% This file was converted to LaTeX by Writer2LaTeX ver. 0.4
% see http://www.hj-gym.dk/~hj/writer2latex for more info

\svnidlong
{$HeadURL$}
{$LastChangedDate$}
{$LastChangedRevision$}
{$LastChangedBy$}
\svnid{$Id$}

\section{Security Check{}-lists}
\label{sec:SecurityChecklists}

\subsection{Physical Environment}
\label{sec:AppendixPhysicalEnvironment}

\begin{longtable}[c]{ p{0.1\textwidth} p{0.5\textwidth} p{0.1\textwidth} p{0.2\textwidth}}
\toprule
\multicolumn{4}{l}{High level information security questionnaire}
\\
&
Question
&
Y or N
&
Additional comment or supporting evidence
\\
\midrule
\endhead
\multicolumn{4}{l}{1. Security Governance
}\\
a
&
Is there an Information Security Policy ?
&
&
\\
b
&
Is this aligned with ISO 17799?
&
&
\\
c
&
Is there a documented risk assessment methodology deployed to assess
security risks associated with new developments/infrastructure changes?
&
&

\\
d
&
Are measures in place to provide user awareness of the policy and
controls for staff working in the Data Centre?
&
&
\\
e
&
Are regular security audits or penetration tests undertaken?
&
&
\\
f
&
Are these internal or external? If external, give details as to type of
test, third party who carried out testing, summary of results?
&
&
\\
\multicolumn{4}{l}{2.1 Physical {}- sit
}\\
a
&
Does the site appear to meet security requirements given the importance
of the site (consider gates, fences, site access, etc.)?
&
&
\\
b
&
Is the site located away from obvious hazards, such as flooding, air
strip or chemical plant?
&
&
\\
c
&
Are facilities used for National Grid segregated in a separate area? IF
so, how is access controlled?
&
&
\\
\multicolumn{4}{l}{2.2 Physical security {}- computer room
}\\
a
&
Is the network equipment stored within a separate computer room?
&
&
\\
b
&
Is the computer room located away from water sources?
&
&
\\
c
&
Is the computer room located in a difficult to get to location (ie.
above ground floor and away from the site perimeter)?
&
&
\\
d
&
Are measures in place to prevent equipment being visible form outside of
the room.
&
&
\\
\multicolumn{4}{l}{2.3 Physical {}- computer room access
}\\
a
&
Does the room have a locked door?
&
&
\\
b
&
Is there adequate control over the allocation and circulation of keys,
swipe cards or other access tokens? Describe.
&
&
\\
c
&
Are only certain and authorised people allowed to approve distribution
of keys or swipe cards?
&
&
\\
d
&
Is the list of personnel with keys or swipe cards formally reviewed on a
regular basis? If so, how regularly?
&


&


\\
e
&
Are cleaning staff restricted from access to the room, and supervised?
&


&


\\
\multicolumn{4}{l}{2.4 Physical {}- computer room envirnment
}\\
a
&
Does the room have a fire detection system?
&


&


\\
b
&
Does the room have a fire suppression system?
&


&


\\
c
&
Does the room have a flood detection system?
&


&


\\
d
&
Does the room have a raised floor?
&


&


\\
e
&
Does the room have a temperature and humidity monitoring system?
&


&


\\
f
&
Does the room have air conditioning?
&


&


\\
g
&
Does the room have CCTV?
&


&


\\
h
&
Are materials that may be a fire hazard or contain hazardous material
not stored inside of the computer room?
&


&


\\
i
&
Are the environmental measurements monitored?
&


&


\\
\multicolumn{4}{l}{2.5 Physical {}- power supply
}\\
a
&
Does the room have power a single computer from dual, independent
panels?
&


&


\\
b
&
Does the room/computer have a UPS? If so, for how long?
&


&


\\
c
&
Does the room have a backup power generator? If so, for how long?
&


&


\\
d
&
Does the computer room have an emergency power cut off?
&


&


\\
e
&
Is the site supplied by power from different sub{}-stations?
&


&


\\
\multicolumn{4}{l}{2.6 Physical {}- comms and cabling
}\\
a
&
Are there multiple physical telecommunication lines into the computer
room that are in separate ducts?
&


