ISO 17799: Standard for Security

Nov/Dec 2006

by Myler Ellie, Broadbent George

Organizations can use ISO 17799 as a model for creating information security policies and procedures, assigning roles and responsibilities, documenting operational procedures, preparing for incident and business continuity management, and complying with legal requirements and audit controls.

Pretexting. Zero Day Attacks. SQL Injections. Bots and Botnets. Insider Infractions. Click Fraud. Database Hacking. Identity Theft. Lost Laptops and Handhelds. According to Ted Humphreys, in a recent International Organization for Standardization (ISO) press release, "It is estimated that intentional attacks on information systems are costing businesses worldwide around $15 billion each year and the cost is rising."

Today's information professionals need to address an ever-increasing number of internal and external threats to their systems' stability and security, while maintaining access to critical information systems. As the e-commerce space continues to grow and new tools allow organizations to conduct more business online, they must have controls in place to curtail cyber crimes' malicious mayhem, tampering, and wrongdoing.

Organizations need to address information security from legal, operational, and compliance perspectives. The risk of improper use and inadequate documentation abounds, and the penalties are greater than ever. By combining best practices outlined in the international standard ISO/IEC 17799 Information Technology - Security Techniques - Code of Practice for Information security Management (ISO 17799) with electronic records management processes and principles, organizations can address their legal and compliance objectives. This article explores the opportunity to bridge the gaps and bring together information security, intellectual property rights, protection and classification of organizational records, and audit controls.

ISO 17799 Components, Applications, Implications

ISO 17799 provides a framework to establish risk assessment methods; policies, controls, and countermeasures; and program documentation. The standard is an excellent model for organizations that need to:

* Create information security policies and procedures

* Assign roles and responsibilities

* Provide consistent asset management

* Establish human and physical security mechanisms

* Document communications and operational procedures

* Determine access control and associated systems

* Prepare for incident and business continuity management

* Comply with legal requirements and audit controls

Information security can be defined as a program that allows an organization to protect a continuously interconnected environment from emerging weaknesses, vulnerabilities, attacks, threats, and incidents. The program must address tangibles and intangibles. Information assets are captured in multiple and diverse formats, and policies, processes, and procedures must be created accordingly.

Organizations can use this standard not only to set up an information security program but also to establish distinct guidelines for certification, compliance, and audit purposes. The standard provides various terms and definitions that can be adopted as well as the rationale, the importance, and the reasons for establishing programs to protect an organization's information assets and resources. Figure 1 depicts the suggested steps and tasks associated with establishing and implementing an information security program.

This ISO framework is methodically organized into 11 security control clauses. Each clause contains 39 main security categories, each with a control objective and one or more controls to achieve that objective. The control descriptions have the definitions, implementation guidance, and other information to enable an organization to set up its program objectives according to the standard methodology.

Step 1: Conduct Risk Assessments

This component of the standard applies to activities that should be completed before security policies and procedures are formulated.

Risk is defined as anything that causes exposure to possible loss or injury. Risk analysis is defined as a process of identifying the risks to an organization and often involves an evaluation of the probabilities of a particular event or an assessment of potential hazards. Loss potentials should be understood to determine an organization's vulnerability to such loss potentials.

Risk categories are both internal and external and can include:

* Natural: Significant weather events such as hurricanes, flooding, and blizzards

* Human: Fire, chemical spills, vandalism, power outages, and virus/hackers

* Political: Terrorist attacks, bomb threats, strikes, and riots

Conduct risk assessments to understand, analyze, evaluate, and determine what risks organizations feel are likely to occur in their environment. Risk assessment activities involve information technology (IT) and information processing facilities, facilities management and building security, human resources (HR), records management (RM) and vital records protection, and compliance and risk management groups. These groups must collectively determine what the risks are, the level of acceptance or non-acceptance of that risk, and the controls selected to counteract or minimize these risks.

Risk analysis is conducted to isolate specific and typical events that would likely affect an organization; considering its geography and the nature of its business activities will help to identify risks. Loss potential from any of these events can result in prohibited access, disrupted power supplies, fires from gas or electricity interruptions, water damage, mildew or mold to paper collections, smoke damage, chemical damage, and total loss (with the destruction of the entire building).

Regularly monitor emerging threats and evaluate their impacts, as this is a constant, moving target. For example, according to an IMlogic article, "IM [instant messaging] worms are the most prevalent form of IM malware, representing 90 percent of all unique attacks in 2005. These attacks frequently utilized social engineering techniques to lure end users into clicking on suspicious links embedded inside IM messages, enabling the activation of malicious code that compromised the security of host operating systems or applications."

Although threats are increasingly sophisticated in the virtual sphere, the simple occurrence of employees stealing company information on paper is still very real and prevalent in today's work space.

Step 2: Establish a security Policy

These components of the standard provide the content that should be included as well as implementation guidance to set the foundation and authorization of the program.

To set its precedence, an information security policy should be developed, authorized by management, published, and communicated. It should apply to all information assets and must demonstrate management's commitment to the program. Explain implications on work processes and associated responsibilities and outline them in employee job descriptions.

The security policy should be administered, documented, and periodically evaluated and updated to reflect organizational goals and lines of business. This is captured under clause 6.0 for organizing information security. It reflects administrative and management activities to implement the security policy. All activities must identify authorities, responsibilities, agreements, and external security requirements. This has an impact on information processing facilities, external parties, access issues, and problem resolution measures. Keep a record of all policy administration activities to create historical relevance for the information security program.

Step 3: Compile an Asset Inventory

This component of the standard addresses asset management, controls, and the protection thereof. It applies to all assets in tangible and intangible form.

Identify the organization's intellectual property (IP), tools to create and manage IP, and physical assets with a detailed inventory so the organization knows what type of resources it has, where they are located, and who has responsibility for them. Identifying how assets are to be used, classified, labeled, and handled is necesk sary to establish an asset management inventory.

This inventory should also distinguish the types, formats, and ownership control issues. Implement associated rules for the use of assets including e-mail, Internet usage, and mobile devices. Classifying assets and establishing procedures for labeling and handling according to the classification scheme are also important. Documents in electronic form will lend themselves to being identified through metadata and document properties completion. However, these processes must all be completed by resources. Although automation of these processes is a possibility, an organization still faces extensive costs and resource coordination to address this piece.

Step 4: Define Accountability

This component of the standard addresses the human aspect of security; it applies to the level of accountability that employees, contractors, and third-party users have to use to protect an organization's information assets.

