Technological Controls: 8.1 User Endpoint Device
Objective: The Objective is to ensure that user endpoint devices are configured and used in a way that minimizes the risk of unauthorized access, data loss, or other security incidents.
Guidance Note: The organization should establish a topic-specific policy on secure configuration and handling of user endpoint devices.
Topic-Specific Policy requirements for:
1. the type of information and the classification level that the user endpoint devices can handle, process, store or support;
2. registration of user endpoint devices;
3. requirements for physical protection;
4. restriction of software installation (example remotely controlled by system administrators);
5. requirements for user endpoint device software (including software versions) and for applying updates (example active automatic updating);
6. rules for connection to Information Services, public networks or any other network off premises (example requiring the use of personal firewall);
7. access controls;
8. storage device encryption;
9. protection against malware;
10. Remote disabling, deletion or lockout;
11. backups;
12. usage of web services and web applications;
13. end user behavior analytics;
14. the use of removable devices, including removable memory devices, and the possibility of disabling physical ports (example USB ports);
15. the use of partitioning capabilities
User responsibility: All users should be made aware of the security requirements and procedures for protecting user endpoint devices, as well as of their responsibilities for implementing such security measures.
BYOD - Use of personal devices
Wireless connections: The organization should establish procedures for:
- the configuration of wireless connection on devices;;
- using wireless or wired connections with appropriate bandwidth in accordance with relevant topic-specific policies.
Broadly the policy covers topics such as the type of information and the classification level that can be handled by user endpoint devices, requirements for physical protection, restrictions on software installation, rules for connecting to networks, access controls, protection against malware, and so on.
About the Trainer:
Pravin Nair [BSc (Phy), MBS (Fin), PG (IR4.0), ISO 27001: 2022 (LI / LA), CEH, CEPT, Dip in Cyber Law, Psychometric Assessor, NLP, Corporate Trainer]
