2

Our site is ISO-27001 compliant. As part of the compliance we were advised not to use RDP to connect to the server, but rather to choose a cloud server which provides a web-interface.

Our current cloud server uses NoVNC.

What is the ISO-27001 compliant recommended way of connecting to Windows Servers on Amazon?

As Amazon itself is ISO-27001 compliant since 2010, https://aws.amazon.com/about-aws/whats-new/2010/11/18/aws-achieves-iso-27001-certification/ then I imagine that either Amazon provides more secure RDP than regular cloud servers, or it could be that our advisor for ISO-27001 standards is too strict.

However an additional advantage of NoVNC (as opposed to RDP) is that we put Bitlocker on the hard-drives of the server, and so if the server restarts and is waiting for the Bitlocker password, then we can fix it via NoVNC. Furthermore, if remote desktop doesn't work for whatever reason then NoVNC can be useful. (Note, I appreciate that Bitlocker on Amazon Servers might not be so simple and Amazon have their own method of encrypting hard drives. https://serverfault.com/questions/569133/bitlocker-drive-encryption-on-aws-windows-instance?utm_medium=organic&utm_source=google_rich_qa&utm_campaign=google_rich_qa)

  • we were advised not to use RDP to connect to the server, but rather to choose a cloud server which provides a web-interface who advised you to do this? The auditor or a consultant? – Tom K. May 30 '18 at 11:36
  • It was the consultant that advised us. – gordon613 May 30 '18 at 12:19
  • Direct remote connection over the internet is not recommended, as there are always worry about vulnerabilities in the connection protocol. Adding extra layer like VPN will help, but this will also add another single point of failure. ;-) – mootmoot May 30 '18 at 15:22
  • Besides adding extra layers (and extra points of failure!) what other ways are there of connecting to a Cloud Server that you recommend? – gordon613 Jun 3 '18 at 10:04
3

First of all: ISO/IEC 27001 is the norm that specifies the requirements for the establishing, implementation, maintenance and continuous improvement of an information security management system. Security controls are specified in the ISO/IEC 27002.

In general the ISO 27000 series (including ISO/IEC 27001 and 27002) does not recommend products or certain technologies to use for implementing a control. A typical control in the norm is described in a rather abstract way. Here's an example (freely translated from the German version):

13.2.1 Guidelines and procedures for the transmission of information

Formal transmission policies, procedures and measures should be in place to protect the transmission of information for all types of communication devices.

Instructions for implementation

In the context of the procedures and measures to be followed when using communication facilities for the transmission of information, the following points should be taken into account:
(a) developing procedures to prevent transmitted information from being intercepted, copied, altered, diverted or destroyed;
(b) methods of detection and protection against malware transmitted through the use of electronic communications equipment (see 12.2.1);
(c) procedures for the protection of transferred sensitive electronic information, which are in the form of an annex; [...]1

So to answer your question: there is no one true "ISO-27001 compliant recommended way of connecting to Windows Servers on Amazon", because there is no mention of which technology, protocol or product should be used. This is something you should decide, but what is important here is, that in the end, it should fit the descriptions of a control. So for instance RDP can be used securely but you have a lot of setting up to do which can be complicated.

To come back to your example: Using a cloud provider is fairly easy and using one that is ISO 27001 certified is also a plus in your own audit. To get certified yourself, you will have to read the norms, understand them and only then implement a control that fits the requirements within your scope.

1: Quote taken from DIN ISO/IEC 27002:2016-11

  • Thank you for your very in-depth answer! We are already ISO-27001 certified. Because we are thinking of moving to Amazon we were wondering what the common practice was for security-conscious companies to connect specifically to AWS instances, especially in light of the fact that our ISO-27001 consultant specifically advised us against RDP. – gordon613 May 30 '18 at 12:26
  • I understand that, maybe I wasn't clear enough in my answer. There is no common way. As always: it depends on a lot of things. But as a starting point you can take the ISO/IEC 27002 description of a control and look for a solution that fits the requirements that are specified there. Also, you might be certified now, but there will be an audit of your organization sooner or later. – Tom K. May 30 '18 at 12:43
  • 1
    OK. Great! Yes we have our yearly audit coming up in August I think... – gordon613 May 30 '18 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.