sensitive information
• future-revenues due to theft or leakage of company intellectual property (IP)
• business viability due to a catastrophic and unexpected disaster-event

1.3 Scope

This policy applies to all executives and employees of TEXTILETECH as well as all contractors, consultants, temporaries, trainees, visitors and any other third parties working for the Company while accessing the Company’s Information Assets.

Company Policies Information Security Policy

Requirements for Information Security

TEXTILETECH’s Information Security Policy is designed to protect the confidentiality, integrity and availability of company information, including proprietary information and information entrusted to the company for safeguarding by customers, business partners or suppliers.

To achieve this goal the company has implemented a defence-in-depth strategy organised into 12 control objectives.

1. Manage information security at all levels of the organisation, as an effective business process, in accordance with business requirements, relevant laws and
2. Maintain effective controls to prevent information leakage or unauthorised tampering of company information at all stages of the information-lifecycle (creation, editing, distribution, storage, archive, and disposal) regardless of media-type.
3. Maintain an effective security program (policies, procedures, guidelines, education and training) to ensure that all employees, contractors and service-providers are aware of typical workplace security threats or vulnerabilities and their security-related roles and
4. Maintain secure network architecture to protect classified company information during transmission and
5. Restrict physical access to secure areas and critical information systems. Ensure that critical information systems are protected from environmental hazards, disruption of ancillary services and are located in an approved IT Facility.
6. Ensure that all IT endpoints and portable “Smart Devices” are adequately configured

(hardened); effectively controlled by Corporate IT; and stored company data is, at all times, forcibly encrypted.

7. Develop and maintain secure information systems and business
8. Apply strong logical-access controls to information systems and IT
9. Detect, classify, record and promptly respond to all security
10. Track, monitor and record all access to classified company information. Detect and prevent unauthorised use of the company’s IT
11. Regularly monitor, review, audit and improve the security
12. Ensure that business-critical data and information systems are accessible, as required, to support business operations and that all critical information assets are recoverable as part of an agreed disaster-recovery

Associated with each control objective is a set of requirements that together form the TEXTILETECH Information Security Policy.

The requirements are derived from the Group Management Policies (GMP) that apply to the TEXTILETECH Group as a whole, including all subsidiaries.

The Information Security Policy is supported by a set of company-level documents that describe the “systems and processes” in place to achieve the above security objectives. These documents are published on the Intranet.

Control Objective: Manage information security, at all levels of the organisation as an effective business process, in accordance with business requirements, relevant laws and regulations.

▌ All managers are responsible to ensure that the security measures outlined in this policy are implemented effectively within their business-unit and must actively support the activities and objectives of the Information Security Management business process.

▌ Senior managers and IT Asset Owners are responsible to ensure that there are sufficient resources to implement and operate the security controls effectively and that these resources are trained, qualified, skilled, and competent to perform their required tasks.

▌ The Chief Information Security Officer (CISO) has overall responsibility to sponsor and support a company-level Information Security Management System (ISMS) that is aligned with this security policy and achieves the business objectives outlined in section 1.1.

▌ The CISO is responsible to ensure that company-level security policies are developed and to monitor and review the performance of the Information Security Management Systems.

▌ The CISO is responsible to designate the company-level role of Information Security Manager with roles and responsibilities defined, as a minimum, by TEXTILETECH Group.

▌ Each Director must designate a “security representative” who will actively participate in an “Information Security Steering Committee (ISSC)” and assist to achieve the company security objectives.

▌ The Information Security Manager (ISM) is responsible to co-ordinate the activities of the ISSC and to provide the security related reports, metrics, KPI’s to each ISSC meeting.

▌ The objective of the Information Security Management process is to ensure that the company level ISMS is implemented, operated, monitored and improved efficiently and effectively. Also, that all major risks related to information security are identified, assessed, analysed and reported to the responsible Director for either mitigation or acceptance.

Control Objective: Protect classified company information at all stages of the asset-lifecycle (creation, sharing, distribution, storage, archival, and disposal) regardless of media-type

▌ Employees who have a job-requirement to collect, handle, store, dispose and disclose the personal information of customers or other employees must apply the strict measures described in the security policies & procedures below and comply at all times, with the relevant laws and Government guidelines.

