Technical Controls Standard Overview
Uploaded by
O GoogleTechnical Controls Standard Overview
Uploaded by
O Google- Revision History
- Responsibility Matrix
- Technical Controls Standards
Common questions
Powered by AIThe ATI Technical Controls Standard mandates that firewalls be configured to block all unnecessary incoming connections, and any changes for business reasons must follow the system change control process. Firewall configurations are regularly reviewed, and unusual network traffic monitored to promptly address potential security breaches. By requiring that firewalls not advertise unused services and restricting management console access to IP-restricted or two-factor authentication-enabled access, ATI ensures that firewalls remain effective barriers against unauthorized access, protecting sensitive data from external threats .
The Operations Management section enhances system security by requiring that all operations adhere to documented procedures approved by the IT Systems Manager. This includes ensuring that unsupported operating systems and firmware are upgraded or decommissioned, thereby reducing vulnerabilities from outdated systems. Additionally, it mandates disabling 'auto-play' features, encrypting mobile device data, and enabling remote wipe capabilities to protect data if devices are lost or stolen. Maintaining audit trails of system access further ensures accountability and operational integrity by providing a means to detect unauthorised access and potential breaches .
Data destruction, as outlined by ATI, involves secure disposal of hard drives, CDs, and other media used to store sensitive data. The process requires storing media securely before destruction and using methods like overwriting for redeployment or professional destruction services for complete disposal. This prevents unauthorized access to sensitive data and ensures compliance with data protection standards, thus maintaining the confidentiality and integrity of information even after it is no longer needed .
The Aerospace Technology Institute's Technical Controls Standard specifies various roles such as the Chief Information Security Officer, Chief Operating Officer, Data Protection Compliance Manager, Chief Technology Officer, IT Systems Manager, and IT Administrator. These roles are designed to ensure compliance with ATI Information Security Policy and Cyber Essentials Scheme. Each role has specific responsibilities. For example, the IT Systems Manager is accountable for maintaining and enforcing technical controls, such as access control and network security, while the Chief Information Security Officer reviews and approves system changes to ensure security requirements are met .
The software management practices in the ATI policy are crucial for reducing cybersecurity risks. Regular updates and patching of software, operating systems, and firmware reduce vulnerabilities that could be exploited by cyber threats. Restricting software installations ensures that only necessary and approved applications are used, minimizing the risk of malware. By removing unnecessary applications and requiring risk assessment and testing of patches, the policy maintains system integrity and lowers the potential for security breaches through software vulnerabilities .
The ATI policy addresses protection against malicious software through comprehensive countermeasures, including the installation of anti-malware software on all appropriate devices. This software is required to be kept up to date, automatically scanning files on access and performing daily scans. Additional measures involve blocking access to malicious websites using web-proxies or whitelisting, prohibiting users from disabling security settings, and ensuring devices check automatically for updates. These layers of defense are critical in preventing, detecting, and responding to malicious software threats .
Access control measures such as requiring unique usernames and passwords, deleting unnecessary user IDs, and changing default passwords help secure the network by preventing unauthorized access. Strong passwords and two-factor authentication further enhance security by making it more difficult for unauthorized users to gain access. Additionally, measures such as locking devices after inactivity and ensuring admin accounts are not linked to regular email accounts prevent misuse of access privileges which are crucial for safeguarding network resources .
Regular vulnerability scanning in the ATI policy is a proactive measure to identify security weaknesses in networks and devices. After each scan, any identified vulnerabilities are assessed, and the ATI acts on external recommendations to address significant security risks. This process ensures continuous improvement of the security posture by updating the risk assessment and security policies based on the findings, thereby enhancing overall security and reducing the likelihood of exploitation .
The ATI policy mandates that all data in transit over networks use approved encryption mechanisms, ensuring that sensitive information is protected during transmission. Similarly, data at rest must also be encrypted to protect it from unauthorized access. These protocols ensure that even if data is intercepted or accessed illicitly, it remains unreadable to unauthorized individuals. This robust approach to encryption greatly enhances data confidentiality and prevents data breaches, supporting overall data security within the organization .
The regulations on external cloud services in the ATI policy require that providers implement data confidentiality, integrity, and availability procedures comparable to or exceeding those in the ATI policy. This ensures that any data stored or processed externally is subject to stringent security controls, thereby safeguarding it from unauthorized access and potential loss. By mandating compliance verification from the IT Systems Manager, the policy enforces accountability and ensures that third-party service compliance aligns with ATI’s data protection standards .