An information security program will not be implemented unless roles and responsibilities are clearly articulated and understood by those having ownership in the program. Ideally, these roles and responsibilities should be outlined in job descriptions and documented in terms and conditions of employment.

Employees are part of the overall information security landscape and often they are the closest and best able to prevent certain incidents from occurring. HR is typically in charge of these issues, but they must collaborate with IT and RM to ensure that all information assets are addressed accordingly.

Define roles and responsibilities during pre-employment and screening processes, and perform background checks to support the hiring process. If the job mandates working with highly sensitive information, an organization must be on guard to hire the most qualified person to perform these tasks. These employees must possess a great deal of integrity, pay attention to detail, and take their responsibilities seriously.

Information security awareness, education, and training must be a routine activity to keep employees informed, to communicate expectations, and to provide updates on their responsibilities. Standardize a disciplinary process for security breaches.

When employees leave or change jobs, it is essential that HR, in collaboration with other stakeholders, follows through with a return of assets process and removal of access rights, which can be captured in HR exit processes and procedures. This often is not a coordinated process, which allows employees to walk off with information or leave behind on servers and in physical work spaces masses of orphaned and unidentified information. Redesign the HR exit interview to ensure that information return or transfer is a coordinated process.

Step 5: Address Physical security

This component of the standard outlines all the requirements for physical security perimeters and authorized entry controls; measures for protecting against external and environmental threats; equipment security, utilities, and cabling considerations; and secure disposal or removal of storage equipment media.

An organization's building and premises, equipment, and informationprocessing facilities must be fail proof to prevent unauthorized intrusions and access, and possible theft issues. This applies mostly to facilities management and IT, although risk management should also participate to provide environmental risk protection measures.

Include guidelines for physical security perimeters, entry controls, environmental threats, and access patterns in this section. Also address supporting utilities, power, and telecommunication networks. Finally, secure the disposal and removal of equipment that holds information so that information is truly deleted or "wiped" clean from the slate.

Step 6: Document Operating Procedures

Procedures for system activities, change management controls, and segregation of duties are included in this component.

Any organizational program will be more established when program administration, policies, procedures, and related processes are formally documented. This component sets out to define operating procedures, instructions for the detailed execution thereof, and the management of audit trail and system log information. It applies to all facets of an information security program.

Formally documenting program activities will allow an organization to keep track of the development, implementation, and associated documentation for the program. Keep in mind that documentation does not magically appear through word processing programs. It takes resources, good writing skills, and an ability to change documentation when necessary.

Address the separation of development, test, and operational facilities to reduce the risk of unauthorized actions. Monitor and review thirdparty service delivery requirements to ensure that actions are carried out as mandated. Plan for, monitor, and update system resources, capacity management, and acceptance criteria, as necessary.

Constantly monitor and prepare to protect against malicious and mobile code to guard the integrity of system software and information. This especially pertains to intelligent cybercrime activities such as structured query language injections and application to mobile devices, which are increasingly becoming more sophisticated. This should also focus on incoming e-mails and downloadable attachments, as well as a review of webpages.

Backup and restoration procedures must provide for the replication of information and methods for dispersal and testing, meeting business continuity requirements. This should also address retention periods for archival information or those with long-term retention requirements. Address media preservation issues to ensure the longevity of media that have long-term retention requirements.

Address network infrastructure through network controls and management. This includes:

* Remote equipment and connections

* Public and wireless networks

* Authentication and encryption controls

* Firewalls and intrusion detection systems

* Media handling and transit methods

* Information classification, retention, and distribution policies and procedures

Although mobile devices have helped organizations stay better connected, employees must use more discretion when using them. Alert employees to proper etiquette for relaying information so they will not be overheard in elevators, airports, or on other public transportation.

Address electronic data interchange, e-commerce, online transactions, electronic signatures, electronic publishing systems, and electronic communication methods such as e-mail and IM. Their secure use and associated procedures must demonstrate accuracy, integrity, and reliability. For organizations using e-commerce, this is not an option, as current regulations are pushing this into the forefront of IT agendas. Organizations should also monitor their systems and record security events through audit logs. Also address records retention policies for archival or evidence requirements.

Step 7: Determine Access Controls

This component of the standard includes guidelines for establishing policies and rules for information and system access.

Practice standard methods for all users and system administrators to control access to and distribution of information. Policies should apply to users, equipment, and network services. Newer technologies, such as those that have passwords connected to fingerprint digital touch pads, come at a cost, but they should be evaluated as a password management tool.

Access control measures should include:

* Setting up user registration and deregistration procedures

* Allocating privileges and passwords

* Implementing a "clear desk and clear screen policy"

* Managing:

- Unattended equipment

- Virtual private network solutions

- Wireless networks and authentications

- Network service issues such as routing and connections

- Telecommuting virtual spaces and intellectual property rights

- Cryptographic keys and procedures

- Software development, testing, and production environments

- Program source code and libraries

- Change control procedures and documentation

- Patches, updates, and service packs

Any information system that an organization procures or develops must also include security requirements for valid data input, internal processing controls, and encryption protection methods. Document the integrity, authenticity, and completeness of transactions through checks and balances. Retain and archive system documentation for configurations, implementations, audits, and older versions. This is further detailed in clause 12 of the standard.

Step 8: Coordinate Business Continuity

This component of the standard includes reporting requirements, response and escalation procedures, and business continuity management.

As organizations increasingly come under attack and suffer security breaches, they must have some formalized manner of responding to these events.

Business continuity management addresses unexpected interruptions in business activities or counters those events that impede an organization's critical business functions. This process should include:

* Identifying risks and possible occurrences

* Conducting business impact analyses

* Prioritizing critical business functions

* Developing countermeasures to mitigate and minimize the impact of occurrences

* Compiling business continuity plans and setting up regular testing methods for plan evaluation and update

A business continuity management framework also includes emergency or crisis management tasks, resumption plans, recovery and restoration procedures, and training programs. Testing the plan is an absolute must to determine its validity. Tests can include a variety of methods to simulate and rehearse real-life situations. Develop calling trees, hot- and cold-site configurations, and third-party contractors, depending on the organization's priority of critical business functions.

Report information security incidents or breaches as soon as possible to ensure that all relevant information can be remembered. This requires having feedback processes in place as well as establishing a list of contacts that are available around the clock to manage this process. Procedures should be consistent and effective to ensure orderly responses to not only manage the immediate process but also to collect evidence for legal proceedings.

Step 9: Demonstrate Compliance

This component of the standard provides standards for intellectual property rights, RM requirements, and compliance measures. These apply to everything from an organization's information processing systems to the granular data and transactional records contained within those systems.