▌ Company information must be classified in terms of its value, sensitivity and criticality to the organisation.

▌ Company information that is not valuable, sensitive or critical has no business impact if it is lost, damaged, stolen, altered or disclosed and does not need to be classified or controlled.

▌ Classified company information must be assigned an owner and labelled appropriately to ensure that it is handled, shared, distributed, edited, stored and disposed of securely.

▌ Classified company information must be encrypted when it is taken, stored or used outside the company. This general principle applies irrespective of the transmission-medium or physical storage device.

▌ It is prohibited to store classified company information on any personal- owned equipment unless the equipment meets the Corporate IT policy for an approved BYOD device.

▌ Classified company information that is no longer sensitive or critical must be de-classified and all labelling removed.

▌ De-classified or non-classified company information that no longer serves any useful purpose and there is no regulatory requirement for it to be archived must be disposed of or permanently destroyed by an approved method(s).

Control Objective: Maintain security policies, procedures, guidelines and training programs to ensure that all employees, contractors and third parties are aware of their security roles and responsibilities

▌ Managers are responsible to communicate and explain the security policy to Staff either individually or as part of regular team meetings, operational reviews etc.

▌ TEXTILETECH employees will receive general Security Awareness Training as part of the “Staff Induction Program” when they join the company. The employee is required to read, agree and sign that they will comply with the security policy and associated security controls.

▌ TEXTILETECH employees will receive annual Security Awareness Training specific to their workplace or job-responsibilities. This training may be delivered using an e-learning platform or as part of team-meetings. In all cases, the employee is required to read, agree and sign that they will comply with any workplace-specific or job-related security controls.

▌ Information about the Security Policy and related controls that is useful and relevant to all Staff will be promptly published and announced to Staff. The announcements will be made using e-mail, the Intranet, social-media tools or by posters pinned to “Staff Noticeboards” in high-visibility areas.

▌ Positions that have specific roles and responsibilities related to information security will have these requirements documented in the relevant Position Description (PD) and any new assignee to this position or role will need to read, agree and sign the PD.

▌ Positions that require administrator-level access to classified information will be identified and all candidates for these positions shall be subject to security- screening as part of the employee recruitment process.

▌ Rules for the acceptable use of IT Systems and the Internet shall be defined and communicated to all Staff as part of the Security Awareness Program. Any activities that would abuse or damage the IT Infrastructure or any high-risk activities that are strictly prohibited shall also be defined and communicated to all Staff periodically.

▌ Employees are required to comply with the Information Security Policy at all times. The company will exercise the right to monitor and audit the activities of employees and to retain logs of these activities in the event that a forensic investigation of a serious breach is needed

Control Objective: Maintain secure network architecture to protect classified company information during transmission and storage

▌ A strict “need-to-access” principle will be applied to all requests for access to network services.

▌ Information systems that are directly accessible from the Internet will be installed in an isolated and controlled network segment (DMZ). All devices installed in the DMZ must comply with the TEXTILETECH Global Network Security Rules (GNSR) including:

• Operating Systems must be hardened to prevent known-vulnerabilities and close any unused services or
• Automatic OS and AV patch-management will be
• Strict Change Control procedures will be
• Regular AV scans will be performed (minimum is two per annum).
• All access to these systems will be logged and reviewed.
• All system log files will be collected, filtered, analysed and

▌ All communications and connections from the Internet to the internal network or DMZ must be logged and filtered by an IPS. The log files from the IPS must be securely stored to support a forensic investigation/audit if needed.

▌ Any Development/Test environment must be firewall-isolated from the internal network.

▌ Critical information systems must be connected to an isolated and controlled network segment that is designed to restrict access to only those users who have a legitimate business-need to access these systems. All access to these systems and network will be logged and reviewed.

▌ Employees must not connect any personal-owned device to the company’s internal network without obtaining prior approval from Corporate IT.

▌ IT endpoints that do not comply with the SOE (Endpoint) policy will be quarantined and prevented from connecting to network services until the non- compliance is resolved.

▌ The utilisation of network resources will be monitored and a formal Capacity Plan will guide investment in network upgrades to ensure that projected demand for network capacity is planned and budgeted in advance.