&


\\
b
&
Are only approved wireless LANs or other wireless devices in use at the
site?
&


&


\\
c
&
Is all communication equipment housed in a suitable case or cabinet?
&


&


\\
d
&
Is all cabling housed in a protective covering?
&


&


\\
e
&
Is all cabling cleared labelled, with appropriate hazard and warning
signs?
&


&


\\
\multicolumn{4}{l}{2.8 Management
}\\
a
&
Are maintenance schedules on key parts of the infrastructure adhered to
(consider fire suppressions system, electrical and UPS batteries,
cooling equipment)?
&


&


\\
b
&
Is the standard change control process used to cover changes to the
infrastrcuture and configuration of firewalls, routers, etc?
&


&


\\
c
&
Is all equipment monitored for faults centrally?
&


&


\\
\multicolumn{4}{l}{3. Personnel
}\\
a
&
Are there clear guidelines for staff on use of IT systems as part of
their T\&Cs, confidentiality agreements, and a disciplinary process for
breach of these?
&


&


\\
b
&
Is Screening of staff part of the recruitment process? If so, who does
the background check?
&


&


\\
c
&
Are users trained in security requirements and procedures?
&


&


\\
d
&
Are there procedures for reporting security issues, risks and incidents?
&


&


\\
e
&
Are the same security controls applied to contractors and consultants?
&


&


\\
\multicolumn{4}{l}{4. Change management
}\\
a
&
How is the change control processed managed?
&


&


\\
b
&
What are the configuration management procedures for control of software
versions through the build, test, and release process?
&


&


\\
c
&
Procedures are in place for the control of source libraries, development
tools, and developed products?
&


&


\\
\multicolumn{4}{l}{5. Operational management
}\\
a
&
Detailed documented operating procedures exists?
&


&


\\
b
&
Is there a documented security incident response and escalation
procedure?
&


&


\\
c
&
Are operator duties segregated for security purposes?
&


&


\\
d
&
Are any external management services or facilities employed?
&


&


\\
e
&
Are software licenses recorded and controlled?
&


&


\\
f
&
Up to date anti virus software is applied to all servers, desktops and
laptops, and at the perimeter? If so, provide details.
&


&


\\
g
&
What data and application back{}-up and restoration procedures exist?
&


&


\\
h
&
Are system and security logs regularly reviewed?
&


&


\\
i
&
What equipment disposal procedures exist?
&


&


\\
j
&
Are servers and other devices patched in a timely and regular manner? If
so, what tools are used?
&


&


\\
k
&
What are the out{}-of{}-hours support arrangements?
&


&


\\
\multicolumn{4}{l}{6. Logical access controls
}\\
a
&
Is there a general policy or procedure governing network and server
access rights?
&


&


\\
b
&
Are there procedures in place governing the use of privileged accounts,
and are records maintained of privileged users?
&


&


\\
c
&
Are there procedures in place for the authorisation of users,
maintenance of user records and deletion of user accounts?
&


&


\\
d
&
Is there a password policy and procedure? If so, does the policy meet up
with at least three of the following:
&


&


\\


&
Password minimum length of 8 characters
&


&


\\


&
Password should be a mix of alpha and numeric characters
&


&


\\


&
Password should be a mix of upper and lower case
&


&


\\


&
Password should include a special symbol
&


&


\\
e
&
Passwords expire every 30 days
&


&


\\
f
&
All system users shall have a unique user identifier.
&


&


\\
g
&
User identifiers shall not provide any indication of the likely access
facilities available to that user.
&


&


\\
h
&
Following 60 days of inactivity, the access rights of any user shall be
disabled.
&


&


\\
i
&
Are there controls in place for access to different networks and network
services?
&


&


\\
j
&
Are there any user authentication techniques employed other than
Passwords and IDs (eg. Token based access)
&