There is an increased scrutiny on organizations to demonstrate compliance with applicable laws, regulations, and legislative requirements for all aspects of their business transactions. Adherence to rules and regulations are an integral part of the information security program and will contribute to demonstrating corporate accountability.

Address identification, categorization, retention, and stability of media for long-term retention requirements according to business and regulatory requirements. Document retention periods and associated storage media as part of managing the organization's records. Address privacy and personal data requirements, which can vary from one country to the next. Address transborder data flow and movement, and associated encryption methods as related to import and export issues depending on federal laws and regulations.

Follow up on and evaluate compliance with established policies and procedures to determine implementation effectiveness and possible shortcomings. Clearly delineate audit controls and tools to determine areas for improvement. Again, it is critical to take time to document all information related to the development and establishment of compliance and audit, including decisions made, resources involved, and other source documentation cited.

Data Breach Reporting Issues

New information security requirements are emerging as a result of organizations' negligence to protect sensitive data and impose adequate controls on employees using mobile technology to house such data. Information security issues are constantly in the media, as with the recent case when the U.S. Department of Veterans Affairs (VA) lost control of the personal information of 28 million veterans when a laptop containing the information was stolen from an employee's home. The VA was criticized for its delay in disclosing the loss and notifying those affected.

California Senate Bill (SB) 1386 is setting the precedent for reporting and disclosing data security breaches and declarations for privacy and financial security. (See Figure 2 "California SB 1386 Excerpts, Source and Language Summary.") Other states are now adopting laws allowing consumers to "freeze" their credit files, even if they have not been a victim of identity theft. If passed, pending bills in the U.S. Congress, including S.1408: Identity Theft Protec-tion Act and H.R. 4127: The Data Accountability and Trust Act, would also force organizations to be more accountable for the vast amount of personal information that they may have.

Organizations should take heed of these legislative efforts and proactively plan for them by updating their information security practices. Any organization that uses e-commerce in its business practices must align its systems and databases for the protection of information content. Organizations that are subject to these laws should structure their reporting measures according to the following components of the ISO 17799 standard:

* Clause 10.9 establishes electronic commerce countermeasures and cryptographic controls to protect sensitive customer information and all associated electronic records databases.

* Clause 13.1 provides a methodology for reporting incidents supported by timely procedures with appropriate behavior mechanisms and disciplinary processes.

Information Security Objectives and Records Management Components

Although information security is now in the limelight and is being brought to the attention of the executive-level audience, RM is still the basic foundation that branches out into all the various new compliance areas. Records managers need to work with IT to ensure that retention and vital records requirements are addressed and are part of the many inventories that the ISO standard suggests. They must also update their programs to be in line with an information security program's objectives as outlined in the controls and implementation guidance of the ISO 17799 standard.

Maintenance, retention, and protection requirements of data, information, and IP are addressed in the ISO clauses in Figure 3.

Vital records are those records that are needed to resume and continue business operations after a disaster and are necessary to recreate an organization's legal and financial position in preserving the rights of an organization's employees, customers, and stockholders. If vital records protection methods exist before an information security program is established, they should be integrated or referred to as part of the larger information security scheme. IP and the management and protection thereof have long been addressed by organizations through a vital records program. When electronic records were not prevalent, vital records protection methods included the same premises, such as:

* Appraisal and identification of those records that are deemed vital

* Duplication and dispersal processes

These methods can apply to any electronic environment but the inventories of such records must include not only the paper versions but also their electronic counterparts captured in other media or systems within the organization.

The objective to protect electronic vital records must focus on:

* Newly created records

* Work in progress

* Other information that is not stored on servers and is typically found on users' desktops

Although it can be argued that many electronic records are captured in enterprise resource planning systems, routine backups of this data may be re-circulated so that long-term retention and protection requirements are not addressed.

Initially, allowing employees to transport laptops and other devices with large amounts of data away from the corporate environment was seen as a way to increase productivity. That is still the case, but controls in the form of policies as to what can and cannot be taken must be established and consistently enforced. As technology offers more ways to compact large amounts of data on very small devices, it is crucial to monitor and correct employees to prevent their actions from compromising the organization's responsibilities for keeping information safe. Establish, fund, and monitor training, support, and compliance to ensure that employees receive appropriate training before turning them loose with the tools.

Compliance also applies to information systems and their audit considerations. Administrators running an organization's information systems must be just as closely scrutinized as the employees within the organization and in virtual spaces.

Stay Ahead of the Curve to Stay Secure

While information security is the newest flavor of the month, chances are that many organizations have no program in place and, therefore, no control over how their employees manage information.

Organizations cannot continue to practice their business in an irresponsible manner. Using the ISO standard to structure their programs is the foundation, but they must also stay ahead of the curve, outguessing and outsmarting potential incidents and occurrences. Websites for information security are pervasive and provide both written materials and podcasts to help keep information professionals informed. Records managers and IT professionals can also help each other achieve a best practices program for information security.

However, any program that an organization initiates will need management support and resources to accomplish it. Collaboration by all parties, including senior management, is essential to achieve compliance in the space of information security.

References

ARMA International. "VA IG Slams Top Officials in VA Data Theft Incident." Washington Policy Brief, July 2006. Available at www.arma.org/news/policybrief/index.cfm?BriefID=1335 (accessed 26 September 2006).

Bartholomew, Doug. "Responding to Risk: Invisible Enemies." Industry Week, 1 March 2006. Available at www.industryweek.com/ReadArticle.aspx?ArticleID=11440 (accessed 26 September 2006).

Greenemeier, Larry. "The Next Data Breach Could Mean Your IT Job." Information Week 17 July 2006. Available at www.informationweek.com/security/showArticle.jhtml?artideID= 190400266. (accessed 26 September 2006).

IMlogic. IMlogic Threat Center - 2005 Real-Time Communication Security: The Year in Review. Accessed 12 July, 2006 at www.imlogic.com/pdf/2005ThreatCenter_report.pdg. No longer available.

International Organization for Standardization. ISO/IEC 17799: 2005, Information Technology - Security Techniques - Code of Practice for Information Security Management, Geneva, Switzerland: International Organization for Standardization, 2005.

_____. ISO/IEC 18043:2006, Information Technology - Security Techniques Selection, Deployment and Operations of Intrusion Detection System, Geneva, Switzerland: International Organization for Standardization, 2006.

_____. "New ISO/IEC Standard to Help Detect IT Intruders." Available at www.iso.org/iso/en/commcentre/pressreleases/2006/Ref1017.html (accessed 26 September 2006).