Control Objective: Restrict physical access to secure areas and critical information systems. Ensure that critical information systems

are protected from environmental hazards, disruption of ancillary services and are located in an appropriate Facility

▌ Entry/Exit to any company premises must be controlled and managed. All access must be logged (date and time stamped). Access logs must be securely archived.

▌ The site perimeter must be protected to ensure access is restricted to controlled entry/exit points.

▌ All office areas must be lockable with access controlled by key or EACS (preferred).

▌ Staff who work in office areas and store or handle classified company information must be provided with access to a lockable cabinet and secure document-disposal bins or shredder.

▌ Areas that are accessible by the public or authorised visitors must be monitored and controlled at all times. Visitors must be escorted while they are on-site and are not permitted to enter secure areas without permission or supervision. Public areas include visitor reception, meeting rooms, showrooms, boardrooms, loading bays, courier pickups etc.

▌ Every site must have a purpose-built IT Facility for safe and secure siting of IT Equipment and information assets.

▌ Access to the IT Facility or office areas must require “single factor authentication (SFA)” based on an employee-ID card (EACS) or key (with log- book).

▌ Classified company information and critical information systems must be located in the IT Facility.

▌ Sites that store critical customer-data; highly sensitive company information; and business-critical information systems must have a purpose-built, secure Data Centre.

▌ Access to the Data Centre must require “two factor authentication (TFA)” based on an employee-ID card (EACS) and a biometric scan (e.g. fingerprint, retina etc.).

▌ The IT Facility Manager is responsible to maintain the environmental conditions and utilities for the facility and to ensure this equipment is monitored and controlled.

Control Objective: Ensure that all IT endpoints and portable “Smart Devices” are appropriately configured, adequately hardened and are controlled by Corporate IT

▌ All IT endpoints (fileservers, PC’s, Laptops and Hybrid Laptop/Tablets) must be controlled and hardened by Corporate IT (CIT). Endpoint configuration must comply with the SOE (Endpoint) standard published by CIT. This includes automatic installation of:-

• All SOE software and
• All OS security-patches, as soon as these are released by the OS
• SOE Anti-Virus (AV) product, including regular and automatic installation of new AV signature-files.

▌ IT endpoints that do not comply with the SOE (Endpoint) standard are considered to be

“uncontrolled” and must be quarantined from the live environment.

▌ It is prohibited to connect a personal-owned IT endpoint to the live environment other than via the Remote Access (VPN) service provided by CIT.

▌ Any IT endpoint that is used off-site must have data-encryption software installed by CIT.

▌ All fileservers connected to the live environment must be registered, reviewed and approved by CIT, to ensure the device is appropriately hardened and complies with the SOE (Fileserver) standard.

▌ It is permitted to use a personal-owned (BYOD) Smart Device for mobile- working provided the Brand/Model is approved for business-use by CIT. Refer to CIT “white-list” of approved Smart Phones/Tablets.

▌ It is prohibited to install “unauthorised software” on any IT endpoint that connects to the live environment. This applies to BYOD and company-owned assets. Examples are:

• Illegal, unlicensed or inappropriate
• Material protected by copyright, trademark or
• Illegal or offensive
• Software that is specifically prohibited or “black-listed” by the

Control Objective: Develop and maintain secure information systems and business applications

▌ The security requirements for new information systems will be documented in the system design specification.

▌ The security requirements will consider the need to protect the confidentiality, availability and integrity of any company information that is stored or processed on the information system.

▌ The security requirements will consider the sensitivity of any information that needs to be shared with end-users or a third party; transmitted across networks; or archived; and will determine whether data-encryption controls are specified.

▌ Data validation of inputs and outputs will be designed and tested as part of the User Acceptance Testing (UAT) plans.

▌ The implementation of any new information system will strictly adhere to the formal Change Control process and will include a security risk assessment procedure.

▌ Access to Test Data will be controlled and the Test Data itself will be carefully selected and protected to ensure that it does not expose staff personal information or cause any leakage of classified company information.

▌ Access to source code will be strictly controlled and strong version-control of source code will be enforced by the Change Control process to ensure that only tested and authorised versions are released to the live environment.

▌ Development and testing of new information systems will be restricted to a Dev/Test environment that is firewall-isolated from the live environment. The rollout of a new information system from the Dev/Test environment to the live environment will be strictly controlled by the Change Control process.