&


\\
k
&
Is any use made of encryption or digital signatures?
&


&


\\
l
&
Are staff allowed work out of the office/Data Centre e.g., from home? If
so, how is remote connections made?
&


&


\\
m
&
What are the controls on permitted network protocols and connection
types?
&


&


\\
n
&
What controls are in place governing access to software applications?
&


&


\\
o
&
What are the controls to prevent unauthorised access to the network (eg.
3rd party laptop)?
&


&


\\
p
&
Automatically generated system logs shall be maintained to record
security incidents.
&


&


\\
q
&
Event logs shall be protected from unauthorised review of their
contents.
&


&


\\
r
&
Event logs shall include unauthorised access attempts, all privileged
user activities, access to sensitive information such as password
files.
&


&


\\
\multicolumn{4}{l}{7. Network management
}\\
a
&
Is the Data Centre{\textquotesingle}s network physically separate from
the main company{\textquotesingle}s network?
&


&


\\
b
&
If not, is there some logical separation such as firewall? If so, please
give as much detail as you can?
&


&


\\
c
&
From b, is there a formal firewall rule and change management process?
&


&


\\
d
&
From b, is there regular review of firewall rules?
&


&


\\
e
&
From b, is there regular penetration tests of these firewalls?
&


&


\\
f
&
Access by third parties shall only be authorised provided a business
need has been identified.
&


&


\\
g
&
Security controls will be agreed and defined in the contract with the
third party.
&


&


\\
h
&
Are Intruder Detection Systems (IDS) installed, and if so how are these
monitored?
&


&


\\
\multicolumn{4}{p{16.799cm}}{8. Development and maintenance
}\\
a
&
Is a standard project planning \& development methodology used on the
National Grid account?
&


&


\\
b
&
Duties are suitably segregated to ensure that the opportunity for
unauthorised activities is reduced.
&


&


\\
c
&
Data entry, system administration, systems development/maintenance,
change management and security administration are segregated.
&


&


\\
d
&
Are there procedures in place to include hardware and software security
requirements in specification documents?
&


&


\\
e
&
Does system testing include security requirements {}- eg \ data
validation, firewall functions and resilience?
&


&


\\
f
&
Access to program source libraries shall be controlled in a manner that
is consistent with the business risks.
&


&


\\
g
&
Are there software change control processes for applications, operating
systems and layered products on servers and network devices?
&


&


\\
h
&
What quality records are maintained of the overall development \&
maintenance processes?
&


&


\\
\multicolumn{4}{l}{9. Business continuity and DR
}\\
a
&
Has an assessment of business continuity and disaster risks been
undertaken?
&


&


\\
b
&
Do business continuity plans and DR procedures exist? If so, can we have
details.
&


&


\\
c
&
Business continuity and DR procedures are exercised regularly? If so,
how often?
&


&


\\
\end{longtable}
\subsection{Application Development}
\label{sec:AppendixApplicationDevelopment}

