Security of Business Terminals

Security control policies such as device authentication, approval, access scope configuration, and device security settings must be established and implemented for terminals used for business, including PCs, laptops, virtual PCs, and tablets.

• Criteria for permitting business terminals
• Scope of business use through business terminals
• Approval procedures and methods for using business terminals
• Authentication methods when connecting to the business network: device authentication, MAC authentication, etc.
• Security setting policy for business terminal use, such as installation of antivirus and security programs
• Security setting policy for business terminal use and measures for monitoring misuse/abuse, etc.

※ Security management and monitoring measures for business terminal use (examples)

• User security setting policy for business terminals (antivirus installation, security patches, caution when using in public places, data wiping upon loss, etc.)
• Policy, training, assignment of responsibility, and disciplinary standards to prevent leakage of personal information and internal data
• Monitoring measures to identify whether business devices are misused/abused
• Measures to review the safety of software installed on business devices
• Measures to prevent malicious code on business devices
• Access control measures for business devices to prevent leakage/exposure of personal information through the internet, open wireless networks, etc.

To prevent the leakage of personal information and important information through business terminals, policies such as prohibition of file-sharing programs, restriction of sharing settings, and control of wireless network use must be established and implemented.

• When sharing settings are unavoidable, set an access-permission password on the business terminal, and remove the sharing setting after use is complete
• When file transfer is the main purpose, grant only read permission, and set write permission individually only when the other party needs to write
• Prevent intentional/careless leakage/exposure of personal information and important information through P2P programs, commercial webmail, web-hard, messengers, SNS services, etc.
• Use of wireless networks to which security protocols such as WPA2 (Wi-Fi Protected Access 2) are applied, etc.

To prevent the leakage/exposure of personal information and important information due to loss or theft of business mobile devices, security measures such as password setting must be applied.

※ Measures against loss/theft of business mobile devices (examples)

• Set screen lock using passwords, patterns, PINs, fingerprints, iris recognition, etc.
• Encrypt applications, data, etc. using device encryption functions, etc.
• Remote lock and remote data wipe using functions provided by the mobile device manufacturer or the mobile carrier (kill switch service, etc.)
• For mobile devices that process important personal information, install a mobile device management program such as MDM (Mobile Device Management) to enable remote lock, remote data wipe, access control, etc.

The adequacy of access control measures for business terminals must be reviewed periodically.

• History of application/approval, registration/deregistration, and device authentication of business terminals
• Status of security settings of business terminals, etc.