Control Objective: Apply strong logical-access controls to information systems and IT Networks

▌ Access (Administrator, User or Guest) to IT systems, applications and networks must be controlled. Users must be uniquely identifiable and the user-identity must be authenticated before access-rights are granted.

▌ It is strictly prohibited for two or more employees to share a common or generic User-ID.

▌ The minimum requirement is “single factor authentication (SFA)” based on a User-ID and password.

▌ Access to the company’s internal network from a public network will require “two factor authentication (TFA)” based on a User-ID, token and password.

▌ All information systems, applications and networks must adopt the TEXTILETECH Group Password Policy for creating, resetting and managing user passwords. It is strictly prohibited for employees to be authenticated on the basis of a simple and/or static password. Complex, dynamic passwords (changed periodically) are required on all information systems that store and handle classified information.

▌ The user registration and de-registration process must be controlled for the entire life-cycle of the account.

▌ The de-registration process will be triggered whenever an employee terminates their employment (e.g. resignation, retirement, redundancy) or is transferred to a new role and access to an information asset is no longer a job-requirement.

▌ Access-rights to classified information must adhere to the “need-to-access” principle.

▌ Asset Owners will establish a formal procedure to review all access-control lists periodically (minimum period is yearly) and obsolete or unused accounts will be disabled or deleted.

▌ Default or temporary passwords will expire after the first session and the user will then be required to set a new password for subsequent sessions.

▌ Access to any IT Endpoint connected to the internal network will be automatically terminated after a period of “non-use”. This is outlined in the “clear screen policy”.

▌ The use of default or generic passwords to access and administer network devices is not permitted.

Control Objective: Detect, classify, record and promptly respond to all security incidents

▌ All security incidents must be reported to the IT Help Desk by phone or e-mail.

▌ All employees are responsible to report any security event or abnormal operations to the IT Help Desk so that these can be recorded and investigated.

▌ Any observed security threat that attempts to damage company information assets, or exploit a known-vulnerability or weak control must be reported as a security incident.

▌ All security incidents will be logged, classified and assigned to the appropriate workgroup for investigation, diagnosis and resolution.

▌ Major security incidents will be notified to the Information Security Manager and will follow the “major incident reporting” procedure that is provided by TEXTILETECH Corporation.

▌ All major security incidents will trigger the “Major Incident Review” procedure so that the root-cause(s) of the incident is diagnosed and a permanent solution is proposed. The solution (corrective or preventative action) will be recorded in the CPAR system and tracked until implemented and tested.

▌ Major security incidents will trigger the “Security Risk Assessment” procedure to ensure that the assessment inputs (business-impact; likelihood of attack; effectiveness of controls) are rated appropriately and the output (residual- risk rating) is accurate.

▌ Repeated or serious breaches of the Information Security Policy will be subject to a formal disciplinary process. Illegal activities will be referred to the appropriate authorities for investigation and the company may take measures to quarantine assets and preserve evidence.

▌ Records of information security incidents, including patterns, statistics and trends will be collected periodically as input to the activities of the Information Security Committee.

Control Objective: Track, monitor and record all access to classified company information

▌ Audit logs that record user activities, exceptions and information security events will be collected and securely archived for a minimum period of 1 year.

▌ Procedures that describe how the use of information systems and IT Facilities will be monitored will be produced and the data collected will be reviewed regularly, at least quarterly.

▌ Automated tools will be provided to collect, filter, analyse and report security events. Access to these tools will be controlled and restricted. The log information will be protected against loss, damage or tampering.

▌ All system administrator and system operator activities will be logged.

▌ Unexpected or abnormal system operations will be logged, analysed and if necessary, referred to the incident management process for diagnosis and resolution.

Control Objective: Regularly monitor, review, audit and improve the security controls

▌ The Information Security management process will define the objectives, metrics and target performance levels of all controls that are in-scope of the ISMS.

▌ The effectiveness of all controls will be measurable; the method for measuring control effectiveness will be defined; the control performance will be measured and compared to the target performance level; the results of control monitoring will be reported periodically to the ISC.

▌ The ISMS methods, procedures and records will be independently audited regularly; the minimum period is 1 year.

▌ The security controls will be independently audited regularly; the minimum period is 1 year.

