Cybersecurity Policies
Explore our comprehensive rules and policies on cybersecurity, ethical hacking, and penetration testing.
Cybersecurity Policies Overview
Explore our comprehensive policies on cybersecurity, ethical hacking, and penetration testing services.
Cybersecurity Best Practices
Learn essential practices to enhance your cybersecurity measures and protect sensitive information.
Ethical Hacking Guidelines
Understand the ethical standards and guidelines for conducting effective penetration testing.
Penetration Testing Policies
Review our policies regarding penetration testing to ensure compliance and security.
ISO/IEC 19249:2017 outlines security principles for designing secure products, systems, and applications. It includes five architectural principles and five design principles.
Architectural Principles:
Domain Separation: Group related components into entities with assigned security attributes, ensuring isolation (e.g., OS privilege levels).
Layering: Structure systems into abstract layers, allowing security policies to be imposed and validated at different levels (e.g., OSI model).
Encapsulation: Hide low-level details and prevent direct manipulation of data, using methods like APIs (e.g., object-oriented programming).
Redundancy: Ensure availability and integrity by duplicating critical components (e.g., RAID configurations, dual power supplies).
Virtualization: Use virtual environments to enhance security boundaries, isolate processes, and protect against malicious activities (e.g., cloud services).
Design Principles:
Least Privilege: Limit permissions to the minimum required for task completion, reducing exposure (e.g., read-only access for viewing documents).
Attack Surface Minimisation: Reduce vulnerabilities by disabling unnecessary services and hardening systems (e.g., Linux hardening).
Centralized Parameter Validation: Validate input from all sources to prevent exploitation (e.g., centralized input validation library).
Centralized General Security Services: Centralize security functions like authentication to simplify management and improve security (e.g., centralized authentication server).
Preparing for Error and Exception Handling: Design systems to fail safely and prevent leaks of sensitive information through error messages (e.g., fail-open firewalls, avoiding confidential data exposure).
These principles guide the creation of secure systems and applications by emphasizing isolation, control, and resilience.