Security System Operation

Based on official sourcesISMSISMS-PCheckpoints 6Evidence 8Cases 4

Certification criterion

For each type of security system, the organization shall establish and implement operating procedures such as assigning administrators, applying the latest policy updates, changing rulesets, and monitoring events, and shall manage the status of policy application for each security system.

Key checkpoints

Are operating procedures established and implemented for the security systems operated by the organization?
Are the personnel permitted to access, such as security system administrators, minimized and is access by unauthorized persons strictly controlled?
For each security system, is a formal procedure established and implemented for the new registration, change, and deletion of policies?
Is the registration of exception policies for security systems managed according to procedure, and are the users of exception policies managed with minimal privileges?
Is the validity of the policies configured in the security systems reviewed periodically?
To prevent illegal access to the personal information processing system and the leakage of personal information, is a security system that performs the functions prescribed by the relevant laws installed and operated?

Detailed explanation

For the security systems operated by the organization, operating procedures including the following shall be established and implemented.

Assignment of persons responsible and administrators for each type of security system
Procedures for applying (registering, changing, deleting, etc.) security system policies (rulesets, etc.)
Method for the latest policy updates: for security systems such as IDS and IPS, continuous updating of the latest patterns (signatures) and engines to detect new attack techniques
Security system event monitoring procedures (detection and confirmation of anomalies that violate policy, etc.)
Security system access control policy (user authentication, administrator terminal IP or MAC, etc.)
Periodic inspection of the security system operation status
Access control measures for the security system itself, etc.

※ Types of security systems (examples)

Network security systems: firewall, intrusion prevention system (IPS), intrusion detection system (IDS), network access control (NAC), DDoS response system, virtual private network (VPN), etc.
Server security systems: system access control, secure operating system (SecureOS)
Database security systems: database access control
Information leakage prevention systems: Network DLP (Data Loss Prevention), Endpoint DLP, etc.
Personal information protection systems: personal information detection solutions, output/print security, personal information access log management solutions, etc.
Encryption solutions: database encryption, DRM, etc.
Malware response solutions: antivirus, patch management system (PMS), EDR (Endpoint Detection Response), etc.
Others: APT response solution, SIEM (Security Incident and Event Monitoring), web application firewall, etc.

The personnel permitted to access, such as security system administrators, shall be minimized and access by unauthorized persons shall be strictly controlled.

Apply protective measures such as strengthened user authentication (OTP, etc.) and administrator terminal IP or MAC access control to strictly control access by unauthorized persons other than the personnel permitted to access, such as security system administrators
Check for access attempts by unauthorized persons through periodic analysis of security system access logs

For each security system, a formal procedure for the new registration, change, and deletion of policies shall be established and implemented.

Application and approval procedures for registering, changing, and deleting policies for each security system, such as firewalls and DLP
Preservation of security system policy application/approval/enforcement records to ensure accountability
Considerations when applying security system policies (rulesets)
- Grant only the minimum privileges necessary for business according to the principle of least privilege
- Manage the network access control policy on the basis of blocking everything by default, while individually adding only the IPs and Ports that must be permitted for business
- When configuring security policies, apply them with a limited period of use according to the purpose
- Manage the registration/change of security policies through formal procedures, etc.

The registration of exception policies for security systems shall be managed according to procedure, and the users of exception policies shall be managed with minimal privileges.

Review of the validity of the reason for application
Security review: security review according to the exception policy and preparation of supplementary measures
Exception policy application/approval: approval by the person responsible or the person in charge for each security system
Monitoring of whether exception policies have expired and of the use of exceptions, etc.

The validity of the policies configured in the security systems shall be reviewed periodically, taking the following into consideration.

Violation of internal security policies/guidelines (excessively permissive rules, etc.)
Policies registered without going through a formal approval procedure
Policies unused for a long period
Duplicate policies or policies whose period of use has expired
Policies related to departing personnel and persons who have changed duties
Policies related to exceptions, etc.

To prevent illegal access to the personal information processing system and the leakage of personal information, a security system that performs the functions prescribed by law shall be installed and operated.

Mandatory functions required of the access control system by the personal information protection laws
1. Restrict access privileges to the personal information processing system by IP address, etc., to restrict unauthorized access
2. Analyze the IP addresses, etc., that have accessed the personal information processing system to detect and respond to attempts to leak personal information
When the personal information processing system is configured in a cloud environment, the access control function can be implemented using the security functions or services provided by the cloud service provider

Related laws

Personal Information Protection Act Article 29 (Duty of Safety Measures)
Standards for Measures to Ensure the Safety of Personal Information Article 6 (Access Control)

Evidence (examples)

Security system configuration
Network configuration
Security system operating procedures
Firewall policy
Firewall policy configuration/change request form
List of security system exception holders
Management screens for each security system (firewall, IPS, server access control, DLP, DRM, etc.)
Security system policy review history

Nonconformity examples

Where periodic review of the firewall security policy is not performed, resulting in the existence of numerous unnecessary or excessively permissive policies
Where there are no procedures and standards for the application, change, deletion, and periodic review of security system security policies, or where procedures exist but are not complied with
Where management and supervision of the assignment of security system administrators and the status of privilege grants is not properly implemented
Where the internal guidelines stipulate that the information security officer shall record/retain the change history of the security system security policy, but the policy management ledger is not prepared periodically, or the security policy recorded in the policy management ledger differs from the security policy of the system actually in operation