U.S. House. Data Accountability and Trust Act, 109th Congress, H.R. 4127. Available at www.govtrack.us/congress/bill.xpd?bill=h109-4127 (accessed 26 September 2006).

U.S. Senate. Identity Theft Protection Act, 109th Congress, S.1408. Available at www.govtrack.us/congress/bill.xpd?bill=s109-1408 (accessed 26 September 2006).

Ellie Myler, CRM, and George Broadbent

Elite Myler is a Certified Records Manager and Certified Business Continuity Professional and a 17-year veteran of the records management industry. A Senior Records Management Analyst with Entium Technology Partners LLC, Myler has previously served as a consultant to Fortune 500 companies in a wide spectrum of industries. She designs and customizes corporate governance programs for records management and business continuity program initiatives and writes and lectures frequently on information management and technology topics. She may be reached at emyler@entium.com.

George Broadbent has more than 17 years of diversified system architecture, network design and implementation, and application development experience, including network management of Novell NetWare and Microsoft Windows 2000/2003 networks. He has designed and built local and wide area networks (LANs/WANs) that include the use of high-availability systems, real-time data replication and hierarchical storage solutions for large multi-site organizations. He has performed the architecture, design, implementation, deployment, and/or support of enterprise electronic mail systems with integrated electronic archiving solutions for Microsoft Exchange-based systems. He can be reached at gbroadbent@entium.com.

Copyright ARMA International Nov/Dec 2006
Provided by ProQuest Information and Learning Company. All rights Reserved

Source : http://findarticles.com/p/articles/mi_qa3937/is_200611/ai_n16871475

Information Security Policy - The University of Illinois (Example)

INTRODUCTION

Storage of university data on computers and transfer across the network eases use and expands our functionality. Commensurate with that expansion is the need for the appropriate security measures. Security is not distinct from the functionality. The Information Security Policy (Policy) recognizes that not all communities within the University are the same and that data are used differently by various units within the University. The principles of academic freedom and free exchange of ideas apply to this policy, and this policy is not intended to limit or restrict those principles. These policies apply to all units within the University. Each unit within the University should apply this policy to meet their information security needs. The Policy is written to incorporate current technological advances. The technology installed at some units may limit immediate compliance with the Policy. Instances of non-compliance must be reviewed and approved by the chief information officer or the equivalent officer(s). Throughout the document the term must and should are used carefully. "Musts" are not negotiable; "shoulds" are goals for the university. The terms data and information are used interchangeably in the document. The terms system and network administrator are used in this document. These terms are generic and pertain to any person who performs those duties, not just those with that title or primary job duty. Many students, faculty and staff member are the system administrators for their own machines.

PURPOSE OF THIS POLICY

By information security we mean protection of the University's data, applications, networks, and computer systems from unauthorized access, alteration, or destruction.

The purpose of the information security policy is:

• To establish a University-wide approach to information security.
• To prescribe mechanisms that help identify and prevent the compromise of information security and the misuse of University data, applications, networks and computer systems.
• To define mechanisms that protect the reputation of the University and allow the University to satisfy its legal and ethical responsibilities with regard to its networks' and computer systems' connectivity to worldwide networks.
• To prescribe an effective mechanism for responding to external complaints and queries about real or perceived non-compliance with this policy.

RESPONSIBILITY

The chair of the University Technology Management Team (UTMT) is responsible for implementing the policy. UTMT, chaired by the Vice President for Administration, is a coordinating group comprised of chief information officers from the three campuses, the university administration, and the hospital. UTMT must see to it that:

• The information security policy is updated on a regular basis and published as appropriate.
• Appropriate training is provided to data owners, data custodians, network and system administrators, and users.
• Each unit appoints a person to be responsible for security implementation, incident response, periodic user access reviews, and education of information security policies including, for example, information about virus infection risks.

Members of UTMT are each responsible for establishing procedures to implement these policies within their areas of responsibility, and for monitoring compliance.

GENERAL POLICY

Required Policies

• The University will use a layered approach of overlapping controls, monitoring and authentication to ensure overall security of the University's data, network and system resources.
• Security reviews of servers, firewalls, routers and monitoring platforms must be conducted on a regular basis. These reviews must include monitoring access logs and results of intrusion detection software, where it has been installed.

Recommended Practices

• Vulnerability and risk assessment tests of external network connections should be conducted on a regular basis. At a minimum, testing should be performed annually, but the sensitivity of the information secured may require that these tests be done more often.
• Education should be implemented to ensure that users understand data sensitivity issues, levels of confidentiality, and the mechanisms to protect the data. This should be tailored to the role of the individual, network administrator, system administrator, data custodian, and users.
• Violation of the Information Security Policy may result in disciplinary actions as authorized by the University in accordance with University and campus disciplinary policies, procedures, and codes of conduct.

DATA CLASSIFICATION POLICY

It is essential that all University data be protected. There are however gradations that require different levels of security. All data should be reviewed on a periodic basis and classified according to its use, sensitivity, and importance. We have specified three classes below:

High Risk - Information assets for which there are legal requirements for preventing disclosure or financial penalties for disclosure. Data covered by federal and state legislation, such as FERPA, HIPAA or the Data Protection Act, are in this class. Payroll, personnel, and financial information are also in this class because of privacy requirements. This policy recognizes that other data may need to be treated as high risk because it would cause severe damage to the University if disclosed or modified. The data owner should make this determination. It is the data owner's responsibility to implement the necessary security requirements. Confidential - Data that would not expose the University to loss if disclosed, but that the data owner feels should be protected to prevent unauthorized disclosure. It is the data owner's responsibility to implement the necessary security requirements. Public - Information that may be freely disseminated All information resources should be categorized and protected according to the requirements set for each classification. The data classification and its corresponding level of protection should be consistent when the data is replicated and as it flows through the University.

• Data owners must determine the data classification and must ensure that the data custodian is protecting the data in a manner appropriate to its classification.
• No University-owned system or network subnet can have a connection to the Internet without the means to protect the information on those systems consistent with its confidentiality classification.
• Data custodians are responsible for creating data repositories and data transfer procedures which protect data in the manner appropriate to its classification.
• High risk data must be encrypted during transmission over insecure channels.
• Confidential data should be encrypted during transmission over insecure channels.
• All appropriate data should be backed up, and the backups tested periodically, as part of a documented, regular process.
• Backups of data must be handled with the same security precautions as the data itself. When systems are disposed of, or repurposed, data must be certified deleted or disks destroyed consistent with industry best practices for the security level of the data.

