What Is Multi-Factor Authentication (MFA)? – ISMS TIPS – WEEK IV

What Is Multi-Factor Authentication (MFA)?

Multi-factor authentication (MFA) is a security mechanism that requires users to provide two or more forms of identification before accessing an account or system. The goal of MFA is to make it more difficult for unauthorized users to gain access to sensitive information. Traditionally, authentication is done with a username and password, but this method is not very secure. Usernames are often easy to guess, and passwords can be stolen or hacked. MFA adds an extra layer of security by requiring a second form of identification, such as a fingerprint, a smart card, or a one-time code sent to your phone. This way, even if someone knows your password, they still can’t access your account without the second factor.

Multi-factor authentication, or MFA, protects your applications by using a second source of validation before granting access to users. Common examples of multi-factor authentication include personal devices, such as a phone or token, or geographic or network locations. MFA enables organizations to verify the identities of users before they can gain entry to critical systems.

Why is multi-factor authentication needed?

As organizations digitize operations and take on greater liability for storing customer data, the risks and need for security increase. Because attackers have long exploited user login data to gain entry to critical systems, verifying user identity has become essential.

Authentication based on usernames and passwords alone is unreliable and unwieldy, since users may have trouble storing, remembering, and managing them across multiple accounts, and many reuse passwords across services and create passwords that lack complexity. Passwords also offer weak security because of the ease of acquiring them through hacking, phishing, and malware.

What are some examples of multi-factor authentication?

Cloud-based authenticator apps such as Duo are engineered to provide a smooth login experience with MFA. They are designed to integrate seamlessly within your security stack. With Duo, you can:

• Verify user identities in seconds
• Protect any application on any device, from anywhere
• Add MFA to any network environment

 How does multi-factor authentication work?

MFA requires means of verification that unauthorized users won’t have. Since passwords are insufficient for verifying identity, MFA requires multiple pieces of evidence to verify identity. The most common variant of MFA is two-factor authentication (2FA). The theory is that even if threat actors can impersonate a user with one piece of evidence, they won’t be able to provide two or more.

Proper multi-factor authentication uses factors from at least two different categories. Using two from the same category does not fulfill the objective of MFA. Despite wide use of the password/security question combination, both factors are from the knowledge category–and don’t qualify as MFA. A password and a temporary passcode qualify because the passcode is a possession factor, verifying ownership of a specific email account or mobile device.

CFS ISMS MANAGER

CLOUD SECURITY

Cloud security is the set of cybersecurity measures used to protect cloud-based applications, data, and infrastructure from unauthorized access, online attacks, and insider threats. Cloud security involves applying security policies, practices, controls, and other technologies to help secure cloud environments.

Cloud security is important because it enables organizations to benefit from the flexibility, scalability, and innovation of cloud computing while minimizing the risks of data breaches, compliance violations, and service disruptions. Cloud security also helps organizations meet their regulatory and legal obligations regarding data protection and privacy.

Cloud security works by following a shared responsibility model between the cloud service provider (CSP) and the customer. The CSP is responsible for securing the cloud infrastructure, such as servers, storage, networks, and virtualization. The customer is responsible for securing the data, applications, and user access in the cloud. Depending on the type of cloud service model used (IaaS, PaaS, or SaaS), the level of responsibility may vary.

Some examples of cloud security measures are:

• Identity and access management (IAM): This is a process of verifying the identity of users and devices and granting them appropriate permissions to access cloud resources. IAM helps prevent unauthorized access and enforce the principle of least privilege.
• Encryption: This is a method of transforming data into an unreadable format using a secret key. Encryption helps protect data from being intercepted or tampered with while in transit or at rest in the cloud.
• Firewall: This is a device or software that monitors and filters network traffic based on predefined rules. Firewall helps block malicious or unwanted traffic from reaching or leaving the cloud.
• Antivirus: This is a software that detects and removes malware from devices or systems. Antivirus helps prevent malware infections that could compromise data or functionality in the cloud.
• Backup: This is a process of creating copies of data and storing them in a separate location. Backup helps ensure data availability and recovery in case of accidental deletion, corruption, or disaster in the cloud.

If you want to learn more about cloud security, you can check out these web search results:

• What is Cloud Security? Cloud Security Defined | IBM
• What Is Cloud Security? | Google Cloud
• Cloud Security | What is cloud security – Javatpoint
• What is Cloud Security? – Benefits of Cloud Based Security – Box

CFS ISMS MANAGER

INFORMATION CLASSIFICATION POLICY – ISMS TIPS – WEEK IV

Adopting a full set of information security policies is a critical step in ensuring that every department and employee understands their role in helping protect company, customer, and employee data.  

