Regular Monitoring and Testing of Networks. All access to network resources and Personal Data is tracked and monitored using centralized logging mechanisms that allow thorough tracking, alerting, and analysis on a regular basis (at least daily) as well as when something does go wrong. All systems are provided with correct and consistent time and audit trails are secured and protected, including file-integrity monitoring to prevent change of existing log data and/or generate alerts in case. Audit trails for critical systems are kept for a year. Security of systems and processes is regularly tested, at least yearly. This is to ensure that security controls for system components, processes and custom software continue to reflect a changing environment. Security testing includes: ● Processes to test rogue wireless access points, ● Internal and external network vulnerability tests that are carried out at least quarterly. An external, qualified party carries out the external network vulnerability tests. ● External and internal penetration tests using Partner's penetration test methodology that is based on industry-accepted penetration testing approaches that cover the all relevant systems and include application-layer as well as network-layer tests All test results are kept on record and any findings are remediated in a timely manner. Partner does not allow penetration tests carried out by or on behalf of its customers. In daily operations IDS (intrusion detection system) is used to detect and alert on intrusions into the network and file-integrity monitoring has been deployed to alert personnel to unauthorized modification of critical systems.
Regular Monitoring and Testing of Networks. All access to network resources and Personal Data is tracked and monitored using centralized logging mechanisms that allow thorough tracking, alerting, and analysis on a regular basis (at least daily) as well as when something does go wrong. All systems are provided with correct and consistent time and audit trails are secured and protected, including file-integrity monitoring to prevent change of existing log data and/or generate alerts in case. Audit trails for critical systems are kept for a year. Security of systems and processes is regularly tested, at least yearly. This is to ensure that security controls for system components, processes and custom software continue to reflect a changing environment. Security testing includes: • Processes to test rogue wireless access points, • Internal and external network vulnerability tests that are carried out at least quarterly. An external, qualified party carries out the external network vulnerability tests. • External and internal penetration tests using Partner's penetration test methodology that is based on industry-accepted penetration testing approaches that cover the all relevant systems and include application-layer as well as network-layer tests All test results are kept on record and any findings are remediated in a timely manner. Partner does not allow penetration tests carried out by or on behalf of its customers. In daily operations IDS (intrusion detection system) is used to detect and alert on intrusions into the network and file-integrity monitoring has been deployed to alert personnel to unauthorized modification of critical systems. Incident Management Partner has implemented and maintains an incident response plan and is prepared to respond immediately to a system breach. Incident management includes: • Definition of roles, responsibilities, and communication and contact strategies in the event of a compromise, including notification of customers, • Specific incident response procedures, • Analysis of legal requirements for reporting compromises, • Coverage of all critical system components, • Regular review and testing of the plan, • Incident management personnel that is available 24/7, • Training of staff, • Inclusion of alerts from all security monitoring systems, • Modification and evolution of the plan according to lessons learned and to incorporate industry developments. Partner has also implemented a business continuity process (BCP) and a disaster recovery process (DRP) that is mainta...
Regular Monitoring and Testing of Networks. All access to network resources and Personal Data is tracked and monitored using centralized logging mechanisms that allow thorough tracking, alerting, and analysis on a regular basis (at least daily) as well as when something does go wrong. All systems are provided with correct and consistent time and audit trails are secured and protected, including file-integrity monitoring to prevent change of existing log data and/or generate alerts in cases of unauthorized access or anomalies of access. Audit trails for critical systems are kept for a year. Security of systems and processes is regularly tested, at least yearly. This is to ensure that security controls for system components, processes and custom software continue to reflect a changing environment. Security testing includes: • Processes to test rogue wireless access points, • Internal and external network vulnerability tests that are carried out at least quarterly. An external, qualified party carries out the external network vulnerability tests, • External and internal penetration tests using Advertiser's penetration test methodology that is based on industry-accepted penetration testing approaches that cover the all relevant systems and include application-layer as well as network-layer tests. All test results are kept on record and any findings are remediated in a timely manner. Advertiser does not allow penetration tests carried out by or on behalf of its customers. In daily operations IDS (intrusion detection system) is used to detect and alert on intrusions into the network and file-integrity monitoring has been deployed to alert personnel to unauthorized modification of critical systems. Incident Management Advertiser has implemented and maintains an incident response plan and is prepared to respond immediately to a system breach. Incident management includes: • Definition of roles, responsibilities, and communication and contact strategies in the event of a compromise, including notification of customers, • Specific incident response procedures, • Analysis of legal requirements for reporting compromises, • Coverage of all critical system components, • Regular review and testing of the plan, • Incident management personnel that is available 24/7, • Training of staff, • Inclusion of alerts from all security monitoring systems, • Modification and evolution of the plan according to lessons learned and to incorporate industry developments. Advertiser has also implemented a business continuity proces...
Regular Monitoring and Testing of Networks. Access to Vendor Network and Personal Data is monitored using mechanisms that allow tracking, alerting, and analysis on a regular basis as well as upon need. • All systems that process Personal Data are provided with correct and consistent time and audit trails, including file-integrity monitoring to prevent change of existing log data and/or generate alerts in such case. Audit trails for critical systems are kept for, at least, one year. • Security of such systems is regularly tested and reviewed at least annually. This is to ensure that security controls for system components, processes and custom software continue to reflect a changing environment. Security testing includes: • Processes to test rogue wireless access points, • Internal and external network vulnerability tests that are carried out at least annually. An external, qualified party carries out the external network vulnerability tests. • External and internal penetration tests using Vendor's penetration test methodology that is based on industry-accepted penetration testing approaches that cover the all systems that process Personal Data and cover application-layer as well as network-layer tests • Test results are kept on record and findings are remediated in a timely manner. • Use of IDS (intrusion detection system) and file-integrity monitoring in daily operations to detect and alert against network intrusions and unauthorized modification or access.
