Policy 7230A - Department of Administration

5.2.1.2 Implement Anti-Malware Protection
Malware (including viruses, worms, Trojan Horses, spyware and
spam) represents one of the most pervasive types of security threats
and can be leveraged against the organization in many ways.
Protection requires appropriate solutions:
• Determine points of protection.
• Select and implement solutions according to the
requirements.
• Establish standard configuration for implemented solutions.
• Make changes as per change control processes (see section
5.1.3 of the Non-Mandatory Procedures).
• Maintain as per maintenance processes (see section 6.3.3 of
the Non-Mandatory Procedures).
5.2.1.3 Implement Security Monitoring
To ensure the effectiveness of both the security controls inherent to
the system as well as the security infrastructure external to the
system ongoing monitoring is required:
• Determine the nature of the monitoring information that is to
be gathered and the manner in which it is to be presented.
• Select and implement solutions according to the
requirements.
• Establish standard configuration for implemented solutions.
• Make changes as per change control processes (see section
5.1.3 of the Non-Mandatory Procedures).
• Maintain as per maintenance processes (see section 6.3.3 of
the Non-Mandatory Procedures).
5.3. Data and Media Protection
The following are the Mandatory Procedures that support the Data and Media
Protection section of the Default Security Requirements:
5.3.1. Securely Handle Data and Media
Protect data while it is in system, both in storage and use, as well as out of
system in media, in both storage and transit:
5.3.1.1 Configure Transmissions for Confidentiality and Integrity
Ensure both the integrity and confidentiality of electronic PII data
transmissions through the use of cryptography. Cryptographic
solutions must meet established standards.
5.3.1.2 Validate Data Inputs
No applicable Mandatory Procedures.
13