ACCESS CONTROL POLICY

• Data must have sufficient granularity to allow the appropriate authorized access. There is a delicate balance between protecting the data and permitting access to those who need to use the data for authorized purposes. This balance should be recognized.
• Where possible and financially feasible, more than one person must have full rights to any university owned server storing or transmitting high risk data. The campuses and University Administration (UA) must have a standard policy that applies to user access rights. This will suffice for most instances. Data owners or custodians may enact more restrictive policies for end-user access to their data.
• Access to the network and servers and systems should be achieved by individual and unique logins, and should require authentication. Authentication includes the use of passwords, smart cards, biometrics, or other recognized forms of authentication.
• As stated in the current campus policies on appropriate and acceptable use, users must not share usernames and passwords, nor should they be written down or recorded in unencrypted electronic files or documents. When limited access to university-related documents or files is required specifically and solely for the proper operation of University units and where available technical alternatives are not feasible, exceptions are allowed under an articulated unit policy that is available to all affected unit personnel. Each such policy must be reviewed by the unit executive officer and submitted to the CIO for approval. All users must secure their username or account, password, and system access from unauthorized use.
• All users of systems that contain high risk or confidential data must have a strong password- the definition of which will be established and documented by UTMT after consultation with the community. Empowered accounts, such as administrator, root or supervisor accounts, must be changed frequently, consistent with guidelines established by UTMT.
• Passwords must not be placed in emails unless they have been encrypted.
• Default passwords on all systems must be changed after installation. All administrator or root accounts must be given a password that conforms to the password selection criteria when a system is installed, rebuilt, or reconfigured.
• Logins and passwords should not be coded into programs or queries unless they are encrypted or otherwise secure.
• Users are responsible for safe handling and storage of all University authentication devices. Authentication tokens (such as a SecureID card) should not be stored with a computer that will be used to access the University's network or system resources. If an authentication device is lost or stolen, the loss must be immediately reported to the appropriate individual in the issuing unit so that the device can be disabled.
• Terminated employee access must be reviewed and adjusted as found necessary. Terminated employees should have their accounts disabled upon transfer or termination. Since there could be delays in reporting changes in user responsibilities, periodic user access reviews should be conducted by the unit security person.
• Transferred employee access must be reviewed and adjusted as found necessary.
• Monitoring must be implemented on all systems including recording logon attempts and failures, successful logons and date and time of logon and logoff.
• Activities performed as administrator or superuser must be logged where it is feasible to do so.
• Personnel who have administrative system access should use other less powerful accounts for performing non-administrative tasks. There should be a documented procedure for reviewing system logs.

VIRUS PREVENTION POLICY

• The willful introduction of computer viruses or disruptive/destructive programs into the University environment is prohibited, and violators may be subject to prosecution.
• All desktop systems that connect to the network must be protected with an approved, licensed anti-virus software product that it is kept updated according to the vendor's recommendations.
• All servers and workstations that connect to the network and that are vulnerable to virus or worm attack must be protected with an approved, licensed anti-virus software product that it is kept updated according to the vendor's recommendations.
• Headers of all incoming data including electronic mail must be scanned for viruses by the email server where such products exist and are financially feasible to implement. Outgoing electronic mail should be scanned where such capabilities exist.
• Where feasible, system or network administrators should inform users when a virus has been detected.
• Virus scanning logs must be maintained whenever email is centrally scanned for viruses.

INTRUSION DETECTION POLICY

• Intruder detection must be implemented on all servers and workstations containing data classified as high risk.
• Operating system and application software logging processes must be enabled on all host and server systems. Where possible, alarm and alert functions, as well as logging and monitoring systems must be enabled.
• Server, firewall, and critical system logs should be reviewed frequently. Where possible, automated review should be enabled and alerts should be transmitted to the administrator when a serious security intrusion is detected.
• Intrusion tools should be installed where appropriate and checked on a regular basis.

INTERNET SECURITY POLICY

• All connections to the Internet must go through a properly secured connection point to ensure the network is protected when the data is classified high risk.
• All connections to the Internet should go through a properly secured connection point to ensure the network is protected when the data is classified confidential.

SYSTEM SECURITY POLICY

• All systems connected to the Internet should have a vendor supported version of the operating system installed.
• All systems connected to the Internet must be current with security patches.
• System integrity checks of host and server systems housing high risk University data should be performed.

ACCEPTABLE USE POLICY

Each Campus and UA must have a policy on appropriate and acceptable use that includes these requirements:

• University computer resources must be used in a manner that complies with University policies and State and Federal laws and regulations. It is against University policy to install or run software requiring a license on any University computer without a valid license.
• Use of the University's computing and networking infrastructure by University employees unrelated to their University positions must be limited in both time and resources and must not interfere in any way with University functions or the employee's duties. It is the responsibility of employees to consult their supervisors, if they have any questions in this respect.
• Uses that interfere with the proper functioning or the ability of others to make use of the University's networks, computer systems, applications and data resources are not permitted.
• Use of University computer resources for personal profit is not permitted except as addressed under other University policies.
• Decryption of passwords is not permitted, except by authorized staff performing security reviews or investigations. Use of network sniffers shall be restricted to system administrators who must use such tools to solve network problems. Auditors or security officers in the performance of their duties may also use them. They must not be used to monitor or track any individual's network activity except under special authorization as defined by campus policy that protects the privacy of information in electronic form.

EXCEPTIONS

In certain cases, compliance with specific policy requirements may not be immediately possible. Reasons include, but are not limited to, the following:

• Required commercial or other software in use is not currently able to support the required features;
• Legacy systems are in use which do not comply, but near-term future systems will, and are planned for;
• Costs for reasonable compliance are disproportionate relative to the potential damage.

In such cases, units must develop a written explanation of the compliance issue and a plan for coming into compliance with the University's Information Security Policy in a reasonable amount of time. Explanations and plans must be submitted to the campus CIO or the equivalent officer(s).

Source : http://www.obfs.uillinois.edu/manual/central_p/sec19-5.html

7 Steps to a Highly Effective IT Compliance Program

Documenting internal policies and controls, assigning appropriate compliance management oversight, and ensuring compliance through training are three of the seven steps incorporated into highly effective IT compliance programs.

By Michael Rasmussen, Vice President of Enterprise Risk & Compliance Management, Forrester Research Inc.

Regulatory compliance pressures are plaguing organizations around the world. Unfortunately, because compliance challenges often affect multiple areas of an organization and can span across different industries, there is no silver-bullet technology package that will bring companies into compliance. In addition, recent corporate disasters and growing government regulatory action have heightened the focus on corporate governance and are driving the centralization of compliance oversight within today's organization. Because most IT functions permeate the organization and its processes, IT compliance is also a process that requires continuous oversight and management.

