8Al 8|CuklJ CL|AklNG

Ju| CON|u8lON AND

JAklNG A uOLl8JlC
AllkOACu
WWW.VANJkANCON8uLJlNG.COV
25 Vor 2ull, l8ACA 8loooro
ro[ect Contro|s
S
A

o
s
t

U
p
g
r
a
d
e

k
e
v
|
e
w
8ASIS Contro|s
S
A

s
e
c
u
r
|
t
y

a
n
d

c
o
n
t
r
o
|
s
Informat|on Secur|ty o||cy and rocedures
ko|es, rof||es, Author|zat|ons and Author|zat|on
Cb[ects
Infrastructure secur|ty
SAS70
SCk
Log|ca| access
SA re Imp|ementat|on kev|ew
Change contro|s
SAkouter
C
h
a
n
g
e

a
n
d

1
r
a
n
s
p
o
r
t


S
y
s
t
e
m

(
C
1
S
)
Arch|tecture secur|ty
Conf|gurab|e contro|s
Access contro|s
S
e
g
r
e
g
a
t
|
o
n

C
f

D
u
t
|
e
s
Data M|grat|on
SA38 and SL38
N
e
t
W
e
a
v
e
r

S
e
c
u
r
|
t
y
A
u
t
h
o
r
|
z
a
t
|
o
n
s

r
e
v
|
e
w
SL16, SM30 & SM31
1ransport Management System (1MS)
SA ost Imp|ementat|on kev|ew
S
C
D
SA*, CIC, DDIC and LAkLWA1Cn
Ob|octlvos
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
33
Dlsccss vorlocs tyos oI soccrlty cootrols lo 8Al
DoIloo Iroowor| Ior 8Al soccrlty ocults
Dlsccss lotorotloo wlto lJ oou oorotloool ocults
1bis resen|o|ion does no| cover individuoI 8AI securi|y
con|roIs ond conce|s in de|oiI ..
And i| is no| o |ecbnicoI resen|o|ion on 8AI securi|y con|roIs
8Al ls o soosltlvo 8 crltlcol systo
44
8Al ls oo |kl oou o bcslooss ollcotloo systo
Aoy soccrlty vclooroblllty oy rosclt lo Iloooclol loss,
bcslooss ulsrctloos, lsstotooot oI Iloooclol
loIorotloo, otc
uoll|o loIrostrcctcro soccrlty vclooroblllty, 8Al
soccrlty vclooroblllty oy ulroctly loct too bcslooss
8Al ls oo lotorotou systo tooroIoro, ooy orrors
oy oovo o wluosroou loct
Ooo oI too ost lortoot systo lo ooy oroolzotloo
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Woot ls too loct oo lJ ocult
lt ls lortoot to soccro 8Al systo
Jo soccro 8Al, lt ls oot scIIlcloot to ooIorco cootrols
losluo 8Al ooly
55
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
8Al ls o ort oI lJ loIrostrcctcro
66
User PC/ Laptop
User PC/ Laptop
AppIication Server 3
AppIication Server 1
AppIication Server 2 Database
Server
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Woot ooous to bo soccrou
Allcotloo ororloto soccrlty cootrols ooou to
bo ooIorcou lo 8Al
loIrostrcctcro too scortlo loIrostrcctcro ooous to
bo soccrou os woll
Notwor| roctors, swltcoos, Ilrowolls
8orvor ollcotloo sorvor oou uotoboso sorvor
Oorotlo systo
Dotoboso
lCs, Lotos rosoototloo loyor oI too 8Al systo
77
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Woot oroolzotloos rovlow ..
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
88
uon'L know/ oLhers
noL performed
uaLa mlgraLlon
8ASlS conLrols
Conflgurable/ auLomaLed buslness.
SA securlLy pollcles and procedures
Sou
AuLhorlzaLlons
8
14
16
24
38
34
68
70
SA Aud|t] kev|ew Scope
8ocrco. VANJkAN 8Al 8occrlty lroctlcos 8crvoy 2ulu
8occrlty cootrols lo 8Al
99
Author|zat|on s
Contro|s
Segregat|on of
Dut|es
(SCD)
8ASIS
Contro|s
8us|ness
rocess
Contro|s
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Actoorlzotloo cootrols
10 10
Allow csors lo 8Al to orIor toolr wor| wollo
soccrlo troosoctloos Iro cooctoorlzou occoss
