+APP.6.A4 Regulation of Software Installation and Configuration [Process Owner] (B)

APP.6.A4 Regulation of Software Installation and Configuration [Process Owner] (B)

The installation and configuration of software MUST be regulated by the IT Operation Department in order to ensure the following:

  • The software is installed and executed with the smallest functional scope necessary
  • The software is executed with the fewest authorisations possible
  • Settings pertaining to the processing of personal data are configured to store as little data as possible
  • All relevant security updates and patches are installed before the software is used productively

Dependent components (including runtime environments, libraries, interfaces, and other programs) MUST also be considered. In coordination with the Process Owner, the IT Operation Department MUST determine who is allowed to install the software and how. Ideally, software SHOULD always be installed centrally by the IT Operation Department. If it is necessary to install software (or parts thereof) manually, the IT Operation Department MUST create installation instructions that clearly regulate the intermediate steps required for installation and what configurations are to be made.

In addition, the IT Operation Department MUST define how the integrity of installation files is to be checked. If digital signatures or checksums are available for an installation package, they MUST be used to verify its integrity.

If required, the IT Operation Department SHOULD define a secure default configuration for the software in question. The default configuration SHOULD be documented.

1. Επισκόπηση

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

Απαιτήσεις

3. Σχετικοί κανονισμοί

Κανονισμοί

Συνδεδεμένα ζητήματα

Συνδέσεις
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.28 Software Vulnerabilities or Errors
blocks G 0.31 Incorrect Use or Administration of Devices and Systems