To meet IT compliance obligations, many companies are looking for a structured approach that allows them to identify and prioritize IT controls and establish a compliance record system. But, implementing an IT compliance program that is effective and responds to the dynamic business environment can be challenging. Nevertheless, having a structured approach is a major step toward compliance with different standards and legislation, such as the U.S. Sarbanes-Oxley Act of 2002, the International Organization for Standardization (ISO) 27001 standard, and the European Union (EU) Directive on Data Protection of 1995. To ensure their IT infrastructure is compliant year-round, organizations can incorporate a series of seven steps to existing operations. When combined with a formal risk assessment process and IT asset management strategy, these seven steps can bring companies one step closer to compliance.

THE 7 STEPS

In 1991, the U.S. Sentencing Commission (USSC) established the Organization Sentencing Guidelines to assist courts in setting fines for organizations and sentences for executives in criminal regulatory cases. The USSC based its model on seven core elements. In 2001, the original USSC guidelines went into revision to include Sarbanes-Oxley compliance and sentencing information.

Using the USSC guidelines as a basis, Forrester Research — a technology and market research company that advises organizations about technology's impact on businesses and consumers — extended the seven elements by integrating compliance best practices in large organizations. When examined in detail, however, these seven practices or steps are equally useful in small and mid-size enterprises. The extended guidelines provide a framework around which organizations can structure their IT compliance management programs, as well as information that could help organizations in their compliance efforts with non-US regulations, such as ISO 27001 and the EU Directive on Data Protection. Below is a description of each step and key points organizations need to keep in mind when implementing each of these recommendations.

Step No. 1: Document the Policy and Control Environment

To demonstrate IT compliance, firms must start by identifying how they document the compliance process and their IT control architecture. The overall compliance documentation architecture should be implemented through a control framework, such as the Information Systems and Audit Control Association's Control Objectives for Information and related Technology (CobiT), and should document all corporate IT policies, controls, standards, and procedures that align with compliance objectives and requirements.

The policy and control architecture establishes the compliance foundation upon which the remaining seven habits are built. Without a proper governance model of policies and controls, organizations may have a hard time overseeing, communicating, monitoring, enforcing, or responding to gaps. It is the policy and control architecture for compliance that provides the framework for everything else to work within the IT environment. This architecture is unique to each organization, reflecting its culture of control and industry requirements.

After drafting the necessary IT policy and control documentation, organizations need to communicate any relevant documentation clearly to those expected to comply with established policies, procedures, standards, and supporting controls. In addition, companies need to update and maintain all documentation, as well as use an operational control and compliance platform that helps them to manage the complexity of corporate IT policies and compliance controls. This documentation also should include a framework to manage operational risks, define policies and supporting controls to meet risks, conduct control self-assessments to validate IT control implementation and efficiency, and track existing control gaps and incidents within the IT environment.

Step No. 2: Assign Appropriate Compliance Management Oversight

The second element necessary for effective IT compliance is the establishment of appropriate oversight for compliance. In many organizations, the compliance role is divided among different parts of the firm. This results in substantial technology and effort duplication, as well as lack of compliance visibility across the organization.

Effective IT compliance oversight in an organization must achieve the mission and charter of the compliance program. To this end, companies should define IT compliance as a corporate function that has proper authority and governance, as well as create appropriate lines of communication to convey important compliance efforts to all operational areas. The board and executive management team must develop this structure with care and review it at least once per fiscal year for effectiveness. To be successful, organizations should develop a compliance oversight model that:

* Makes executives and the board accountable for compliance.
* Assigns IT compliance responsibility to an oversight manager. This individual may have the title of chief information officer or chief compliance officer.
* Delegates specific compliance areas to distribute oversight.
* Assigns adequate resources (e.g., staff and budget).
* Ensures that the compliance oversight manager has enforcement authority.
* Establishes lines of communication to the business.
* Defines reports and metrics for operational IT control and compliance.

Step No. 3: Require Personnel Screening and Access Control

Ensuring that the organization is not giving access to information and business processes to an individual likely to exhibit unethical behavior is crucial when establishing an effective IT compliance program. One of the greatest risks that organizations face when trying to enforce compliance with regulations is the internal threat from employees, contractors, and business partners. To ensure that appropriate and authorized access is established across the board, organizations should:

* Conduct a background check on employees, contractors, and business partners before allowing them access to sensitive corporate data.
* Use caution when delegating authority.
* Use identity management and provisioning when giving access to IT systems. Provisioning enables administrators to assign system resources and privileges to users, including employees, contractors, and business partners (e.g., many IT managers use provisioning software to enforce security policies).
* Implement access controls based on the person's job function, role, and responsibility.
* Change access rights when internal changes occur (e.g., an employee changes jobs within the organization).
* Revoke access upon termination.
* Conduct routine reviews to check for unethical behavior in personnel and contractors with access to sensitive resources.
* Publicize disciplinary standards. This allows employees to understand the repercussions of noncompliance with access policies and procedures.

Step No. 4: Ensure Compliance Through Training and Communications

Forrester Research's fourth recommendation is the establishment of effective compliance awareness through active training and communication to employees, contractors, and business partners. To avoid corporate wrongdoing and fraud, as well as to reduce liability, organizations must implement effective compliance training programs that help to promote compliance with regulations and rules of corporate conduct. Characteristics of an effective compliance communication and training program include:

* The integration of compliance into the corporate ethics program.
* An active policy communication.
* Required compliance training for all employees, contractors, and consultants who have access to regulated information.
* The acknowledgement of training and policy adherence.
* Up-to-date information regarding relevant changes in regulations and case law.

In essence, companies have to ensure that individuals with access to regulated processes and information understand what they need to do to comply with internal and external regulations.

Step No. 5: Implement Regular Monitoring and Auditing of IT Controls

Monitoring and auditing IT controls for efficiency and effectiveness is the fifth step toward establishing an effective IT compliance program. Where the first recommendation focused on documenting controls, this step focuses on the working operation of those controls. The proper controls to monitor that may affect IT compliance vary in type. Some include:

* Policy, operational, and technical controls.
* Contractual controls.
* Detective, preventive, and corrective controls.
* Compensating controls.

Firms should monitor and audit controls regularly through a manual or automated process, which validates that the control is in place and is operating effectively. When monitoring the management of IT system controls, many organizations prefer automated control monitoring and enforcement to ease the burden of control validation. When controls cannot be automated, organizations should conduct control self-assessments that are facilitated through workflows on compliance management systems. Furthermore, control self-assessments should be augmented by independent verification of audit controls.