To properly manage risk, organizations need to understand how to properly store, process, transmit, and destroy sensitive data based on the risk that information poses to the organization. 

Purpose 

The purpose of the Information Classification and Management Policy is to provide a system for classifying and managing Information Resources according to the risks associated with its storage, processing, transmission, and destruction. 

Audience 

The Information Classification and Management Policy applies to any individual, entity, or process that interacts with any Information Resource. 

Responsibilities 

Information User 

• The person, organization or entity that interacts with Information for the purpose of performing an authorized task. 
• Have a responsibility to use Information in a manner that is consistent with the purpose intended and in compliance with policy.  Information Owner 

• The person responsible for, or dependent upon, the business process associated with an information resource. 
• Is knowledgeable about how the information is acquired, transmitted, stored, deleted, and otherwise processed. 
• Determines the appropriate value and classification of information generated by the owner or department. 
• Must communicate the information classification when the information is released outside of the department and/or. 
• Controls access to their information and must be consulted when access is extended or modified. 
• Must communicate the information classification to the Information Custodian so that the Information Custodian may provide the appropriate levels of protection. 
• Must periodically review their information to ensure the proper classification is applied.  Information Custodian 

• Maintains the protection of Information according to the information classification associated to it by the Information Owner. 
• Delegated by the Information Owner and is usually Information Technology personnel.  
  Policy Information Classification 

• Information owned, used, created or maintained by should be classified into one of the following three categories: 
  • Public 
  • Internal 
  • Confidential 
  •  
• Public Information: 
  • Is information that may or must be open to the general public. 
  • has no existing local, national, or international legal restrictions on access or usage. 
  • While subject to disclosure rules, is available to all employees and all individuals or entities external to the corporation.  Examples of Public Information include: 

• Publicly posted press releases, 
• Publicly available marketing materials, 
• Publicly posted job announcements. 

• Internal Information: 
  • Is information that must be guarded due to proprietary, ethical, or privacy considerations. 
  • Must be protected from unauthorized access, modification, transmission, storage or other use and applies even though there may not be a civil statute requiring this protection. 
  • Is restricted to personnel designated by who have a legitimate business purpose for accessing such Information.  Examples of Internal Information include: 

• Employment Information, 
• Business partner information where no more restrictive confidentiality agreement exists, 
• Internal directories and organization charts, 
• Planning documents, 

• Confidential Information: 
  • Is information protected by statutes, regulations, policies or contractual language. Information Owners may also designate Information as Confidential. 
  • Is sensitive in nature, and access is restricted. Disclosure is limited to individuals on a “need-to-know” basis only. 
  • Disclosure to parties outside of must be authorized by executive management, approved by the Director of Information Technology and/or General Counsel, or covered by a binding confidentiality agreement. 

Examples of Confidential Information include: 

• Customer data shared and/or collected during the course of a consulting engagement, 
• Financial information, including credit card and account numbers, 
• Social Security Numbers, 
• Personnel and/or payroll records, 
• Any Information identified by government regulation to be treated as confidential, or sealed by order of a court of competent jurisdiction, 
• Any Information belonging to a customer that may contain personally identifiable information, 
• Patent information. 

Information Handling

• All Information should be labeled according to the Labelling Standard. 
• Public: 
  • Disclosure of Public Information must not violate any pre-existing, signed non-disclosure agreements. 
• Internal: 
  • Must be protected to prevent loss, theft, unauthorized access, and/or unauthorized disclosure. 
  • Must be protected by a confidentiality agreement before access is allowed. 
  • Must be stored in a closed container (i.e., file cabinet, closed office, or department where physical controls are in place to prevent disclosure) when not in use. 
  • Is the “default” classification level if one has not been explicitly defined. 
• Confidential: 
  • When stored in an electronic format must be protected with a minimum level of authentication to include strong passwords as defined in the Authentication Standard. 
  • When stored on mobile devices and media, must be encrypted. 
  • Must be encrypted at rest. 
  • Must be stored in a locked drawer, room, or area where access is controlled by a cipher lock and/or card reader, or that otherwise has sufficient physical access control measures to afford adequate protection and prevent unauthorized access by members of the public, visitors, or other persons without a need-to-know. 
  • Must not be transferred via unsecure communication channels, including, but not limited to: 
    • Unencrypted email 
    • Text messaging 
    • Instant Messaging 
    • Unencrypted FTP 
    • Mobile devices without encryption 
  • When sent via fax, must be sent only to a previously established and used address or one that has been verified as using a secured location. 
  • When transmitted via USPS or other mail service, must be enclosed in a sealed security envelope. 
  • Must not be posted on any public website. 
  •  Management must be notified in a timely manner if Information classified as Confidential has been or is suspected of being lost or disclosed to unauthorized parties. 

