search

dwyl / ISO-27001-2013-information-technology-security

:closed_lock_with_key: Probably the most boring-but-necessary repo on GitHub. If you care about the security/privacy of your data...! :white_check_mark:
156 stars 42 forks source link

Information Security Questionnaire Follow Up Questions #21

Open nelsonic opened 7 years ago

nelsonic commented 7 years ago

We replied to an InfoSec Questionnaire that was heavily based on ISO 27001 sent to by a "Fortune 500" company. it had over 130 questions and these were the only ones they need additional info on:

infosec-followup-questions

So, we must be doing _something "right"... 😉 🔐 ✅

But let's address these Questions Now so they know Security is our Top Priority!! 👍

nelsonic commented 7 years ago

No hosting is performed directly by DWYL everything is hosted on the Amazon Web Services (AWS) infrastructure and the account is controlled the client (i.e. DWYL does not "own" the AWS account!)

The development environment is on each developer's laptop and holds only dummy data (developers never use customer data for any purpose).

Test (Continuous Integration (CI) testing) and Staging environments are hosted on AWS and are logically isolated from production (i.e. no access to customer data!)

No customer data is available in any environment other than "production" and no developers have access to the data. This is by design (not by accident) as it ensures "segregation of duties".

Given that the organisation is small we only have one administrator for the IT infrastructure. If this is considered a "business continuity risk" we can implement a control/process to ensure that in the case of an illness/emergency or other unforeseen event, a nominated person can administer the system with delegated authority.

The underlying OS is patched automatically and transparently by Amazon Web Services. please see: https://aws.amazon.com/amazon-linux-ami/faqs/

aws-linux-ami-patching