Comparison between NZISM July 2017 v2.6 and NZISM December 2017 v2.7

Transcription

1 Change register New Zealand Information Security Manual Comparison between NZISM July 2017 v2.6 and NZISM December 2017 v2.7 Change Chapter Page(s) July 2.6 Ref Paragraph 1 Pg Paragraph 1 Pg R.01 Rationale 1 16 Pg R.02 Rationale 1 16 Pg R.03 NEW Rationale added C.01 Control 1 16 Pg C.01 Control 1 16 Pg Paragraph 1 20 Pg Table updated 2 24 Pg Header Risk Assessment - Corrected to Pg R.01 Rationale 2 33 Pg Header Security Architecture - Corrected to Header Selection of Services - Corrected to Pg Pg R.01 Rationale 3 49 Pg Paragraph 4 57 Pg Reference Table updated Pg NEW PSR Table Reference Table updated 4 66 Pg R.02 NEW Rationale added R.01 Paragraph 4 68 Pg Paragraph heading Audit Aim changed to Audit objectives, scope and criteria 4 69 Pg Paragraph 4 69 Pg NEW Paragraph added 4 69 Pg renumbered to Pg NEW Paragraph added 4 69 Pg. 67 GCSB NZISM Change Register December 2017 Release Page 1

2 26. Updated numbering to Pg DSO changed to CSO Chief Security Officer 4 69 Pg Independent Audits renumbered to Pg NEW paragraphs added Audit Evidence 30. Updated numbering for Rationale and Controls to Pg R.01 NEW Rationale added R.01 Renumbered to R R R.02 Renumbered to R R Paragraph heading 4 80 Pg R.01 Rationale 4 80 Pg C.01 Control 4 80 Pg Paragraph 4 82 Pg Notes added to paragraph C.01 Control Amended 5 88 Pg NEW Paragraph added Updated numbering to Pg Reference Table updated Pg R.01 Rationale R Paragraph and moved to NEW Rationale R Updated numbering Evacuating Facilities to R.01 and renumbered to R C.01 renumbered to C Pg Pg R.03 NEW Rationale added Note added to paragraph Pg Reference table updated Pg Table updated Pg R.01 Rationale Pg C.01 Control Pg Paragraph heading Pg R.01 Rationale Pg C.01 Control Pg NEW paragraphs added Cable Trays NEW Diagram added NEW paragraph added Catenary NEW paragraph added Earthing Renumbered paragraphs, Rationale & Controls to Pg NEW paragraph added Renumbered paragraphs, Rationale & Controls to Pg GCSB NZISM Change Register December 2017 Release Page 2

3 C.01 Classification Corrected Pg C.01 renumbered to C Pg C.02 renumbered to C Pg C.01 Classification and Compliance corrected Pg C.01 Classification Corrected Pg C.01 Classification Corrected Pg Reference corrected Pg R.01 Rationale Pg R.01 Split into two Rationale Pg R.02 NEW Rationale added Chapter 13 heading changed from Decommissioning and Disposal to Media Management, Decommissioning and Disposal Pg Paragraph Pg C.02 Control Pg C.01 Control Pg C.01 Control Pg C.04 Control Pg Paragraph Pg R.01 Rationale Pg C.01 Control Pg R.06 NEW Rationale added C.01 Control Pg R.01 Rationale Pg R.01 Rationale Pg C.01 Table Pg R.01 Rationale Pg R.01 Rationale Pg C.01 Table Pg R.01 Rationale Pg R.01 Rationale Pg R.01 Rationale Pg C.01 Table Pg R.01 Rationale Pg R.01 Rationale Pg R.02 NEW Rationale added C.01 Table Pg C.02 NEW Control added R.01 Rationale Pg Paragraph Pg C.01 Control REMOVED 13 - Pg C.02 renumbered to C C.02 Pg C.01 Control C.02 Pg R.01 Rationale Pg C.01 Control Pg. 352 GCSB NZISM Change Register December 2017 Release Page 3