▌ The results of control effectiveness measurements, ISMS audits, and security control audits will be promptly reported to the ISC along with recommended opportunities for improvement.

▌ The ISC will prioritise; approve; and allocate resources and funds to implement the improvement-actions so that the effectiveness of the ISMS and controls meet the target performance levels.

Control Objective: Ensure that business-critical data and information systems are accessible, as required, to support business operations and that all critical information assets are recoverable as part of an agreed disaster-recovery plan

▌ The business continuity management system (BCMS) will ensure that all business continuity plans include the requirement to protect the confidentiality, availability and integrity of any classified company information that needs to be recovered and restored as part of a major disaster-event.

▌ The BCMS will assess the risk that the disruption of a business process may have a negative consequence for information security and where appropriate, will ensure that the BCP mitigates this risk and securely protects classified company information from harm.

▌ The BCMS will develop plans and procedures to ensure that critical business information is accessible, as required, to meet the needs of business operations.

▌ The BCMS will develop plans and procedures to ensure that critical information assets are recoverable, following a major disaster-event, and that an agreed level of service can be restored within an agreed minimum time scale.

▌ A single BCMS framework will be maintained to ensure that all BCP plans are consistent and include information security requirements.

▌ The BCMS will ensure that all plans, procedures, methods and tools, that support data recovery and restoration following a major disaster-event, are tested and updated periodically. The minimum period is 1 year.

Delegations

3.1 Governance and Support

3.1.1 Chief Executive Officer

▌ The CEO has overall accountability for the endorsement, sponsorship and support of the company-level Information Security Management process

▌ The CEO shall delegate and appoint relevant organisational functions in the company with authority and responsibility for compilation of policies

3.1.2 Chief Information Security Officer

The Chief Information Security Officer (CISO),

▌ has delegated authority and overall responsibility for the company-level Information Security Management process

▌ shall ensure sponsorship and support of company-level Information Security Management System which is aligned the business objectives

3.2 Implementation

• Directors and General Managers

▌ Communicate this policy to all employees

▌ Ensure that this policy is implemented throughout the organisation

▌ Encourage a culture of security-awareness and compliance with the policy

▌ Provide adequate resources to design, implement, maintain, monitor and improve the security controls

3.2.2 All Staff

▌ Ensure that all actions and activities are performed in accordance with this policy.

▌ If any circumstance requires an employee to breach this security policy so that they may fulfil the requirements of their job/contract, then the inconsistency should be reported to their line manager.

Document Information

Amendment History

Review and Approval

Role	Name & Position Title	Digital Signature
Author Approver	Chief Information Security Officer Chief Executive Officer

Reference Material

Copyright © 2018 TEXTILETECH Pty Ltd: Do not copy, distribute or modify in any form or manner without prior written consent of TEXTILETECH.

Classification: The information contained herein is classed as “Internal Use Only”

Version Control: The document is maintained and published on the TEXTILETECH intranet for reference. Printed copies are uncontrolled

Textile Tech Case Scenario

TextileTech (TexT) invents fabric with unique characteristics that has never been seen before. The firm has disrupted the textile and clothing industry by engineering innovative clothing that is better suited to today’s global climate. Their flagship product, ArcticFiber, is an insulating synthetic fleece made from recycled plastics that is lightweight, warm and soft while being very affordable. TexT is in the process of engineering ArcticFiberGamma – an advanced insulating material for military use. The new fabric will have active insulation that has superior capability in regulating core body temperatures in extreme weather. ArcticFiberGamma will have superior breathability and warmth, will be easy to dry and maintain, and will be extremely lightweight thereby making any derived clothing highly compressible – an important characteristic for the military.

TexT continues to innovate in this industry leading to new and sophisticated textile fibres that are wind resistant, water resistant, heat insulating, and moisture regulating. TexT’s competitive advantage lies in its highly complex and sophisticated processes used to transform recycled plastic bottles into synthetic fibres, engineer particular properties into the fibres as previously mentioned, and weave the fibres into a range of different fabrics. These processes are supported by sophisticated manufacturing systems operated by engineering teams that have specialised knowledge and experience, customized and unique high-tech tools and techniques, and digital stores of sensitive R&D information that contain valuable experiment and test data, previous designs of technologies and processes, strategy and planning documents as well as feasibility reports.