lt ls o colo oou scoloblo coocot
Dotorloos wHA1 octlvlty coo bo orIorou by o csor os
woll os wHLkL lt coo bo orIorou
|oIorcou toroco o socuo ob|oct orlootou coocot cslo
octoorlzotloo ob|octs
Actoorlzotloos oro ossloou to kolos, wolco oro tooo
ossloou to usors
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Aroimo|eIy 2,000 ou|borizo|ion ob|ec|s con|roI occess
|o more |bon 100,000 |ronsoc|ion codes
Loo| Ior too oolos .
11 11
8Al cooc|s csor ostor rocoru Ior rogclrou
octoorlzotloos
8Al rovluos loIorotloo oo wolco octoorlzotloos oro
rogclrou Ior ooco troosoctloo couos
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
lt ls lortoot to loo| Ior 'ulsoblou'
octoorlzotloo cooc|sl
Dlsobllo octoorlzotloo cooc|s .
12 12
Joo Actoorlzotloo Ob|oct cooc| oos booo ulsoblou Ior
too Jroosoctloo Couo cslo troosoctloo 8u2= (toblo
u8OJ_C oou u8Ox_C}
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Doo't Iorot lobol uooctlvotloo oI Actoorlzotloo
Ob|octs toroco troosoctloo AuJu_8WlJCu_O1|CJ8
(roIllo orootor 'octo,ob|oct_ulsobllo_octlvo'
sooclu bo sot to Ior tols to to|o oIIoctl}
Woot sooclu bo rovlowou
13 13
Accoss to crltlcol, soosltlvo octlvltlos oro cootrollou
usor occoss ls ororloto (l.o., bosou oo toolr rolos
oou rosooslbllltlos}
kolos oro ororloto (l.o., octoorlzotloos wltolo rolos
oro os or too rolo uoIloltloo}
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
8orootloo oI Dctlos (8oD}
14 14
|oscros toot oo ooo loulvlucol oos coloto cootrol
ovor o|or ooso oI o rocoss
koy cooooot oI ooy oIIoctlvo lotorool cootrols
oovlroooot
Jylcolly ooIorcou toroco o coblootloo oI occoss
cootrol oou ltlotlo cootrols
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Woot sooclu bo rovlowou
15 15
8oD Iroowor| oos booo uoIloou
usors uo oot oovo 8oD cooIllcts
kolos uo oot oovo 8oD cooIllcts
lI 8oD cooIllcts olsts lo csors, tooro oro ororloto
ltlotlo cootrols
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
oyoou too boslcs .
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
16 16
Vltlotlo cootrols uo tooy wor|
lt ls lortoot to cooc| wootoor too ltlotlo cootrols wor|
Vltlotlo cootrols sooclu bo uoccootou oou tostou
roclorlyl
A8l8 cootrols
17 17
koIors to tocoolcol cootrols lo 8Al
lossworu cootrols
usor oulolstrotloo
lrlvlloou csors
Acultlo
Coooo cootrols
otco |ob oooooot
Dlroct occoss to uoto toroco toblos
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Go boyoou too boslcs
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
18 18
Clloot sottlos ulroct coooos sooclu oot bo ollowou
oo too roucctloo clloot
Doo't Iorot to cooc| systo sottlosl
Aou too toblo lolol
Woot sooclu bo rovlowou
19 19
A8l8 rovlow
lollclos oou rocoucros
Jocoolcol sottlos lo 8Al
lJ rocoucros rolotou to 8Al oulolstrotloo oou
olotooooco
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
cslooss rocoss cootrols
20 20
koIors to octootou (oou lJ uooouoot} cootrols
ovolloblo lo 8Al Ior vorlocs bcslooss rocossos scco
os crcooslo, solos, Iloooclol roortlo, lovootory,
uk, otc
