Tag Info

New answers tagged

0

Content-Security-Policy is also a domain specific language to tell the browser from which origins which kind of content is acceptable (mainly script, but also css, images...). This is maybe not what you intended, but it describes a policy at the network level and could actually be used within deep inspection firewalls to enforce the policy for dumb browsers ...


0

The de factor policy language for access control (aka authorization) is XACML, the eXtensible Access Control Markup Language. Once upon a time there was an alternative from Microsoft Research called SecPal. It never picked up and XACML was preferred instead. MS Windows Server 2012 (Server 8) also has its own policy language called SDDL but it is specific ...


4

Certification companies like SGS, TÜV Rheinland or BSI are accredited by accreditation entities to issue ISO 27001 certificates. For example, SGS and BSI are accredited by UKAS and TÜV Rheinland is accredited by DAR. Accreditation entities perform audits of the certification companies they accredit in order to guarantee that they conform to their ...


0

The ISO27001 is a standard against which an organization is audited. It is not a pen test or a code review, it is focused primarily on management, policies, etc. It's a third party providing reasonable assurance about the operating effectiveness, controls, etc. at the company. e.g., If an org has been certified, you still would have legal agreements, ...


1

Ultimately it's down to trust. Who trusts you to audit against ISO27001? In the case of BSi, they've established themselves as part of the process (indeed BS7799 which was a BSi developed standard predated ISO27001 and IIRC got effectively turned into ISO27001 when it was first created). So as part of creating a standard you have to create and manage an ...


0

Procedural security controls are security controls that mitigate identified risks by way of policies, procedures or guidelines. As opposed to other controls, procedural controls rely on users to follow rules or performs certain steps that are not necessarily enforced by technical or physical means. How about that for a definition? By no means official as ...



Top 50 recent answers are included