Documented controls are meaningless and could become a business liability if they are not implemented or functioning properly. As a result, the role of compliance management is to implement a process of monitoring control implementation and effectiveness. The critical factors in monitoring and auditing IT controls an organization must have are:

* Ongoing validation of controls by management.
* Independent audit verification of controls.
* The establishment of key risk indicators.
* The reporting of control gaps and audit findings in the environment.
* The monitoring of corporate policy compliance.
* The retention and review of audit trails.

In addition, organizations need to establish a process that helps them incorporate any recommendations accepted by management regarding the control monitoring process, and implement an escalation procedure that details how to proceed when agreed-upon recommendations are not implemented.

Step No. 6: Enforce the Control Environment Consistently

The sixth step identifies some of the ways effective compliance programs may promote a consistent enforcement of policies and controls throughout the company. Consistent enforcement of the control environment allows internal controls to be applied appropriately throughout the organization, its business processes, and relationships, as well as make sure specific control violations are not ignored and are enforced according to policy. The organization’s approach to ensure consistent enforcement should drive the success of the overall compliance program. It is through consistent enforcement that the organization’s culture of compliance is achieved and that employees understand there will be zero tolerance for unethical and noncompliant behavior.

If management does not consistently enforce controls and discipline unethical and noncompliant behavior, the compliance program will fail. Penalties for noncompliance increase with regulators and the courts when organizations do not exhibit effective governance and enforcement practices. Vital factors for consistent enforcement of the control environment include:

* Establishing appropriate incentives to endorse strong ethical and compliance behavior.
* Adhering to consistent disciplinary actions.
* Providing open communication and reporting.
* Implementing a systematic approach to incident investigation.
* Establishing a post-incident evaluation process that enables organizations to learn from each incident.

Step No. 7: Prevent and Respond to Incidents and Gaps in IT Controls

An effective IT compliance program prevents and responds to compliance violations and gaps in controls and includes a lessons-learned process to prevent further violations. For instance, identified control deficiencies or incidents should be corrected in an efficient and effective manner. To prevent and respond to IT control incidents, organizations must:

* Develop a control deficiency response plan.
* Maintain an incident response team and procedures.
* Implement active detection and monitoring for gaps and violations.
* Build a lessons-learned process, so the company is not a repeat offender.
* Establish active and cooperative lines of communication with authorities, and communicate with authorities according to response procedures.
* Obtain legal counsel from a knowledgeable source when incidents occur.

Disregarding control gaps and compliance violations amounts to negligence. Therefore, it is essential that an effective compliance program actively identifies and closes all control gaps, as well as contains or eliminates potential damage or loss to the organization incurred by any violations.

BEYOND THE 7 STEPS

Following the seven guidelines above will help organizations build effective IT compliance programs that improve confidence in business performance. In addition, the seven steps help companies manage operational risks and compliance efforts, as well as measure compliance consistently. To implement the steps, organizations need to involve the use of policy, approach compliance as a process as opposed to individual projects, and consider the use of technology to automate compliance management activities.

Furthermore, organizations need to establish a formal risk assessment process so they can take a more comprehensive approach to information security management. This formal risk assessment process will help organizations expand the effectiveness of the seven recommendations above. After conducting an organizationwide information security risk assessment, companies should implement an information asset management strategy, as well as put into practice a business continuity plan that incorporates IT disaster recovery strategies.

ARCHITECTURE FOR SUSTAINABLE COMPLIANCE

Organizations that do not embrace IT compliance management as a defined business process will approach compliance as fragmented projects. Although this mindset may appear to work for a short time, gaps that can push an organization out of compliance may arise quickly. In fact, one of the 11 control areas mentioned in the ISO 27001 standard is compliance with relevant legislation and regulations that affect the organization's activities. Unfortunately, many organizations don't realize what the consequences of noncompliance are until it's too late: When regulators come asking questions, and there is no central person ready to answer them, the organization looks confused and unorganized and receives more scrutiny.

On the other hand, organizations that incorporate the seven steps make effective IT compliance a cost of doing business — not a one-time business event. For these firms, spending money on a compliance program averts far greater expense resulting from losses and penalties. These organizations also establish greater operational control oversight, enabling them to pour more funding into expanding their activities into new areas with confidence. These well-run organizations will contrast sharply with those that remain reactive and tackle compliance problems as isolated and reactionary initiatives. The end game is a culture of IT compliance and controls and a structured approach that demonstrates the business is practicing IT compliance, while managing information security from the most senior level.

Michael Rasmussen is a vice president and analyst in Forrester's IT Management and Services research group. A risk professional with more than 12 years' experience, Rasmussen advises clients around the world on issues pertaining to enterprise risk and compliance management, as well as public policy, legislation, and regulation.

source : www.theiia.org/ITAudit/

Information Security Policy Controls to Reduce the Risk of Home-based Employee Access

Attackers follow the weakest link

The never-ending battle to secure the corporate desktop against viruses, unauthorized software, and spyware now consumes significant resources for many companies. However, as organizations continue to adopt security best-practices to protect their networks, attackers are increasingly targeting the weakest link - the home internet user. Recent studies are now confirming that attacks against user's home computers present increasing risks to business.

Two "mega" trends are making it nearly impossible to ignore the home PC in the corporate security battle. First, the number and frequency of remote workers is growing rapidly. Second, rapidly-evolving threats against the users home PC and the prospect for large financial gain are creating new opportunities for hackers.

Attacks on home PCs on the rise

According Symantec's September 2006 Internet Security Threat Report, home users are the most targeted attack sector, accounting for 86 percent of all targeted attacks. Newer, more sophisticated attacks are using blends of adware, spyware and phishing attacks to lure users to download new malicious code that is becoming harder to detect. As attack vectors move from corporate networks to personal computers, newer attacks are exploiting vulnerabilities in end-user applications such as web browsers and desktop applications, rather than servers and firewalls.

Most compromised home PC become part of an increasing army of "botnets". According to the Symantec report, in the first half of 2006 the company identified more than 4.6 million distinct, active bot network computers and observed an average of 57,717 active bot network computers per day during this period.

As the internet crime business has moved from simple bragging rights to big business, the second largest target are financial services businesses. For example, in October 2006 both the U.S. Securities and Exchange Commission (SEC) and Canada's Investment Dealers Association noted a drastic increase in on-line stocking trading fraud over the last few months. On-line brokerage accounts are being compromised at an alarming rate by keyloggers and other spyware. According to one report, ETrade Financil suffered more than $18 million in losses from fraudulent online trades within a 90 day period.