roouly closslIlou couor Iollowlo toroo cotoorlos.
loooroot cootrols
CooIlcroblo cootrols
lrocoucrol cootrols
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
cslooss rocoss cootrols
21 21
loooroot cootrols |oIorcou by uoIoclt lo 8Al
8olos Oruor coooot bo crootou wlto oo lovollu ccstoor
CooIlcroblo cootrols '8wltcoos' toot coo bo sot by
tcrolo too oo or oII bosou oo too bcslooss
rogclrooots
CooIlcrou toroco llooototloo Gcluo (lVG}
|olos - tolorooco lllts Ior toroo woy otco, lO
orovol olororcoy
lrocoucrol cootrols lJ uooouoot cootrols (o..,
rovlow oI ocotloo roorts}
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Do oroolzotloos cso too
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
22 22
11
46
30
13
Ut|||zat|on of SA automated contro|s
very confldenL
SomewhaL confldenL
noL confldenL
uon'L know/ oLhers
8ocrco. VANJkAN 8Al 8occrlty lroctlcos 8crvoy 2ulu
8oo oolos oI scco cootrols .
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
23 23
16
23
24
33
MIN cond|t|on for pr|c|ng
Mln ls used
Mln ls noL requlred
noL aware LhaL SA has
Mln
uon'L know
8ocrco. VANJkAN 8Al 8occrlty lroctlcos 8crvoy 2ulu
A Iow oro oolos .
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
24 24
Dcol cootrols Ior ccstoor oou voouor ostors
A Iow oro oolos .
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
25 25
Altorooto oyoo
A Iow oro oolos .
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
26 26
koclor rovlow oI voouor roorts scco os k|kALuu (Coooos
to voouors}
Woot sooclu bo rovlowou
27 27
CooIlcrotloo sottlos
lrocoucrol cootrols
|cotloo roorts
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Cloorlo too cooIcsloo
28 28
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
1. 8usiness Irocess keview
2. Con|iquro|ion keview
8. 8Iuerin| keview
4. |1 Au|omo|ed Con|roIs
(|1AC) keview
5. |1 AIico|ion Con|roIs
(|1AC) keview
1. 8A8|8 keview
2. |1 GeneroI Con|roIs (|1GC)
keview
8. 1ecbnicoI keview
1. Au|borizo|ions
keview
2. Access keview
8. 8oD review
4. koIe keview
5. User keview
1. Au|borizo|ions
keview
2. Access keview
8. 8oD review
4. koIe keview
5. User keview
8occrlty cootrols octsluo 8Al
29 29
lt ls ogcolly lortoot to ooIorco soccrlty cootrols lo
too couorlylo loIrostrcctcro cooooots
8Al lotorocts wlto lts couorlylo loIrostrcctcro
cooooots lo colgco woys
JooroIoro, lt ls lortoot to coosluor cootrols rolotou
to tooso lotoroctloos ot too loIrostrcctcro lovol
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Notwor| cootrols oro lortoot
30 30
8Al ootwor| soccrlty
Coo csors ulroctly cooooct to too uotoboso toroco
boc|oou
ls too uoto trooslssloo ovor too ootwor| soccro
Woot ootwor| cocolcotloo ls ollowou botwooo csor
ocoloos oou ollcotloo sorvor
Woot ootwor| cocolcotloo ls ollowou botwooo
ollcotloo sorvor oou uotoboso sorvor
Aort Iro cscol ootwor| soccrlty cootrols, coosluor
8Al soclIlc cootrols scco os 8Alkoctor oou 8NC
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
8Al scorts ootwor| soccrlty
31 31
8Alkoctor
8Alkoctor ls oo 8Al roro toot sorvos os oo
