Application |
|
| Names | Controls |
| · Application - "Application Server" - Apache Tomcat 5.5.12 | 42 |
| · Application - "Application Server" - Oracle 9iAS ("Java Edition") | 79 |
| · Application - "Browser" - Microsoft Internet Explorer 6.x | 49 |
| · Application - "Database" - IBM DB2 8.1 (Unix) | 42 |
| · Application - "Database" - Microsoft SQL Server 2000 | 96 |
| · Application - "Database" - MySQL 5 | 54 |
| · Application - "Database" - Oracle 8/8i | 77 |
| · Application - "Database" - Oracle 9i | 82 |
| · Application - "Database" - PostegreSQL 8.0 | 60 |
| · Application - "Database" - Sybase 11.0.2 | 38 |
| · Application - "DHCP Server" - Microsoft DHCP (Windows 2000 Server) | 22 |
| · Application - "DHCP Server" - Microsoft DHCP (Windows Server 2003) | 22 |
| · Application - "Email client" - Microsoft Outlook 2000 | 28 |
| · Application - "Email client" - Microsoft Outlook 2003 (English) | 30 |
| · Application - "Email client" - Microsoft Outlook XP | 28 |
| · Application - "Email Server" - Microsoft Exchange Server 2003 | 121 |
| · Application - "Email Server" - Postfix 2.2 (Unix) | 49 |
| · Application - "Email Server" - Qmail 1.03 (Unix) | 32 |
| · Application - "Email Server" - Sendmail 8.12 (Unix) | 49 |
| · Application - "ERP" - SAP AG R/3 4.0B (Application Server) | 67 |
| · Application - "ERP" - SAP AG R/3 4.0B (Oracle Database) | 9 |
| · Application - "ERP" - SAP AG R/3 4.6D (Application Server) | 72 |
| · Application - "ERP" - SAP AG R/3 4.6D (Oracle Database) | 10 |
| · Application - "Firewall" - Check Point SmartPortal (NGX R60) | 16 |
| · Application - "Firewall" - Check Point VPN-1 Pro (NGX R60) | 20 |
| · Application - "Firewall" - Check Point VPN-1/Firewall-1 4.1 | 60 |
| · Application - "Firewall" - Check Point VPN-1/Firewall-1 NG | 74 |
| · Application - "Firewall" - Generic Firewall | 52 |
| · Application - "Firewall" - Linux IPTables 1.3.x | 47 |
| · Application - "Firewall" - Microsoft ISA Server 2004 | 117 |
| · Application - "FTP Server" - Wuftpd (Unix) | 33 |
| · Application - "Gateway" - Microsoft SNA Server 2000 | 28 |
| · Application - "Groupware" - IBM Lotus Notes Client R5 | 9 |
| · Application - "Groupware" - IBM Lotus Notes Domino Server R5 | 61 |
| · Application - "IDS" - ISS Real Secure 7.0 | 17 |
| · Application - "IDS" - Unix Snort 2.x | 20 |
| · Application - "Instant Messenger" - ICQ, Microsoft Messenger and similar applications | 9 |
| · Application - "Name Server" - ISC Bind versions 4.x/8.x/9.x | 31 |
| · Application - "Name Server" - Microsoft DNS (Windows 2000) | 26 |
| · Application - "Name Server" - Microsoft DNS (Windows 2003) | 27 |
| · Application - "Office Tools" - Microsoft Office 2000 (English) | 28 |
| · Application - "Office Tools" - Microsoft Office 2003 (English) | 41 |
| · Application - "Office Tools" - Microsoft Office XP (English) | 41 |
| · Application - "Proxy Server" - Squid 2.5 (Unix) | 24 |
| · Application - "Remote Access Server" - Microsoft RRAS (Windows 2000) | 41 |
| · Application - "System Management Server" - Microsoft SMS 2.0 | 37 |
| · Application - "Terminal Server" - Citrix MetaFrame XP FR3) | 44 |
| · Application - "Terminal Server" - Microsoft Terminal Services (Windows 2000) | 34 |
| · Application - "Terminal Server" - Microsoft Terminal Services (Windows Server 2003) | 32 |
| · Application - "Unix Service" - OpenSSH | 24 |
| · Application - "Unix Service" - Unix NFS | 12 |
| · Application - "Web Server" - Apache 1.3.27. (Unix) | 48 |