\begin{longtable}[l]{p{0.1\textwidth} p{0.7\textwidth} *{3}{p{0.05\textwidth}} }

\multicolumn{5}{l}{PROJECT:}
\\
\multicolumn{5}{l}{Information Security {}- technical checklist {}- controls for web
applications}
\\
&
&
R
&
A
&
G
\\
\endhead
\multicolumn{5}{l}{Administration}
\\
1.1
&
Appropriate user and password procedures are in place for Helpdesk 
&
&
&
\\
1.2
&
The system does not allow for password retrieval (i.e. passwords have to
be reset)
&
&
&
\\
1.3
&
The system require some form of verification before resetting a password
&
&
&
\\
1.4
&
Users are educated on how to protect their account information 
&
&
&
\\
1.5
&
Navigation around the application is easy
&
&
&
\\
1.6
&
Source code do not reveal inappropriate information 
&
&
&
\\
1.7
&
Adequate system documentation around authenticationauthorisation and
auditing are in place 
&
\ 
&
&
\\
\multicolumn{5}{l}{Authentication {--} ``who can get in?''}
\\
2.1
&
The system requires both a username and password
&
&
&
\\
2.2
&
The system allows for, encourage, or enforce strong passwords (e.g.
minimum 6{}-8 characters)
&
&
&
\\
2.3
&
The system allows for password aging and enforce a password history
(e.g.change every 30{}-90 dayshistory of 12) 
&
&
&
\\
2.4
&
The system does not permit easily{}-guessed usernames and passwords
(e.g.password cannot equal user id) 
& 
&
&
\\
2.5
&
The system does not allow the harvesting of usernames through the
application 
&
&
&
\\
2.6
&
Error messages do not provide too much information about usernames or
passwords
&
&
&
\\
2.7
&
The system does not provide the last username that logged on i.e.the
user has to re{}-type username 
&
&
&
\\
2.8
&
Controls exists to prevent brute{}-force guessing of usernames or
password 
&
&
&
\\
2.9
&
The source code does not contain any hard{}-coded username or password
checks
&
&
&
\\
2.10
&
Users cannot change their username
&
&
&
\\
2.11
&
Users can easily change their own passwords \ 
&
&
&
\\
2.12
&
Users required to re{}-authenticate before changing a password
&
&
&
\\
2.13
&
The system assigns temporary initial passwords that are unique and not
easy to guess
&
&
&
\\
2.14
&
There is no sharing of administrative user accounts and passwords \ 
&
&
&
\\
2.15
&
There is no sharing of other accounts and passwords \ 
&
&
&
\\
2.16
&
The system transmits user credentials over a secure channel
&
&
&
\\
2.17
&
Passwords are stored using a strong hashing algorithm
&
&
&
\\
2.18
&
Users cannot bypass authentication by accessing a module directly
&
&
&
\\
2.19
&
The system does not allow authentication to the Web
server{\textquotesingle}s operating system or network
&
&
&
\\
2.20
&
The system prevent account hopping (e.g. via URL)
&
&
&
\\
2.21
&
A third party cannot trick users into authenticating to fake login pages
&
&
&
\\
2.22
&
Users cannot customise their security options
&
&
&
\\
2.23
&
Users cannot revoke or delete accounts
&
&
&
\\
2.24
&
A hijacked cookie will not allow a user logon 
&
&
&
\\
2.25
&
Sensitive information such as passwords is not stored in cookies
&
&
&
\\
2.26
&
Cookies have a reasonable expiration date
&
&
&
\\
2.27
&
Input field validation checks have been built in \ 
&
&
&
\\
\multicolumn{5}{l}{Authorisation {--} ``what can they do?''
}\\
3.1
&
Users have the option to log out of their session in a controlled manner
&
&
&
\\
3.2
&
The system destroy session tokens upon logging out or timing out
&
&
&
\\
3.3
&
Session expiration mechanisms are in place
&
&
&
\\
3.4
&
Users are grouped and have specific and restricted rights privileges
&
&
&
\\
3.5
&
Users assignment of groups and their roles have been formally documented
and approved
&
&
&
\\
3.6
&
There are restrictions to the ``back'' and ``forward'' web buttons
&
&
&
\\
3.7
&
The ``right click'' functionality of the web browser is disabled
&
&
&
\\
\multicolumn{5}{l}{Auditing {--} ``what have they done?''
}\\
4.1
&
Users get to see their account history \ 
&
&
&
\\
4.2
&
Users can easily report security incidents \ 
&
&
&
\\
4.3
&
All user activity is logged
&
&
&
\\
4.4
&
All key changes to system parameters and users are logged
&
&
&
\\
4.5
&
The above key changes and any unusual events are reviewed and followed
up
&
&
&
\\
\multicolumn{5}{l}{Availability}
\\
5.1
&
Number of concurrent logins is restricted
&
&
&
\\
5.2
&
Reports queries or processes are properly queued and prioritised and
assigned appropriate resources \ 
&
&
&
\\
\bottomrule
\end{longtable}