lotorouloto stotloo (roy} lo o ootwor| cooooctloo
botwooo 8Al systos or roros
Cootrols occoss to yocr ootwor| (ollcotloo lovol otowoy}
usoIcl otoosloo to oo olstlo Ilrowoll
8occro Notwor| Cocolcotloos
8NC ls csou to soccro 8Al ootwor| cooooctloos
lrovluos rolloblo octoootlcotloo os woll os oocrytloo oI too
uoto to bo troosIorrou
8Alkoctor ollows 8NC cooooctloos to bo sot c
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
8Al sorvor ooous to bo ooruooou
32 32
oto ollcotloo oou uotoboso sorvors ooou to bo
ooruooou
Coosluor 8Al soclIlc ooruoolo rogclrooots scco os
troosort tools soccrlty, roIllo orootor Illo soccrlty
oou soccrlty ocult los soccrlty
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
8Al coooos oro cootrollou by O8
33 33
Oorotlo systo lovol troosort tools lo 8Al sorvors
Coooo oou Jroosort 8ysto (CJ8} ls o sot oI tools to
oroolzo uovolooot ro|octs lo too AAl Wor|booco oou
lo ccstolzlo, oou tooo troosort too coooos botwooo too
8Al systos oou clloots
lt broouly cooslsts oI Coooo oou Jroosort Oroolzor
(CJO}, Jroosort Voooooot 8ysto (JV8} oou soo
oorotlo systo lovol troosort tools
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
8Al Coooo oou Jroosort 8ysto
34 34
Jroosort Jools
(t oou k3troos}
CJO
Jroosort
Oroolzor
Wor|booco
Oroolzor
Ccstolzlo
Oroolzor
JV8
Jroosort
Voooooot
8ysto
k|C k|C
k|C
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
CJ8 uooous oo O8 Illos
35 35
Jooro oro two lobol cooIlcrotloo Illos
Jl_DOVAlN_<8lD>.l|L oou JllAkAV toot cst
loclcuo ootrlos Ior ooco 8Al systos to|lo ort lo
troosorts
't' csos tooso Illos Ior o|lo troosorts.
8torou lo ,csr,so,troos or <Dklv|>,csr,so,troos
Accoss rlots sooclu bo cooIlcrou so toot oll 8Al systos
wltolo too troosort roc coo occoss tooso Illos
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Jroosort tools rosluo ot O8 lovol
36 36
lorts coo bo orIorou cslo 't' roro ot too
O8 lovol by lolo loto too torot systo os csor
<8lD>ou, olo to ,csr,so,troos,blo ulroctory
oou colllo too roro
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
8Al roIllos oro O8 Illos
37 37
lroIllo orootor Illos storou lo 8Al sorvor
A roIllo lo 8Al ls oo oorotlo systo Illo cootololo
orootors oou cooIlcrotloo loIorotloo oI 8Al lostooco
Joo roIllo Illos oro locotou couor too ulroctory
,csr,so,<8lD>,88,roIllo
Jols ulroctory ls soorou by oll ollcotloo sorvors boloolo
to too soo 8Al systo (l.o., 8lD}
Accoss to oulIy too roIllo Illos sooclu bo rostrlctou
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Acult lo ls storou oo sorvor
38 38
8occrlty ocult los storou lo 8Al sorvor
ksoc,locol,Illo uoIloo ooos oou locotloos oI too soccrlty
ocult lo Illos
Accoss to too soccrlty ocult lo Illos oou ulroctorlos sooclu
bo rostrlctou
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Aou vlco vorso ...
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
39 39
Wlto ororloto occoss,
O8 lovol cooous coo
bo oocctou Iro wltolo
8All
loulcotlvo 8Al soccrlty Iroowor| ..
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Woot uoos lt ooo Ior lJ ocultors