Information Retention & Destruction 

• All information stored by must be stored in accordance with the Data Retention Schedule. 
• All information maintained by must include a documented timestamp or include a timestamp as part of metadata. 
• Information that is no longer required to be maintained by is classified as “Expired” and must be destroyed in accordance with the Media Reuse and Destruction Standard. 
• Information owners should be consulted prior to information destruction and may have the opportunity to extend Information expiration, given business needs and/or requirements for the extended retention. 
•  customers may have their own information retention requirements that supersede ’s requirements. Such customer requirements should be documented in contractual language. 

CFS ISMS MANAGER

CLEAR DESK/CLEAR SCREEN POLICY – ISMS TIPS – WEEK III

Clear Desk and Clear Screen policy refers to an organizational practice that requires employees to maintain a clutter-free workspace and ensure that computer screens are free from sensitive or confidential information when not in use. This policy is implemented to protect the security and privacy of sensitive company information and prevent data breaches.

TELEWORKING – ISMS TIPS – WEEK II

CFS ISMS MANAGER

How to Report an Information Security Incident?

What is a Security Incident?

A security incident is any attempted or actual unauthorized access, use, disclosure, modification, or destruction of information. This includes interference with information technology operation and violation of the organization’s policy, laws or regulations.

Examples of security incidents include:

• Computer system breach
• Unauthorized access to, or use of, systems, software, or data
• Unauthorized changes to systems, software, or data
• Loss or theft of equipment storing institutional data
• Denial of service attack
• Interference with the intended use of IT resources
• Compromised user accounts

It is important that actual or suspected security incidents are reported as early as possible so that campus can limit the damage and cost of recovery. Include specific details regarding the system breach, vulnerability, or compromise of your computer and we will respond with a plan for further containment and mitigation.

How to report a security incident

email: it@cfsfin.com

phone: 234-909-032-9828
Important: If the incident poses any immediate danger, contact the Incidence Response Team immediately via unitsheads@cfsfin.com

Information to include in the report:

• Your name
• Department
• Email address
• Telephone number
• Description of the information security problem
• Date and time the problem was first noticed (if possible)
• Any other known resources affected

To report an information security incident, follow these steps:

1. Identify the incident: Determine if the situation qualifies as an information security incident. This can include unauthorized access to systems or data, malware infections, data breaches, network attacks, or any other security-related event.

2. Contain the incident: Take immediate action to contain the incident and prevent further damage. This can involve isolating affected systems, disconnecting from the network, or disabling compromised accounts.

3. Document the incident: Gather as much information as possible about the incident. Note the date, time, and location of the incident, as well as the systems, devices, or individuals involved. Document any suspicious or unusual activities leading up to the incident.

4. Notify the appropriate authority: Report the incident to your organization’s designated reporting authority. This can be your IT department, security team, or incident response team. If your organization has specific incident reporting and response procedures, follow those guidelines.

5. Follow incident response procedures: If your organization has established incident response procedures, follow the steps outlined in those protocols. This may include preserving evidence, conducting a forensic investigation, or engaging external security consultants.

6. Inform affected parties: If the incident involves a breach of personal data or could potentially impact individuals or organizations outside your organization, consider notifying those affected. Depending on the regulations and laws in your country, you may be required to inform individuals of any breach involving their personal information.

7. Learn from the incident: After the incident is resolved, conduct a post-incident analysis to identify any lessons learned and areas for improvement in your organization’s security practices. Use this information to enhance your security measures and prevent similar incidents in the future.

Remember, the specific reporting procedures and contacts may vary depending on the organization, so it is essential to follow your organization’s policies and guidelines when reporting an information security incident.

CFS ISMS MANAGER

BACKUP POLICY – ISMS TIPS – Week 2

Backup policy definition

A backup policy is a crucial component of an organization’s comprehensive backup strategy. Common backup policies identify critical data and systems to be protected, clarify the frequency of both full and incremental backups, delineate backup administrator responsibilities, and provide details for retention, offsite rotation, restoration procedures, storage of backups, and more.

