Cyber security controls

Objective:

 To limit access to information and information processing facilities and ensure authorised user access and to prevent unauthorised access to systems and services. Also, to make users accountable for safeguarding their authentication information and prevent unauthorised access to systems and applications. 

Control implementation overview: 

All University user accounts follow industry best practice identity management guidelines e.g. the use of Single-Sign-On, Multi-Factor-Authentication (MFA)

Privileged IT access management follows industry best practices

Managed end-user devices (computing and mobile devices) and Virtual Private Network (VPN) access provided to all staff

Adherence to the Identity and Access Management Standard

��𳦳پ��: 

To identify organisational data and technology assets and define and implement appropriate levels of protection responsibilities and controls. 

Control implementation overview: 

Guidance on information classification and the acceptable use of University assets via the:

 governing the access to, use of and return of University assets

IT Asset management practices aligned with industry tools and frameworks

Data encryption best practices implemented in a managed IT environment

Secure physical storage of core IT equipment within University managed facilities

��𳦳پ��: 

Information security continuity shall be embedded in the organisation's business continuity management systems and to ensure availability of information processing facilities. 

Control implementation overview: 

University enterprise business continuity and crisis management framework implemented following industry best practice

Resilience in the managed IT environment is designed and implemented to ensure continuous operations of key enterprise IT services and systems

��𳦳پ��: 

To ensure the protection of information in networks and its supporting information processing facilities. 

Control implementation overview: 

Industry best practice network security protection and detection controls and capabilities support the managed IT environment

Dedicated IT network management capability to ensure the best practice management of all network communications infrastructure across the managed IT network (including network infrastructure device configuration, deployment and management)

Virtual Private Network (VPN) mechanisms provided where applicable to secure access to enterprise IT services and systems

��𳦳پ��: 

To avoid breaches of legal, statutory, regulatory or contractual obligations related to information security and of any security requirements and to ensure that information security is implemented and operated in accordance with the organisational policies and procedures. 

Control implementation overview: 

Regular internal cyber security management and security control maturity assessments are conducted across the managed IT environment

The University Internal Audit capability reviews the cyber security management and security control maturity of the University on a periodic basis

Independent regulatory security management audits are conducted on an periodic basis (based on the relevant regulatory scope)

Independent industry security certification audits are conducted on a regular basis (based on relevant University security certifications ) including  PCI DSS security compliance

��𳦳پ��: 

To establish a management framework to initiate and control the implementation and operation of information security within the organisation. 

Control implementation overview: 

University Cybersecurity and Risk capability and the associated cyber security functions and services it provides to the University

University cyber security policies and procedures

University cyber security standards

��𳦳پ��: 

To provide management direction and support for information and cyber security in accordance with business requirements and relevant laws and regulations. 

Control implementation overview: 

University cyber security policies and procedures

University cyber security standards

Regular periodic review and update of cyber security policies, procedures and standards to ensure they continue to support business, regulatory and legal requirements and the cyber security risk and threat landscape

��𳦳پ��: 

To ensure proper and effective use of encryption to protect the confidentiality, authenticity and/or integrity of information. 

Control implementation overview: 

Centralised management of SSL certificates for University web domains

Encryption of data implemented for enterprise managed end user devices

Industry best practice encryption protocols and mechanisms implemented for enterprise managed IT compute and storage hosting platforms

��𳦳پ��: 

To ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered. 

Control implementation overview: 

Enterprise Human Resources capability which governs and supports HR activities across the University

University HR policies and procedures

Employment contracts/agreements (including confidentiality and intellectual property requirements)

Employment screening processes (as governed by University HR policies and procedures)

Employment on-boarding and offboarding processes (as governed by University HR policies and procedure

��𳦳پ��: 

To ensure correct and secure operations of information processing facilities, to protect against loss of data and to record events and generate evidence. 

Control implementation overview: 

Enterprise grade antivirus and anti-malware detection, prevention and recovery technology across lT managed devices

Technical vulnerability management program and supporting tools implemented across the managed IT environment (including vulnerability scanning, vulnerability disclosure program, bug bounty program)

Security penetration testing capabilities applied to verify the technical security posture of enterprise IT service and infrastructure in a risk-based manner

Security threat identification, monitoring and response capabilities based on industry best practice frameworks

IT change management procedures and processes embedded into the managed enterprise IT environment in alignment with industry best practices (including change management and release procedures, change advisory board (CAB) and change management records etc.

Operational monitoring of the managed IT environment to ensure appropriate IT system and platform health and resilience

Standard patch management processes based on industry best practice for managed end-user devices, IT hosting platforms and core IT infrastructure

��𳦳پ��: 

To prevent unauthorised physical access, damage and interference to the organisation's information and information processing facilities and to prevent loss, damage, theft or compromise of assets and Interruption to the organisation’s operations. 

Control implementation overview: 

Use of commercial grade ISO 27001 certified data centre hosting providers within New Zealand for the storage of core IT equipment

Use of commercial grade ISO 27001 certified cloud hosting providers for managed cloud platform services

Centralised physical security management and support services provided by the University Facilities Security Services capability

Implementation of standard physical security access and monitoring controls across all University offices and buildings (including electronic building access management, 24/7 CCTV monitoring and security guard services etc.)

Implementation of standard environmental management and monitoring controls across all University offices and buildings (including managed heating, cooling, lighting etc.)

��𳦳پ��: 

To ensure protection of the organisation's assets that are accessible by suppliers. To maintain an agreed level of information security and service delivery in line with supplier agreements. 

Control implementation overview: 

support the procurement and use of externally managed IT services

Standard University data security and data privacy requirements are considered within contractual agreements with external suppliers

Supplier delivery and commercial management processes in place to ensure that suppliers continue to perform and meet the requirements of the supplier agreements

��𳦳پ��: 

To ensure that information security is an integral part of information systems across the entire system development and maintenance lifecycle. 

Control implementation overview: 

and the the development, release or significant changes of IT services or systems within the managed environment

 support the design, development and implementation of IT systems

Specific security awareness and secure code development training for development capabilities and resources

Implementation of industry best practice approaches to secure development life cycle practices (e.g.  secure code training, security testing, and communities of practice etc.)

IT change management procedures and processes embedded into the s managed enterprise IT environment in alignment with industry best practices (including change management and release procedures, change advisory board (CAB) and change management records etc.)

mini��ý

Menu

mini��ý UC

Mō UC

Study

Ako

Life

Te Ao o UC

Research

Rangahau

News and Events

Rongo o te Wā

Find it

Do it

Study it

Tools

Latest

General enquiries

International enquiries

More contact details

mini��ý contact details