| · Application - "Web Server" - Apache 2.0.x (Windows) | 55 |
| · Application - "Web Server" - Microsoft IIS 5.0 | 111 |
| · Application - "Web Server" - Microsoft IIS 6.0 | 119 |
| · Application - "Web Services" - Web Services on Microsoft .NET platform | 11 |
Environment |
top |
| Names | Controls |
| · Environment - "Administration" - Office | 68 |
Equipment |
top |
| Names | Controls |
| · Equipment - Access Point" - WLAN pattern IEEE 802.11b Generic | 31 |
| · Equipment - "Computer" - Desktop workstation | 19 |
| · Equipment -"Computer" - Laptop/Notebook | 23 |
| · Equipment - "Computer" - Server | 23 |
| · Equipment - "Firewall" - Cisco Secure Pix Firewall series 500 OS v6.3 | 53 |
| · Equipment - "PDA" - Generic Handheld | 26 |
| · Equipment - "PDA" - PALM | 28 |
| · Equipment - "PDA" - Pocket PC with Windows Mobile 2003 | 24 |
| · Equipment - "Router"- Cisco IOS 12 Router | 96 |
| · Equipment - "Switch Layer 2" - Cisco Catalyst with CatOS 9 | 27 |
| · Equipment - "Switch Layer 2" - Cisco Catalyst with IOS 12 | 75 |
| · Equipment - "Switch Layer 2" - Generic | 63 |
| · Equipment - "Switch Layer 3" - Cisco Catalyst with IOS 12 | 76 |
| · Equipment - "Switch Layer 3" - Enterasys X-Pedition (SSR) 2000/8000/8600 | 45 |
| · Equipment - "Switch Layer 3" - Generic | 73 |
FISAP |
top |
| Names | Controls |
| · FISAP - AUP | 46 |
| · FISAP - SIG - Access Control | 58 |
| · FISAP - SIG - Asset Management | 13 |
| · FISAP - SIG - Business Continuity Management | 31 |
| · FISAP - SIG - Communication and Operations Management Back-up | 13 |
| · FISAP - SIG - Communication
and Operations Management Exchange of Information |
27 |
| · FISAP - SIG - Communication and Operations
Management Media Handling |
15 |
| · FISAP - SIG - Communication and Operations Management Monitoring | 22 |
| · FISAP - SIG - Communication and Operations Management Network Security Management | 69 |
| · FISAP - SIG - Communication and Operations Management Operational Procedures and Responsibilities | 19 |
| · FISAP - SIG - Communication and Operations Management Protection Against Malicious and Mobile Code | 13 |
| · FISAP - SIG - Communication and Operations Management System Planning and Acceptance | 5 |
| · FISAP - SIG - Communication and Operations Management Third Party Services Delivery Management | 9 |
| · FISAP - SIG - Communications
and Operations Management (Apache) |
8 |
| · FISAP - SIG - Communications and Operations
Management (AS/400 Standards) |
20 |
| · FISAP - SIG - Communications and Operations Management (Cryptography) | 19 |
| · FISAP - SIG - Communications and Operations Management (IIS) | 10 |
| · FISAP - SIG - Communications and Operations Management (Mainframe Audit Alarm command) | 11 |
| · FISAP - SIG - Communications and Operations Management (Mainframe Standards) | 24 |
| · FISAP - SIG - Communications and Operations Management (OpenVMS Standards) | 15 |
| · FISAP - SIG - Communications and Operations Management (UNIX) | 33 |
| · FISAP - SIG - Communications and Operations Management (User Equipment) | 13 |
| · FISAP - SIG - Communications and Operations Management (Windows) | 31 |
| · FISAP - SIG - Compliance | 7 |
| · FISAP - SIG - Human Resource Security | 44 |
| · FISAP - SIG - Information
Security Incident Management |
15 |
| · FISAP - SIG - Information Systems Acquisition
Development and Maintenance |
52 |
| · FISAP - SIG - Organizational Security | 11 |
| · FISAP - SIG - Physical and Environmental Security | 32 |
