+INF.10 Meeting, Event, and Training Rooms
---+INF.10.G1. Insufficient Rules
---+INF.10.G2. Incompatibility between External and In-House IT Systems
---+INF.10.G3. Threats Caused by Visitors
---+INF.10.G4. Exposed Cables
---+INF.10.G5. Theft
---+INF.10.G6. Loss of Confidentiality of Sensitive Information
---+INF.10.A1 Secure Use of Meeting, Event, and Training Rooms [Building Services, IT Operation Department] (B)
---+INF.10.A3 Closed Windows and Doors [Employee] (B)
---+INF.10.A4 Planning Meeting, Event, and Training Rooms (S)
---+INF.10.A5 Exposed Cables (S)
---+INF.10.A6 Configuring Secure Network Access [IT Operation Department] (S)
---+INF.10.A7 Secure Configuration of Training and Presentation Computers [IT Operation Department] (S)
---+INF.10.A8 Creating a Proof of Use for Rooms (S)
---+INF.10.A9 Resetting Training and Presentation Computers [IT Operation Department] (H)
---+INF.10.A10 Ban on Carrying Mobile Phones (H)
|
INF.10 Meeting, Event, and Training Rooms
IntroductionEvery organisation usually has one or more rooms for holding meetings, training courses, or other events. Specially equipped rooms are often designated for this purpose. Meeting, event, and training rooms are usually used by different persons and/or groups of persons and visitors, and generally for a limited period of time. IT systems that participants bring along are often operated together with the organisation’s devices, as in the case of external laptops that are connected to overhead projectors. These different usage scenarios result in a particular risk situation that does not exist in the same way in other rooms of the organisation. ObjectiveThe aim of this module is to protect the information processed in meeting, event, and training rooms, along with the IT systems operated in such rooms. Moreover, it addresses the recommended procedure for visitors who use these rooms. Not in scope and modellingModule INF.10 Meeting, Event, and Training Rooms must be applied to all rooms used for meetings, events, and training. This module addresses all the technical and non-technical security aspects of using meeting, event, and training rooms. It does not deal with detailed recommendations on how to configure and safeguard the IT systems in such rooms. Information on this is included in SYS.2.1 General Client, as well as in the operating-system-specific modules. Further security aspects relevant to meeting rooms, such as WLAN or video conferencing systems, are addressed in the modules of the layers NET.2 Radio Networks and NET.4 Telecommunication. Cabling in these rooms is specifically considered in module INF.12 Cabling. Requirements for fire prevention are included in module INF.1 Generic Building. Requirements for monitoring visitors are included in module ORP.1 Organisation. Useful ResourcesThe International Organization for Standardization (ISO) provides guidelines for the physical and environmental security of buildings and rooms in annex A.11 of ISO/IEC 27001:2013. In "The Standard of Good Practice for Information Security", the Information Security Forum (ISF) provides guidelines for the physical and environmental security of buildings and rooms in chapter CF19. The German Institute for Standardisation (DIN) provides specifications for physical security in buildings and rooms in the standard DIN EN 1627:2011-09.
1. Přehled
| Název |
Standard |
|
INF.10.A1 Secure Use of Meeting, Event, and Training Rooms [Building Services, IT Operation Department] (B)
|
The equipment present in such rooms MUST be protected appropriately against theft. Furthermore, the persons who manage the IT and other systems present in such rooms MUST be defined. It MUST also be specified whether visitors may use IT systems they bring along and, if so, under which conditions. Furthermore, the network access points and telecommunications interfaces that can be accessed by visitors MUST be specified.
|
|
INF.10.A3 Closed Windows and Doors [Employee] (B)
|
The windows MUST be closed when leaving meeting, event, or training rooms. The doors MUST be locked when leaving rooms that contain IT systems or sensitive information. In addition, regular checks MUST be carried out to ensure that the windows and doors have been locked after leaving such rooms. Furthermore, it MUST be ensured that fire doors and smoke control doors are actually closed.
|
|
INF.10.A4 Planning Meeting, Event, and Training Rooms (S)
|
When planning meeting, event, and training rooms, the location of the rooms SHOULD be given special consideration. In particular, rooms often used together with or exclusively by visitors SHOULD NOT be located close to parts of the building where confidential information is regularly processed. The level of confidentiality of the information discussed or processed there SHOULD be specified for each room.
|
|
INF.10.A5 Exposed Cables (S)
|
Power connections SHOULD be placed in locations where projectors, laptops, or other devices requiring electricity are to be set up. Cabling routed over the floor SHOULD be covered by a cable duct.
|
|
INF.10.A6 Configuring Secure Network Access [IT Operation Department] (S)
|
It SHOULD be ensured that the IT systems visitors bring along cannot be connected to a given organisation’s internal IT systems via the data network. Only designated IT systems SHOULD be able to access the organisation's LAN. A data network for visitors SHOULD be kept separate from the organisation's LAN. Network access points SHOULD be configured so that third parties are prevented from reading internal exchanges of data. Network connections in meeting, event, or training rooms SHOULD be safeguarded. The IT systems in meeting, event, and training rooms SHOULD be prevented from establishing simultaneous connections to the intranet and the Internet. Furthermore, the power supply SHOULD be established separately from other rooms from the last sub-distributor.
|
|
INF.10.A7 Secure Configuration of Training and Presentation Computers [IT Operation Department] (S)
|
Dedicated training and presentation computers SHOULD have a minimum configuration. The applications that can be used on the training and presentation computers during each event SHOULD be specified. The training and presentation computers SHOULD only be connected to a separate data network that is isolated from the LAN of the organisation at hand.
|
|
INF.10.A8 Creating a Proof of Use for Rooms (S)
|
Depending on the ways in which meeting, event, and training rooms are used, the persons using the rooms and the corresponding times SHOULD be evident. Proof of use SHOULD also be provided for rooms where training on IT systems or particularly confidential meetings are held. It SHOULD be considered whether corresponding proof of use should also be implemented for rooms that are accessible to every employee.
|
|
INF.10.A9 Resetting Training and Presentation Computers [IT Operation Department] (H)
|
A procedure for resetting training and presentation computers to a pre-defined state after use SHOULD be specified. Changes made by users SHOULD be removed completely in such cases.
|
|
INF.10.A10 Ban on Carrying Mobile Phones (H)
|
Mobile phones SHOULD NOT be taken into confidential meetings and conversations. If necessary, this ban SHOULD be enforced by detectors.
|
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|