Information System Access
Certification criterion
For information systems such as servers and network systems, the users allowed to access, the access restriction methods, and the secure access means, etc. must be defined and controlled.
Key checkpoints
- For each information system such as servers, network systems, and security systems, are the users allowed to access the operating system (OS), the permitted access locations, and the access means, etc. defined and controlled?
- When no work is performed for a certain period of time after connecting to an information system, is the system connection automatically blocked?
- Are services unrelated to the purpose of using the information system removed?
- Are information systems that provide major services operated on dedicated (independent) servers?
Detailed explanation
※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.6.2 Information System Access], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).
For each information system such as servers, network systems, and security systems, the users allowed to access the operating system (OS), the permitted access locations, and the access means, etc. must be defined and controlled.
- Application/approval procedures for accounts and privileges
- Granting an individual account per user and restricting the use of shared accounts
- Periodic review and up-to-date management of account usage status: presence of long-unused accounts, unnecessary accounts, etc.
- Access location restriction: restriction of the accessor's IP address, etc.
- Consideration of strengthened authentication means for special privileges such as administrators: certificates, OTP, etc.
- Application of secure access means: SSH, SFTP
- Access control measures for connections between servers within the same network area, etc.
When no work is performed for a certain period of time after connecting to an information system, measures must be taken so that the system connection is automatically blocked.
- Set the session retention time considering each server's characteristics, the work environment, the magnitude of risk, legal requirements, etc.
Services or ports that are unrelated to the purpose of using the information system or that could cause a security incident must be identified and removed or blocked.
- Implement additional security functions for insecure services, protocols, and daemons
- Unless there is an unavoidable reason, restrict the use of insecure services/protocols such as Netbios, File-Sharing, Telnet, and FTP, and use secure technologies such as SSH, SFTP, and IPSec VPN
Servers that provide major services must be operated as dedicated (independent) servers.
- Web servers, database servers, application programs, etc. that directly provide services to the outside or that store/process sensitive information must not be used as shared equipment but must use dedicated servers
Related laws
- Personal Information Protection Act Article 29 (Duty of Safety Measures)
- Standards for Measures to Ensure the Safety of Personal Information Article 6 (Access Control)
Evidence (examples)
- List of information system operating system accounts
- Server security settings
- Server access control policy (SecureOS management screen, etc.)
- Server and network configuration diagram
- Information asset inventory
Nonconformity examples
- A case where a server administrator in the office accesses a Windows server located in the IDC using terminal services, but no session timeout is configured for the terminal service, so the session is not blocked even when no work is performed for a long time
- A case where connections between servers are not properly restricted, so a specific user, after connecting to a server for which they are authorized, can also connect to other unauthorized servers by relaying through that server
- A case where insecure connection protocols (telnet, ftp, etc.) are used for access without a valid reason or compensating measures, and unnecessary services and ports are left open
- A case where the access control policy requires that all access to servers go through a server access control system, but a bypass path exists that allows access to servers without going through the server access control system