TexT has invested significantly in the digital transformation of its manufacturing production capability and reaped the benefits of increases of productivity (17-20%) and quality (15-20%). Aging industrial systems have been replaced by more sophisticated ‘smart manufacturing’ technologies that enable integration with IoTs, a bridge to the digital domain. TexT’s vision for its future manufacturing capability is the complete transformation of its supply chains into a smart network of connected intelligent and autonomous objects that communicate and interact with each other in real time. TexT’s corporate information infrastructure is physically distributed amongst the 15 key facilities that house its major operations. The firm has 20 to 30 networked servers (file, print, database, web, proxy and domain servers) and a few hundred desktop machines connected to the core network via Ethernet and/or wifi channels.

TexT’s intention to compete for lucrative military contracts around the world to supply army personnel with combat uniforms has significantly increased the risk that a competitor possibly backed by a nation-state will seek to replicate its capability by acquiring its trade secrets, test data, tools and techniques. Therefore, the firm has decided to undertake a full and comprehensive information security management review to assess the adequacy of the existing information security strategy given the strong likelihood of industrial espionage.

TexT is located in the state of Arizona (USA) where it occupies 50 acres of warehouses, factories and 15 key ‘facilities’ that house major operations. One of these is a three-storey building dedicated to corporate functions (business, IT, HR, executive management etc.). TextT does not have a dedicated information security unit. However, it does have an IT operations team (TexT-IT) that is responsible for the maintenance of the IT infrastructure. TexT-IT has a core five-person team lead by Sarah – an IT manager with over 20 years of experience managing systems and networks of which the last 10 have been at TexT. Sarah functions as the firm’s CIO. She reports directly to Melissa, the CEO of TextT. Sarah’s team of four are Andrew (network administrator), Dilip (systems administrator), and Brian (responsible for writing policies, training employees, and Nadia (helpdesk). In addition to the core IT team, there are IT Facility Managers responsible for each of the 15 main buildings or facilities on the premises of TexT.

IT Portfolios	Primary Duties / Description	Assignment
IT Manager	Ultimately responsible for IT management across TexT and liaising with other C-suite executives	Sarah
Network Administrator	Responsible for designing network architectures, implementing them across TexT information infrastructure and configuring all network devices, evaluating network performance, securing network access, monitoring network security activity, etc.	Andrew
Systems Administrator	Responsible for effective provisioning, installation/configuration, operation, and maintenance of systems hardware and software and related infrastructure	Dilip
Managerial aspects of IT	Responsible for all non-technical IT duties including drafting policy, procedures and conducting training	Brian

TexT-IT’s prime directive is to maximize uptime for TexT’s information infrastructure and support the business’ expanding needs for more IT resources. This includes procuring and integrating new technologies and applications and designing and implementing new IT services. From a security perspective, the team ensures compliance with the relevant industry standards (e.g. ISO 27xxx), manages the security policy (see security policy document), conducts basic IT security risk assessments, and trains users to keep good passwords and install software previously screened / endorsed by TexT-IT. Cyber-attacks on the corporate infrastructure have increased in frequency. The IT team responds to at least two breaches of the digital perimeter every month. Sarah personally leads all major incident response (see TexT-IT’s incident response policy). Depending on the nature and scope of the incident, she will recruit members of the Text-IT team but will also seek the assistance of business operations personnel. Andrew and Dilip are involved in responding to almost all incidents. When the incident is resolved, Brian focuses on revising the policy and risk documentation. Brian then conducts any necessary training with Nadia to ensure the right advice is being given by the Helpdesk.

TexT-IT believes in preventative security and therefore relies heavily on its digital perimeter which is maintained by firewalls and backed up with an intrusion detection system. Most of Text-IT’s workforce stays on the premises of the organization. However, Sarah is particularly concerned by the proliferation of shadow IT – these are the large number of unauthorized devices that exist outside the corporate infrastructure and pose a significant security risk to the firm. They include personal devices such as mobile phones and tablets, applications and even servers used on TexT premises that are not registered with the IT department. Sarah is aware of the digital transformation program of TexT’s manufacturing capability. However, she does not consider the security portfolio to extend to the firm’s manufacturing facilities nor has the firm included the IT operations unit at any stage of the transformation process.