A well-crafted backup and restore policy is essential as it is frequently a business’s last line of defense against data loss from data corruption, hardware failure, or a security breach.

Benefits of a data backup policy

A backup retention policy helps guide user expectations and provides the broader context for the data restoration and backup process. There are several benefits to developing a strong backup and recovery policy document:

Clarity. A backup policy clarifies specific procedures, policies, and responsibilities, including a well-defined schedule for performing backups, ensuring a more stable process. It also identifies any superseding procedures or policies that already exist, such as contingency plans.

Control. A well defined backup policy allows you to control what kind of backups are performed, how often data should be backed up, what software/hardware or cloud service should be used for performing backups, where backups are located, and who can access backups and how to contact them.

Accountability. The backup policy identifies primary and secondary contacts who are responsible for performing backups and provides their contact information. This piece of the data backup and recovery policy also identifies who is responsible for confirming that reliable backups are successfully performed, and sets forth how and when they will do this.

Reliability. Stronger backup policies are more likely to result in complete data restoration. They offer details on how to protect data, how to access backups, and how to train those responsible for performing backups. They also ensure multiple copies exist separate from the original data, and also make use of multiple forms of media with complementary strengths. Finally, the policy demands at least partial automation, further increasing reliability.

Key considerations for backup retention policies

Preserve essential data with a multi-pronged backup policy. Your backup policy should follow the 3-2-1 rule, creating at least three backup copies of all data in addition to the original file using two different backup media, with one copy in a remote location. This helps to ensure a full set of accessible backup data no matter what the circumstances leading to the need to recover data.

Storing at least one copy of backup data at a remote location is essential for disaster recovery, especially in the event of site-wide failures or geographical disasters. To protect against malware, remote backup data should be air-gapped (separated) from the original data set. Historically, third party vendors could store backup tapes offsite for a fee, but remote disk and cloud storage can be used as well.

It is important to periodically check the integrity of your backup files. Do this by restoring several files from the backup to confirm that you can, that the backup itself is uncorrupted, and that the media is still accessible.

Your backups should also contain versioning data—older versions of your data, not just the current version of files that were backed up most recently. This is important in case of accidental file corruption or ransomware that may be hiding in current data backups.

Determine what data is essential to your organization and establish backup strategies tailored to each type of data. At a minimum, backup mission critical data in real time, or at least daily. Backup less critical data at least once a week. Many businesses create exact mirrors of their systems annually, just to avoid the nightmare of having to start over again from scratch in case of a major failure.

Backup policy best practices

Follow these best practices to select an ideal backup solution that ensures your data remains recoverable and safe. The best backup policy solutions:

Include remote storage. Remote backups are a critical element in any backup solution. It is all but pointless to backup organizational data only to store it on the same disk as the original information. Off-server storage is a minimum requirement, with off-site backup storage being a better alternative. Should a central server become compromised during a disaster, off-site backups, whether on a cloud-based server or physical dedicated server, allow for complete data recovery—a key part of disaster recovery.

Take frequent, regular backups. Prevent critical data loss by creating a regular schedule of frequent backups. Obviously, the most critical data may demand a continuous backup solution, while daily backups or weekly backups may be enough for more static data.

Use automated backups. Avoid manual data backup solutions that rely on end users to back up their data. Your end user data backup policy should mandate a fully automatic backup solution. Manual data backup can easily be delayed and is a dull task—something that, in reality, never gets done.

Address retention span. After frequency, how long each backup should be kept is the next important question. Retaining every backup forever is neither desirable nor feasible, so any good data backup and storage policy and solution provides a series of retention schedules. This changing schedule will, for example, schedule more frequent backups at first—for example, hourly and daily backups for a week—and then pivot to less frequent backups less often.

The retention schedule will also keep some backups longer, or even indefinitely. Annual, bi-annual, or even monthly backups might be retained to provide ready benchmarks. Another reason to retain these scheduled backups is to ensure your organization remains compliant with data retention standards and requirements in your vertical. For example, healthcare organizations will need to craft backup policies that are HIPAA compliant. Businesses that are active in the EU may need a GDPR backup policy.

Encrypt backups. Even when backups are off-site, your data backup policy should always require encryption of backup files.

Use cloud storage for backup storage. Storing your backups in the cloud adds redundancy to your infrastructure and improves cost and scalability. In fact, leveraging the cloud for disaster recovery is one of the best ways to lower your risk of data loss after a disaster.