A home user's PC that is compromised provides several avenues of attack against businesses, including compromised logon credentials, exposure of confidential information (via file-sharing or uploading), and coordinated SPAM and DDOS attacks using botnets. With these attacks escalating, businesses must now consider how the security of a remote PC or laptop may pose a threat to their business.

Security Policy Considerations

So what types of information security policy controls can an organization put in place to help reduce the risk of corporate data being exposed in a home based attack? Let's look at the most common areas of risk and examine some possible security policies.

Password Controls - Networks and systems are still vulnerable to weak passwords and compromised login accounts. Having strong password controls, especially for any accounts with remote access to the network, is critical for protecting the network. An increasing number of breaches are occurring where attackers are gaining access to legitimate login information from third party business partners, and then using these credentials to steal information. Password complexity requirements, password histories, and password expirations are all critical controls to be put in the password policies.

A related password security policy is to prohibit users from using their corporate userids and passwords on public web sites that they may access from home. While sharing passwords between web sites is common for users who must remember a number of different passwords, a compromised on-line brokerage account can lead to a compromised network account if login credentials are shared.

Restricting Data Transfer - Organizations should restrict users from taking sensitive information out of the corporate network and making copies of the data to use at home or one the road. Using flash drives and other portable devices, it is easy for users to make copies of sensitive data and move them to laptops or home PCs. In 2006 alone, there have been over 50 different reported cases of stolen laptops that contained sensitive corporate data.

Organizations can help restrict the flow of sensitive information by auditing or restricting access to USB drives or CD-ROM backup drives. Only certain privileged users should be allowed to remove sensitive information from the company network or physical locations. When sensitive data is removed, it should always be password protected and stored in encrypted format.

Requiring basic PC protection - Organizations should consider updating their Acceptable Use policies to require that users accessing corporate networks from home employ basic security measures on their PC including, at the minimum, Anti-virus and spyware detection. While this type of policy is very difficult to enforce using today's technology, organizations can start by requiring users to sign an agreement that they have these controls in place as part of a provisioning process for remote access. Organizations can aid users by providing access to pre-approved software that has been shown to be effective in the home environment.

User Education and Awareness - Of course, educating users is still one of the most effective controls for reducing the risk of home-based security incidents. Many organizations with a large base of users are including education on protecting the home PC as part of their standard corporate security awareness. Not only does this type of education help reduce corporate risk, is gives the end-user a reason to be motivated to learn about information security principles.

Some organizations now require their users to pass a basic security awareness quiz before being allowed access to corporate resources. It would be appropriate to add the knowledge of how to protect home-based PCs and laptops as part of a standard body of knowledge required for remote access to company information.

Resources

Information Security Policies Made Easy, Version 10 - A complete library of information security policies, including policies for personnel security.

Information Security Roles & Responsibilities Made Easy, Version 2 - An extensive library of documented information security requirements for various organizational roles.

Privacy Management Toolkit, Version 1 - A complete resource for managing customer and employee privacy based on OECD Fair Information Principles.

Other Security Policy and Data Privacy Whitepapers

Access Control: An Introduction To Access Control

The Problem

Your building is secure at night, but during the day there are several doors that have to be open. Anybody could walk in. What can you do?

The Solution

You need an Access Control System.

What is an Access Control System?

Access Control is an electronic security system which permits or restricts access to specific areas of a premises. It not only protects property against unwanted visitors but ensures the safety of both the property and of the people inside.

In simple terms, an Access Control System provides control of entry (or exit) through nominated doors via a control panel and some form of electric locking facility.

An Access Control System can be as simple or as complicated as you wish but in each case, the solution will always provide an easy passage for permitted persons around the building.

Door Entry or Access Control?

Door entry is commonly associated with a single door or gate, whereas access control is more suited to multiple doors or entry points.

Access Control can also incorporate a host of other features which enhance other areas of the business.

Access Control / Door Entry Technology

There are a number of ways that a permitted user can open a door that is fitted with a system.

PIN Code Entry

The most common unit is the keypad system. This comprises a control unit with a series of numbered push buttons, or a touch-sensitive pad, connected to the lock release mechanism via a control unit located at the entrance.

Magstripe (also called Swipe Card) Readers

Each entry point has a card reader and the user “swipes” an encoded card similar to a credit card to gain entry.

This technology is widely used and there are many choices of manufacturers.

Proximity Readers

Rather than swiping the card or tag, it is simply presented to a reader which typically will see the card at a distance of about 100mm. This is a fast, non-contact, method of entry.

Long Range Readers

Long range proximity readers (of approximately a meter or so) automatically unlock or open a door when it detects the card.

This is particularly suitable for compliance with the Disability Discrimination Act (DDA) as no action is required by the card bearer.

Smartcard Readers

For systems that use cards or tags, these cards can also carry additional information which can be used for other building services – – for example, time and attendance functions, integration with payroll systems, car park management and even vending machine applications.

Biometric Readers

A Biometric Reader system uses unique human characteristics – such as finger prints or a retina scan – to clearly identify those who are permitted access.

As there are no cards or tags which can be stolen or lost, or open to misuse, this type of system significantly increases the level of security.

What about Visitors?

You will want to welcome most of those who visit your premises, so it must be easy for them to let you know they are there.

The three most common means of attracting attention are:

• A simple door bell system which alerts your staff to the fact that there is someone waiting outside.

• An audio intercom panel which allows the visitor to have a direct conversation with a member of your staff and, if appropriate, the door can be remotely released.

• An audio intercom panel with a camera facility which allows your staff to see who wants to enter the building before permitting access.

Once access has been permitted, the visitor can either be escorted around or issued with a card or pin number for the duration of their visit.

Things to Consider

When planning an access control system, you should consider the following:

• How many entry/exit points
• Where are these located>
• Level of security desired
• The movement of staff around the building
• Method of operation
• Future growth of building
• Turnover of employees
• Disability access
• Interface with other systems – for example, the fire alarm

As with any type of security system, it is sensible to employ a company that you can trust. Make sure you use a NSI (NACOSS) approved organisation; this will ensure that your system will be designed and installed by professionals.

About the Author:

Pete Childs is the Sales Manager of Christie Intruder Alarms (CIA) Ltd, Security House, 212 - 218 London Road, Waterlooville, Portsmouth, Hampshire, PO7 7AJ, UK http://www.christieintruderalarms.co.uk. CIA specialises in installing Security Systems including Intruder Alarms, Fire Alarms, CCTV and Access Control and Physical Security (Safes & Locks)