Internet Access Control

Based on official sourcesISMSISMS-PCheckpoints 3Evidence 5Cases 5

Certification criterion

To prevent information leakage through the Internet, malicious code infection, penetration of the internal network, and similar risks, an Internet access control policy shall be established and implemented, including restricting Internet access or services (P2P, web hard drives, messengers, etc.) for key information systems, terminals performing key duties, terminals handling personal information, etc..

Key checkpoints

Is a control policy for the Internet access of business PCs, such as terminals performing key duties and terminals handling personal information, established and implemented?
Is unnecessary external Internet access from key information systems (DB servers, etc.) controlled?
Where an obligation to block the Internet network is imposed under relevant laws, are the applicable persons identified and the Internet network blocking measure applied in a secure manner?

Detailed explanation

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.6.7 Internet Access Control], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

To reduce to an appropriate level the risks of information leakage through the Internet, malicious code infection, penetration of the internal network, and similar risks, a control policy for the Internet access of business PCs, such as terminals performing key duties and terminals handling personal information, shall be established and implemented.

Network configuration policy for Internet connection
User access policy for external email use, Internet site access, software download and transmission, etc.
Policy for blocking access to harmful sites (adult, entertainment, etc.)
Policy for blocking access to sites that may enable information leakage (web hard drives, P2P, remote access, etc.)
Policy related to network separation or Internet network blocking measures (whether network separation is applied, persons subject to network separation, network separation method, inter-network data transfer procedures, etc.)
Policy for review (monitoring) of Internet access history, etc.

Unnecessary external Internet access from key information systems (database servers, etc.) shall be controlled.

Restrict external Internet access from internal servers (DB servers, file servers, etc.) so that malicious code introduction, information leakage, reverse-direction access, etc. are blocked
Where there is an unavoidable reason, prepare protective measures through risk analysis and allow access after approval by the responsible officer

Where an obligation to block the Internet network is imposed under relevant laws, the persons subject to Internet network blocking shall be identified and the Internet network blocking measure shall be applied in a secure manner.

Targets to which the Internet network blocking measure applies under the Personal Information Protection Act
- (Personal information controllers subject to the obligation) Personal information controllers for whom the average daily number of users whose personal information has been stored/managed over the three months immediately preceding the end of the previous year is at least one million
- (Computers, etc. subject to the obligation) Computers, etc. of personal information handlers who can download, destroy, or set access rights to personal information in the personal information processing system
- (Measures when using external cloud services) Where a personal information processing system is configured/operated using cloud computing services under Article 2, Subparagraph 3 of the "Act on the Development of Cloud Computing and Protection of Its Users", apply a measure that blocks the Internet except for access to the relevant service
Apply the Internet network blocking measure in a secure manner, taking into account the following:
- Review whether the entity is subject to the Internet network blocking obligation and, if subject, identify the persons subject to the Internet network blocking measure
- Where not subject to the Internet network blocking obligation, decide whether to apply the Internet network blocking measure according to the results of risk analysis, etc.
- Apply the Internet network blocking measure by a physical method (e.g., configuring two PCs with separated networks) or a logical method (e.g., using virtualization technology such as VDI)
- Identify bypass paths for the Internet network blocking measure and apply control measures
- Prepare control measures for the secure data transfer of computers to which the Internet network blocking measure is applied
- Conduct periodic inspections of the adequacy of the Internet network blocking environment and the existence of vulnerabilities, etc.

Related laws

Personal Information Protection Act Article 29 (Duty of Safety Measures)
Standards for Measures to Ensure the Safety of Personal Information Article 6 (Access Control)

Evidence (examples)

Policy for blocking non-business sites (P2P, etc.) (management screen of the non-business site blocking system, etc.)
Internet access history monitoring records
List of persons subject to the Internet network blocking measure
Inter-network data transfer procedures and processing records (application/approval records, etc.)
Network configuration diagram

Nonconformity examples

Where the Internet network blocking measure was applied under the Personal Information Protection Act, but the measure was omitted for some obligated persons, such as those able to set access rights to the personal information processing system
Where, being subject to the Internet network blocking obligation under the Personal Information Protection Act, the Internet network blocking measure was applied, but bypass access via another server is possible, allowing personal information to be downloaded, destroyed, etc. by connecting to the personal information processing system in an environment where the Internet network blocking measure is not applied
Where some servers located in the DMZ and the internal network can unnecessarily make direct connections to the Internet
Where the Internet network blocking measure is applied by physically separating the Internet PC and the internal business PC and an inter-network data transfer system is built/operated, but there is no approval procedure for data transfer and periodic review of data transfer records is not performed
Where internal rules require that a personal information handler obtain approval from the responsible officer to access P2P and web hard drive sites and that access be allowed only for a specific period, but there are numerous cases in which exceptional access was allowed without going through the approval procedure