Buenas prácticas en seguridad informática (ESET)

Al igual que las amenazas informáticas en general, los códigos maliciosos han ido evolucionando a la par de las tecnologías de información y comunicación, aumentando considerablemente el nivel de complejidad y agresión. Es por ello que la visión y la filosofía de ESET contemplan la protección de manera proactiva, no sólo a través de sus soluciones de seguridad, sino también a través de la educación.

Autor: Jorge Mieres, Analista de Seguridad de ESET Latinoamérica.

En el informe "Buenas prácticas en seguridad informática" se analizan diferentes medidas de seguridad que pueden adoptarse para minimizar los riesgos de que el usuario sea víctima de los ataques informáticos más actuales.

Plantillas de Politicas y de otros documentos de seguridad

La empresa Callio Technologies, publico en su web una serie de plantillas de ejemplo relacionadas con la seguridad de la información:

Security templates Examples

• 3. Security policy
  • 3.1 Information security policy
    • 6-Elements of a Security Policy (23k)
    • 7-Manual of Security Policies (52k)
    • 3-Memorandum (25k)
    • 8-Policy Review Process (253k)
    • 5-Security Management Group Mandate (26k)
    • 4-Security Policy Statement (26k)
• 4. Organizational security
  • 4.1 Information security infrastructure
    • 10-Information Security Advisor (27k)
    • 9-Security Management Group Members (24k)
• 5. Asset classification and control
  • 5.1 Accountability for assets
    • 11-Asset Inventory (53k)
  • 5.2 Information classification
    • 13-Classification Guide (34k)
    • 12-Roles and Responsibilities Related to Assets (42k)
• 6. Personnel security
  • 6.1 Security in job definition and resourcing
    • 22-Advice - Confidentiality Agreements (27k)
    • 15-Elements of a Job Description (24k)
    • 24-Employment Contract (39k)
    • 19-Hiring Personnel (25k)
    • 10-Information Security Advisor (27k)
    • 14-Information Security Positions (28k)
    • 16-Job Description Model (25k)
    • 21-Performance Evaluation Form (29k)
    • 18-Reference Check Authorization (28k)
    • 23-Template no 1 - Confidentiality Agreement (32k)
    • 55-Template no 2 - Nondisclosure Agreement (47k)
    • 17-Tips for Checking References (23k)
    • 20-Tips for Performance Evaluations (30k)
  • 6.2 User training
    • 25-Training Program Start-Up (34k)
    • 26-Training of Security Staff (87k)
    • 27-User Consent (30k)
  • 6.3 Responding to security incidents and malfunctions
    • 32-Application of Disciplinary Measures (367k)
    • 33-Example of a Disciplinary Process (305k)
    • 29-Persons to Contact - Security Incidents (24k)
    • 31-Progression in Disciplinary Measures (24k)
    • 28-Reporting Security Incidents (588k)
    • 30-Review of Reported Incidents (24k)
• 7. Physical and environmental security
  • 7.1 Secure areas
    • 39-Delivery Process (109k)
    • 37-Industrial Visits (25k)
    • 40-Merchandise Refusal (25k)
    • 34-Physical Security Questionnaire (58k)
    • 36-Reception Layout Plan (655k)
    • 35-Site Layout (1087k)
    • 38-Working in Secure Areas (24k)
  • 7.2 Equipment security
    • 41-Measures for protecting equipment (3459k)
    • 42-Mesures for power supply protection (485k)
    • 34-Physical Security Questionnaire (58k)
  • 7.3 General controls
    • 43-Material Requisition Form (29k)
• 8. Communications and operations management
  • 8.1 Operational procedures and responsibilities
    • 45-Form for Operational Change (32k)
    • 44-Operational Change Process (24k)
    • 49-Procedure for Reinstalling a System (23k)
    • 47-Security Incident Classification (22k)
    • 46-Security Incident Management Process (236k)
    • 48-Security Incident Report (Form) (43k)
    • 50-Segregation of responsibilities (29k)
  • 8.4 Housekeeping
    • 53-Fault Log (29k)
    • 51-Information Backups (47k)
    • 52-Operator's Log (29k)
  • 8.5 Network management
    • 54-Network Control Measures (24k)
  • 8.7 Exchanges of information and software
    • 57-Email Security (179k)
    • 56-Letter of Confirmation -- Online Purchase (30k)
    • 23-Template no 1 - Confidentiality Agreement (32k)
    • 55-Template no 2 - Nondisclosure Agreement (47k)
• 9. Access control
  • 9.2 User access management
    • 24-Employment Contract (39k)
    • 60-Intervals for Reviewing Access Rights (23k)
    • 58-Modification of Privileges (35k)
    • 59-Nondisclosure of Passwords (24k)
  • 9.3 User responsibilities
    • 61-Good Password Management Practices (27k)
    • 62-Unsupervised equipment (23k)
  • 9.4 Network access control
    • 63-Authentication Methods (169k)
    • 68-Installing a Linux RedHat Server (27k)
    • 67-Installing a Netware Server (33k)
    • 69-Installing a Windows 2000 Server (35k)
    • 66-Modifying Filtering Rules (52k)
    • 64-Protection of Remote Diagnostic Ports (37k)
    • 65-Role of the Router (941k)
  • 9.5 Operating system access control
    • 70-Connection Process (78k)
    • 71-Individual Alarms (457k)
  • 9.7 Monitoring system access and use
    • 72-Recording Events (28k)
    • 73-Synchronizing Clocks (375k)
  • 9.8 Mobile computing and teleworking
    • 74-Teleworking -- Contractual Arrangement (41k)
• 10. Systems development and maintenance
  • 10.1 Security requirements of systems
    • 75-Security Requirements -- Analysis and Specifications (26k)
  • 10.2 Security in application systems
    • 76-Responding to Validation Errors (29k)
  • 10.3 Cryptographic controls
    • 80-Cryptography Policy (48k)
    • 79-Key Management (25k)
    • 77-Selecting Cryptographic Measures (32k)
    • 78-Selecting a Cryptographic Solution (24k)
  • 10.4 Security of system files
    • 81-Change Control (25k)
  • 10.5 Security in development and support processes
    • 82-Modification Request Form (34k)
• 11. Business continuity management
  • 11.1 Aspects of business continuity management
    • 95-Address and Phone Number of the Backup Facility (28k)
    • 96-Communications During a Disaster (177k)
    • 90-Continuity Plan -- Content (91k)
    • 89-Creation and Implementation of a Continuity Plan (35k)
    • 100-Criteria for Evaluating a Backup Facility (115k)
    • 91-Distribution List for the Continuity Plan (34k)
    • 92-Drafting a Recovery Plan (27k)
    • 85-Elaborating Business Continuity Strategies (258k)
    • 93-Emergency Plan (91k)
    • 83-Evaluating Priorities (64k)
    • 87-Impact Analysis Form (30k)
    • 86-Impact Analysis (297k)
    • 84-Insurance Risk Coverage (26k)
    • 97-List of Emergency Telephone Numbers (27k)
    • 98-List of Suppliers (340k)
    • 94-Responding to Emergency Situations (205k)
    • 88-Risk Analysis and Management (248k)
    • 99-Testing and Maintaining Continuity Plans (31k)
• 12. Compliance
  • 12.1 Compliance with legal requirements
    • 101-User Statement (30k)
  • 12.3 System audit considerations
    • 103-Network Security Audit (23k)
    • 102-Security Audit Process (24k)