Cyber-crime () Electronic Crimes Section Telephone: (08) 8127 - 5030 Identity crime () Your local police station Freedom of Information and privacy hotline () State Records of South Australia Telephone: (08) 8204 - 8786 Records of South Australia () General Enquiries Telephone: (08) 8204 - 8791
Implementation Guidance Marking Description Portable Storage Devices Remote Access Media Sanitisation and Re-use Public Information authorised for unlimited public access and circulation, such as agency publications and web Such information should still be accompanied by Integrity and Availability classifications. Labelling or of devices according to classification is recommended per controls 0332-0336 in the ISM. No special controls applicable No special controls applicable. For Official Use Only Information is only available for official use by South Australian or Australian Government personnel (including authorised contractors). The public release of this information may be authorised by an agency head or agency policy. PSDs shall only be connected to systems with an equal or greater classification per control 0337 in the ISM. Password control plus basic encryption shall apply. Additional mechanisms for Information marked as Protected should include use of strong ciphers and additional key files. Cryptographic controls and guidance are described in the ISM. Dual phase password control (Remote Access login and system login) plus transmission encryption as described in the ISM. Media should be wiped in alignment with ISMF Standard 60. Post sanitisation media classifications for magnetic media and for non-volatile flash memory are described in the ISM. Sensitive (legislation Sensitive: Personal Compromise could cause limited damage to the State, the Government, an agency, commercial entities or members of the public. (refer control S19.13 in the ISMF) Responsible Parties shall observe the authentication requirements described by ISMF Standard 86 Cryptographic (encryption) mechanisms must be enabled in alignment with the Cryptography chapter in the ISM. Sensitive: Legal Sensitive: Commercial Sensitive: Medical Compromise could cause moderate damage to the State, the Government, commercial entities or members of the public. Sensitive: SA Cabinet Sensitive: Cabinet Compromise could cause significant damage to the State, the Government, commercial entities or members of the public. Sensitive: Cabinet materials received from the Australian Government must be classified as [P] Protected. PSD use not permitted without formal exemption process and authorisation by Agency Chief Executive. Secure wipe per ISM *or* destruction of per the relevant sections of the ISM. Classification Description [P] Protected The PROTECTED security classification is used when the compromise of the information could cause damage to the Australian Government including states and territories, commercial entities or members of the public. For instance, where compromise could:
MAC Address; Encryption and digital signatures; Caller Line Identification (CLID); Remote Access Service Call-back. Additional controls based on DLMs and protective markings There is no additional guidance specific to information asset classification levels. Remote diagnostic/configuration port protection ISMF Standard 88 (Configuration port protection) Access to diagnostic and configuration ports shall be securely controlled and where necessary, a key lock and a procedure shall be implemented to ensure that the facility is only accessible by arrangement between the Responsible Party and the support personnel requiring access. Business Controls The following general guidance applies regardless of the classification levels of the information assets: Responsible Parties may implement the guidance described in . (The removal of this control in ISO/IEC 27001:2013 does not absolve Agencies from their obligations under ISMF Standard 88). Supervisory control and data acquisition (SCADA) networks are used to monitor and control key functions in provision of various services and products. Responsible Parties must implement appropriate controls for the protection of SCADA networks as part of the protection of the organisation’s overall network infrastructure and should consider additional product and/or feature specific control(s) that may be applied to protect these assets including a combination of physical and logical controls, such as using non-standard virtual port identifiers and dedicated firewalls or remote access devices. Default passwords must be changed and, applicable, Simple Network Management Protocol (SNMP) and/or Wireless LAN (i.e. Wi-Fi, 3G, GSM etc.) should be disabled on SCADA devices. Additional controls based on DLMs and protective markings Classification Additional Controls [FOUO] Official Use Only [SOUO] Sensitive [I2] Integrity 2 [A2] Availability 2 Hardware that supports remote connections for ad-hoc support (e.g. modems and VPN switches) should be powered off or otherwise disabled, and only enabled when specifically required.
