한국어
2.9.3

Public Server Security

Based on official sourcesISMSISMS-PCheckpoints 4Evidence 3Cases 3

Certification criterion

For servers exposed to external networks, the organization shall separate them from the internal network and establish/implement strengthened protective measures such as vulnerability assessment, access control, authentication, and procedures for information collection/storage/disclosure.

Key checkpoints

  1. When operating public servers, are protective measures for them established and implemented?
  2. Are public servers installed in a DMZ (Demilitarized Zone) area separated from the internal network and protected through security systems such as firewalls?
  3. When personal information and important information must be posted or stored on a public server, are authorization and posting procedures such as approval by the responsible officer established and implemented?
  4. Is it periodically checked whether the organization's important information is exposed through websites and web servers, and when exposure of important information is recognized, are measures such as immediate blocking taken?

Detailed explanation

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.10.3 Public Server Security], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

  • When operating public servers such as web servers, protective measures for them shall be established and implemented.

    • Build a secure server, such as installing SSL (Secure Socket Layer)/TLS (Transport Layer Security) certificates when transmitting/receiving personal information through the web server
    • Install antivirus software and configure updates
    • Install the latest security patches for applications (web servers, openssl, etc.), operating systems, etc.
    • Remove unnecessary services and block unnecessary ports
    • Prohibit installation of unnecessary software, scripts, executable files, etc.
    • Prohibit exposure of unnecessary pages such as error handling pages and test pages
    • Perform periodic vulnerability assessments, etc.

  • Public servers shall be installed in a DMZ area separated from the internal network and protected through security systems such as firewalls.

    • Apply an access control policy through firewalls, etc., so that intrusion into the internal network through a public server is impossible even if the public server is compromised
    • When a public server in the DMZ needs to connect to information systems such as databases or a WAS (Web Application Server) located in the internal network, apply a strict access control policy

  • When personal information and important information must be posted or stored on a public server, authorization and posting procedures such as approval by the responsible officer shall be established and implemented.

    • In principle, prohibit the storage of personal information and important information within web servers in the DMZ zone, and when unavoidably necessary for business, apply authorization procedures and protective measures
    • When posting personal information and important information on a website, perform prior review and approval procedures
    • Take measures so that personal information and important information are not exposed to unauthorized persons through external search engines, etc.

  • It shall be periodically checked whether the organization's important information is exposed through websites and web servers, and when exposure of important information is recognized, measures such as immediate blocking shall be taken.

    • Periodically inspect through search engines, etc., and apply necessary measures
    • When exposure of important information is recognized, block it on the website and request the relevant search engine operator to prevent continued exposure through caches, etc.

Related laws

No individual legal provision directly corresponding to this item is specified.

Evidence (examples)

  • Network configuration diagram
  • Website information disclosure procedures and records (application/approval/posting history, etc.)
  • Inspection history of whether personal information and important information is exposed

Nonconformity examples

  • A case where, due to a vulnerability in a website published on the internet, another person's personal information could be accessed without viewing authority through a Google search
  • A case where internal regulations require an approval procedure when posting personal information on a website, but numerous instances existed where personal information was posted without complying with this
  • A case where, in a web application such as a bulletin board, posts written by others could be arbitrarily modified/deleted, or password-protected posts could be viewed

Source

Source: The certification criterion is based on [Annex 7-2] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2024.7.24); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2024.7.24); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7-2
Applies toISMS / ISMS-P
Key checkpoints4
Evidence3
Cases3
Related laws-
Annex 7 / 2.9.3Annex 7