| · FISAP - SIG - Security Policy | 9 |
Operating System |
top |
| Names | Controls |
| · Operating System - "Mainframe" - IBM OS/390 2.10 | 91 |
| · Operating System - "Microsoft" - Windows 2000 Professional (English version) | 279 |
| · Operating System - "Microsoft" - Windows 2000 Server Family (Domain Controller) | 347 |
| · Operating System - "Microsoft" - Windows 2000 Server Family (Member Server) | 280 |
| · Operating System - "Microsoft" - Windows NT 4.0 Server | 118 |
| · Operating System -"Microsoft"
- Windows NT 4.0 Workstation |
112 |
| · Operating System - "Microsoft" -
Windows Server 2003 Family (Domain Controller) |
423 |
| · Operating System - "Microsoft" - Windows Server 2003 Family (Member Server) | 355 |
| · Operating System - "Microsoft" - Windows Vista Ultimate (English) | 336 |
| · Operating System - "Microsoft" - Windows XP Professional (English version) | 346 |
| · Operating System - "Novell" - NetWare 3.x | 55 |
| · Operating System - "Novell" - NetWare 6.0 with eDirectory and TCP/IP services | 110 |
| · Operating System - "Unix" - Linux Debian 3.x | 113 |
| · Operating System - "Unix" - Linux Fedora Core 3 | 106 |
| · Operating System - "Unix" - Linux Red Hat Enterprise 3.0 | 112 |
| · Operating System - "Unix" - Linux Slackware 10.x | 103 |
| · Operating System - "Unix" - Linux Suse 7.3 | 103 |
| · Operating System - "Unix" - Red Hat 7.x Linux | 111 |
| · Operating System - "Unix" - Slackware Linux 9.x | 101 |
| · Operating System - "Unix" - Unix FreeBSD 5.x | 117 |
| · Operating System - "Unix" - Unix HP Tru64 5.1B | 90 |
| · Operating System - "Unix" - Unix AIX 4/5 | 95 |
| · Operating System - "Unix" - Unix HP-UX 10.x/11.x | 100 |
| · Operating System - "Unix" - Unix SCO OpenServer | 96 |
| · Operating System - "Unix" - Unix Solaris 8 | 134 |
People |
top |
| Names | Controls |
| · People - Area or Process Manager | 24 |
| · People - End User | 28 |
| · People - People - IT Technician | 9 |
| · People - People - Security Officers (Civil Liability) | 43 |
| · People - People - Senior Manager (Officers Civil Liability) | 40 |
Processes |
top |
| Names | Controls |
| · Process -"Applications" - Change Management in Systems | 11 |
| · Process - "Applications" - Data and System Backup | 12 |
| · Process - "Applications" - Developed Application System (based on ISO 15408) | 64 |
| · Process - "Applications" - Development and Maintenance Environment (based on ISO 15408) | 11 |
| · Process - "Applications" - Systems Continuity Management | 7 |
| · Process - "Legal" - Contracts with Vendors | 35 |
| · Process - "Management" - Business Process Information Flow | 31 |
| · Process - "Management" - Information Security Management System (ISO/IEC 17799:2005) | 152 |
| · Process - "Management" - IT Process Maturity (based on Cobit 4.0) | 5 |
| · Process - "Management" - Organization of IT Security | 58 |
| · Process - "Management" - Requirements for the Information Security Management System (ISO/IEC 27001:2005) | 38 |
| · Process - "Regulatory" - General Security Policies | 66 |
| · Process - "Regulatory" - HIPAA NIST 800-66 | 106 |
| · Process - "Regulatory" - PCI 1.0 | 204 |
| · Process - "Regulatory" - PCI 1.1 | 233 |
Others |
top |
| Names | Controls |
| · Facilities - Datacenter - Generic | 122 |
| · FISMA | 163 |
| · Networks - LAN/WAN Generic | 27 |
| · NIST 800-68 |
5 |
| top | |
Microsoft
"Modulo Risk Manager was used as a solution to speed up our risk assessments."