Network routing controls should be implemented by Responsible Parties as necessary to enforce and support the Agency’s access control policy. Business Controls The following general guidance applies regardless of the classification levels of the information assets: Responsible Parties should implement the guidance contained in . (The removal of this control in ISO/IEC 27001:2013 does not absolve Responsible Parties from their obligations under ISMF Standard 91). Good Practice: SNMP services should be disabled or set to read only with a community string other than “public”. Where “write” access is required, the community strings should be set to a string other than “private”. Only SNMP queries from known IP addresses (monitoring servers etc) should be processed by a router. Where possible, restrict hosts that can accept or transmit Routing Information Protocol (RIP) packets. Restrict the use of trivial file transfer protocol (TFTP). TFTP does not have any security controls built in to it. If TFTP needs to be used, make sure that the TFTP host is secured and that the correct ACLs or file/directory permissions are in place. The TFTP server (if needed) should not run other services, as it may be a source of compromise for those services. Checksums should be placed on all files on the TFTP machine. Also, lock down the hosts from layer 2 (e.g. in UNIX, use the file /etc/ethers to set the MAC address to a specific host). Additional controls based on DLMs and protective markings Classification Additional Controls [A4] Availability 4 Address translation mechanisms must be implemented to isolate the internal network from external networks. [P] Protected [SC] Sensitive: Cabinet [I4] Integrity 4 Address translation mechanisms should be implemented to isolate the internal network from external networks. [FOUO] Official Use Only [SOUO] Sensitive [I2] Integrity 2 [A2] Availability 2 Positive source and destination address checking mechanisms should be adopted (to counter IP spoofing attacks). Physical and logical access to consoles for all routers should be restricted to only the Network Administrator. Privileged modes should be password protected. This helps to ensure that only authorised personnel can make modifications to the router’s configuration.
ANNEX F - MAPPING TO AUSTRALIAN AND INTERNATIONAL STANDARDS The following table provides a simplified mapping of International, South Australian and Australian Commonwealth legislation, policies, controls and standards as well as listing complementary standards and measures implemented in this framework. SOUTH AUSTRALIAN GOVERNMENT AUSTRALIAN GOVERNMENT INTERNATIONAL ISO 27001 IMPLEMENTATION GUIDANCE ISMF Policy Statements and Standards Other SA policy, standards and legislation Information Security Manual (ISM 2012) controls Protective Security Policy Framework (PSPF) ISO Control Objectives & Controls ISO 27001:2013 Control Objectives & Controls Miscellaneous supporting standards & guidelines and information sheets Section 4-8 Section 4-10 Section 4-8 Section 4-10 Section 4 (ISO 27002) Section 6 Refer Other A.5.1 A.5.1 A.5.1.1 A.5.1.1 A.5.1.2 A.5.1.2 A.6.1 Section 6 A.6.1.1 Section 6 A.6.1.2 (retired) A.6.1.3 A.6.1.1 A.10.1.3 A.6.1.2 A.6.1.4 (retired) A.6.1.6 A.6.1.3 A.6.1.7 A.6.1.4 n/a A.6.1.5 A.6.2 A.15.1
A.10.7.2 A.8.3.2 A.10.7.3 A.8.2.3 A.10.7.4 (retired) A.10.8 A.13.2 A.10.8.1 A.10.8.2 A.13.2.1 A.13.2.2 A.10.8.3 A.8.3.3 A.10.8.4 A.13.2.3 Refer Other A.10.8.5 (retired) Refer Other A.10.9 A.14.1 A.10.9.1 A.10.9.2 A.14.1.2 A.14.1.3 A.10.10 A.12.4 A.10.10.1 A.10.10.2 A.12.4.1 A.10.10.3 A.12.4.2 A.10.10.4 A.12.4.3 A.10.10.5 (retired) A.10.10.6 A.12.4.4 A.11.1 A.9.1 A.11.1.1 A.9.1.1
ANNEX H – RETIRED ISMF STANDARDS The following list identifies retired ISMF Standards, and their replacement or amendment as well as the version number of ISMF in which the Standard was de-listed. ISMF Standards number designations are not re-used once retired. Reference Title and/or text abstract of standard Treatment (ISMF version) ISMF Standard 18 Acceptable use policies encompassing applicable conditions, standards and guidelines must be documented and implemented for information assets. Replaced in entirety by ISMF Standard 131 (v3.2.0) Control S131.8 added to map to ISO 27002 control objectives. ISMF Standard 138 Privacy and confidentiality of government data is governed by the Information Privacy Principles Instruction (Cabinet Administrative Instruction 1/89) issued as Replaced in entirety by ISMF Standard 130 (v3.2.0) Implementation considerations from former standard assigned as control S130.2