4 C.01 Control Pg R.03 Rationale Pg C.03 Control Pg C.03 Control Pg Paragraph Pg Paragraph Pg R.01 Rationale Pg R.01 Rationale Pg C.02 Control Pg Paragraph heading Pg R.01 Rationale Pg C.01 Control Pg Paragraph heading Pg R.01 Rationale Pg Paragraph heading Pg R.01 Rationale Pg C.01 Rationale Pg R.02 NEW Rationale added Section Heading Pg Paragraph Pg Paragraph Pg Paragraph Pg Paragraph Pg Numbering anomaly corrected Pg Renumbered paragraphs, Rationale & Controls to Pg Paragraph heading Pg Paragraph Pg NEW paragraph added Renumbered paragraphs, Rationale & Controls to Pg Paragraph Pg NEW paragraph added Renumbered paragraphs, Rationale & Controls to Pg Paragraph Pg NEW paragraph added Public Key Infrastructure 139. Renumbered paragraphs, Rationale & Controls to NEW Reference table added End Point Security Pg C.03 Control Pg Paragraph Pg R.01 Rationale Pg. 566 GCSB NZISM Change Register December 2017 Release Page 4

5 R.01 Rationale Pg R.01 Table Pg R.01 Rationale Pg R.02 NEW Rationale added C.04 Control Pg C.04 Control Pg C.05 Control Pg NEW Abbreviation added (BYOK) NEW Abbreviation added (HYOK) Term Pg Term Access Gateway Pg Term Accountable Pg NEW Term added (Accountable Material) Term Accreditation Authority Pg Term Application Whitelisting Pg Term Audit Pg Term Authentication Header Pg Term Blacklist Pg Term Cascaded Connections Pg Term Caveat Pg Term Certification Pg Term Chief Information Security Officer Pg NEW Term added (CODEWORDS) Term Coercivity Pg Term Common Criteria Pg Term Communications Security Pg Term ConOp Pg Term Consumer Guide Pg Term Content Filtering Pg Term Cryptographic Protocol Pg Term Cryptographic System Material Pg Term Data at Rest Pg Term Declassification Pg Term Delegate Pg Term Device Access Control Software Pg Term Diode changed to Data Diode (moved) Pg Term Domain Owner Pg Term Domain Owner changed to Security Domain Owner (moved) Pg Term Emanation Security Pg NEW Term added (Endorsement) Term Escort Pg Term Evaluation Assurance Level Pg Term Fax Machine REMOVED 23 - Pg. 643 GCSB NZISM Change Register December 2017 Release Page 5

6 Term Filter Pg Term Fly Lead Pg Term Function Segregation Pg Term Government Chief Information Officer Pg Term Gateway Pg Term Hardware Security Module Pg Term Hashed Message Authentication Code Algorithms Pg Term High Assurance Pg NEW Term added (High Grade Cryptography) Term High Grade Cryptographic Equipment Term High Grade Cryptographic Equipment changed to High Grade Cryptographic Products & Equipment Term High Grade Cryptographic Products REMOVED Term Host-Based Intrusion Prevention System changed to Intrusion Prevention System (moved) Term Information and Communications Technology Pg Pg Pg Pg Pg Term Information Security Pg Term Information Security Incident Pg Term Information Security Policy Pg Term Infrared Device Pg Term Intrusion Detection System Pg Term IP Security Pg Term IP Telephony Pg Term ISAKMP Aggressive Mode Pg Term ISAKMP Main Mode Pg Term ISAKMP Quick Mode Pg Term Isolation Pg Term IT Equipment Pg Term Limited Higher Access Pg Term Logging Facility Pg Term Malicious Code Pg Term Malicious Code Infection Pg Term Management Traffic Pg Term Media Disposal Pg Term Media Sanitisation Pg Term Multifunction Devices Pg Term Network Access Control Pg Term Network Protection Device Pg Term NZ Government Information Security Manual Pg. 648 GCSB NZISM Change Register December 2017 Release Page 6

7 Term Off-Hook Audio Protection Pg Term Official Information Pg Term Openpgp Message format changed to OpenPGP Pg Term Patch Cable Pg Term Public Switched Telephone Network Pg Term Push-To-Talk Pg Term Secure Area Pg Term Secure Multipurpose Internet Mail Extension Pg Term Secure Shell Pg Term Security Association Lifetimes Pg Term Solid State Drive Pg Term SSH-Agent Pg Term Standard Operating Environment Term Standard Operating Procedures Pg Pg Term Transfer Gateway Pg Term Trust Zone Pg Term Trusted Source Pg Term Tunnel Mode Pg Term Unsecure Area Pg Term Whitelist Pg Term Wireless Access Point Pg. 654 GCSB NZISM Change Register December 2017 Release Page 7