iStorage diskAshur PRO2 Benutzerhandbuch Seite 33

Mitigation NCSC (CESG) CPA
7 DEP.2.M277
Confidentiality
8 DEP.2.M280
Confidentiality
Integrity
9 DEP.4.M348
DEP.1.M348
Integrity
10
Confidentiality
Accountability
11
Confidentiality
Risk Best Practice
Social Be aware of the potential of direct and indirect threat of Social
Engineering Engineering attacks which may attempt to discover your user
id, password and other business related, or personal creden-
tials by means of social engineering techniques.
Ensure that the organisation delivers Security Education and
Awareness to make users aware of the potential threats posed
by:
i. Unsolicited email seeking to entice the user into
exchanging communications with the sender
ii. Opening URL's which are embodied within an
unexpected email, which has been received from an
unknown user
iii. Opening attachments without consideration – they
could be carrying a Malware Payload
iv. Accepting requests on Social Networking sites from
people you don't know or recognise
v. Being enticed by on-line offers – if they look to good
to be true, they probably are and most certainly are
fake
Credential Never communicate or issue any form of security credentials
via the same channel, or which are packaged with an iStorage
Distribution
secure drive.
Note 3:
for distributing credentials, this should be achieved out-of-
band (e.g. by voice, text, secured email).
Authorised No automated process exists. Only approved updates which
Updates applicable to the iStorage products will be distributed as
part of an upgrade or replacement process under the internal
iStorage SDLC (Security Development Lifecycle) and their
Vulnerability Management Policy/Process.
Data Ensure that the value of data assets stored on the iStorage
Classification secure drive are classified, or protectively marked as is appro-
priate for their use, and/or custodianship.
Cleared Staff/ Ensure that those who are provisioned access to the data as-
Access sets stored on an iStorage secure drive possess a clear need-
to-know and are suitably cleared as appropriate to the level of
data asset, or protectively marked materials stored thereon.
www.istorage-uk.com
Where operational necessity dictates the requirement
#33