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
41 41
8Al ocult covors boto tocoolcol oou Icoctloool oroos
kogclros lotorotloo botwooo lJ oou lotorool,
oorotloool ocultors
Wltolo lJ ocult too, coorulootloo botwooo
loIrostrcctcro oou 8Al ocultors ls lortoot to ooscro
toot lortoot loIrostrcctcro cootrols oro covorou
|colloot oortcolty to couorstoou bcslooss oou
ollo lJ ocult wlto bcslooss rls|sl
lotorotou ocult ls oot yot cooo
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
42 42
32
14
32
22
IA Approach
no - no lnLegraLlon wlLh
sysLemlc conLrols ln SA
?es - Lo a very small
exLenL
?es - Lo large exLenL
uon'L know/ CLhers
8ocrco. VANJkAN 8Al 8occrlty lroctlcos 8crvoy 2ulu
8Al rovlow toroco lts llIocyclo
43 43
8Al rovlow oy bo orIorou ot vorlocs stoos oI
8Al llIocyclo
Accoruloly, scoo oou covoroo oy vory
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
Pre-ImpIementation
Review
Post-ImpIementation
Review
lro-llooototloo rovlow
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
44 44
Cooucctou boIoro 8Al ls lloootou (l.o., boIoro
o-llvo} oou oy loclcuo
lcorlot,cooIlcrotloo, bcslooss rocoss cootrols rovlow
Actoorlzotloos oou 8oD rovlow
lJ ooorol cootrols, A8l8 rovlow
Doto lrotloo , coovorsloo, cctovor rovlow
lro|oct oooooot rovlow
lroro uovolooot rovlow
lro-llooototloo rovlow
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
45 45
8ysto oy oot olst or cootrols oy oot oovo booo
lloootou
lt ls oItoo o uoccoot rovlow bosou oo uoccoots
scco os
cslooss blcorlots
Actoorlzotloo uoslo uoccoots
lro|oct loo, strotoy oou otoor ro|oct uoccoots
Doto lrotloo loo, strotoy oou cctovor loo
8Al tocoolcol uoslo uoccoots
uAJ uoccoots
lost-llooototloo rovlow
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
46 46
uscolly cooucctou oItor systo stoblllzotloo
lt cscolly loclcuos too Iollowlo oroos
CooIlcrotloo, bcslooss rocoss cootrols rovlow
Actoorlzotloos oou 8oD rovlow
lJ ooorol cootrols, A8l8 rovlow
uscolly cooucctou by rovlowlo too systo sottlos
Otoor oroos
2ull VANJkAN Cooscltlo lto. Ltu. All rlots rosorvou.
47 47
Jooro oro oow soccrlty coocoros wlto cso oI vorlocs
NotWoovor rouccts
Otoor 8Al rouccts scco os CkV, 8kV, 8CV oou 8LV
oovo toolr owo soccrlty lsscos
lrosootou by
8orun kumor
Dlroctor
Vootroo Cooscltlo lto Ltu
-5 8ll8 9972
|oll lD borco|cor@ootroocooscltlo.co
Llo|oulo roIllo ott.,,www.llo|oulo.co,lo,borco|cor
Vy blos ott.,,www.ootroocooscltlo.blosot.co,
Ocostloos
Vootroo Cooscltlo lto Ltu 2ull All rlots rosorvou.
VANJkAN loo oro rolstorou or corolstorou trouoor|s oI Vootroo Cooscltlo lto Ltu. All otoor ooos, broous, loo, otc
oro rolstorou trouo or sorvlco or|s oI toolr rosoctlvo owoors.
8Al, 8Al loo oou oll 8Al scrooosoots oro coyrlot oI 8Al AG. 8Al ls o rolstorou trouoor| oI 8Al AG.
All loIorotloo rovluou lo too trololo ls trco to bost oI ocr |oowlouo. Joo loIorotloo rovluou ls o scorlzotloo oI
vorlocs coocots Ior ooso oI couorstooulo. Cortolo Iocts oy oovo booo loorou or slllIlou Ior oosy couorstooulo. Joo
loIorotloo rovluou oy oot bo occcroto or coloto.