Find a comprehensive backup solution. Find a backup solution that fits the full needs of your business, including onsite as well as SaaS applications that host your data.

Data backup policy example

A typical data backup policy example might look something like this.

Overview/policy statement
In this first section, the server backup policy will state how the procedures in the plan will help the organization ensure continuity of its operations, ensure reliable, timely backup of its IT assets, and meet its enterprise business objectives. This section of a backup and recovery policy template might also state other high-level business objectives and cite involved team members.

Purpose
Next, the backup and restore policy will describe its purpose—the “why” behind the backup policy. Typically this sets out the way the organization will recover should there be a software failure, hardware failure, or both, and describes how the team will protect against data loss in case of disaster, human error, or other problem.

Scope
The scope of the backup policy will typically set forth the who, what, when, and how of the backup and restore process, to follow up with the “why” stated in the purpose section. A backup policy generally applies to all employees, contractors, and third party employees, and anyone who might be contractually bound to or have access to IT assets of the organization.

A backup policy will also describe the “what,” describing its scope as covering all IT assets and the entire organization’s IT infrastructure as well as data contained in SaaS applications. The scope statement will also describe documentation and how documentation will be controlled. For example, scope may touch upon the existence of a data retention policy for records.

A backup policy will spell out the “how” backups are to be taken, including the types of backups that will be taken and how long those backups will be stored. The policy will also explain the “when,” or how often and what time of day backups are to be taken.

Finally, a scope statement in a backup policy will cover maintenance and distribution of the documentation itself. This way, everyone who needs the backup policy in the organization should have access to it.

Substantive policy
In the substantive data backup policy and procedure section, your backup management policy should identify mission critical data, and which user-level data and system-level data will be maintained. More details about backup frequency in accordance with the acceptable risk and importance of the data should all be here.

Other elements of a data backup and restore policy might include backup retention details, restoration procedures and documentation, restoration testing procedures, guidelines for how to proceed when backup media has expired, and a list of other applicable policies.

An IT data backup policy must also designate responsible personnel for proper policy implementation. Along these lines, it should set forth terms of enforcement, including disciplinary actions that will be taken against employees who violate the backup policy in line with existing HR policies, industry standards, and controlling law.

Finally, the backup and recovery policy and procedure should include all relevant definitions to ensure clarity and the ability to execute. It should also include revision history, and any changes to the document must be controlled. This ensures recoverability in the event of a catastrophe.

Remember, while you might begin with a backup and restore policy template, it is important to craft any backup policy to meet your organization’s specific needs.

CFS ISMS MANAGER

PASSWORD POLICY – ISMS TIPS – Week 1

What Is a Password Policy?

A password policy is a set of rules designed to enhance computer security by encouraging users to create and implement stronger passwords. A part of an organization’s official rules, it’s often included in the security awareness training.

A password policy allows you to set a definite tone for how people create and use passwords on your web application. While you may not be able to control users’ activities 100%, it enables you to guide them for their own safety.

Why Is a Password Policy Important?

Cybersecurity is a buzzword in information technology. And that’s because cyber crimes are increasing by the day.

Passwords are essential in cybersecurity as they determine, to a large extent, whether an attacker can break into a system or not. So, having an effective password policy to safeguard your network is key.

There are significant benefits to having a well-designed password policy.

1. Prevent Data Breaches

Safeguarding your business’ data and customer details is paramount. Your failure to do so makes your network vulnerable to data breaches.

With just a tiny loophole, attackers can initiate a data breach that will leave you professionally, financially, and legally exhausted.

2. Maintain Order

A password policy is meant for everyone using your network, regardless of their status. The top-down hierarchy in most organizations doesn’t come to play here, and that creates a sense of orderliness.

External users of your network are also obliged to follow your policy. They drop whatever preconceived notions they have about password usage and adopt your policy.

3. Build Trust

Many online users are wary of entering their personal information on websites due to fear of cyber-attacks. So, they get a sense of relief when they see a password policy on a website. It shows that the owners of the website take cybersecurity seriously.

Since everyone on the network is guided by the same password policy, users trust that their personal information is secured.

4. Cultivate Cybersecurity Culture

Implementing effective cybersecurity may seem daunting. But the most difficult part is taken care of if your team or users understands how to secure themselves.

Most cyberattacks happen due to the loopholes created by people. If the users of your network are informed about cyber threats and how to avoid them, there’ll be little or no room for attackers to penetrate.

CFS ISMS MANAGER