|
Different security for terminals in
different locations |
This falls under the domain of physical
security. A terminal located inside a physically secure data
center is less likely to be attacked as opposed to one outside.
This has been discussed in depth in Chapter 4 under the section
for Physical Security. |
|
Comply with Orange Book C2 or better |
This is a security specification
recommended by an independent party. Oracle database and
software is already compliant, so there is no cause of concern
for compliance here. |
|
Account canceled when employee leaves |
This calls for procedural modifications to
the security administration. When an employee leaves, there
should be a well-defined procedure for the help desk to
systematically lock all the accounts used by the employee –
email, domain, and database. Often, mostly due to lack of proper
procedure, the accounts are left open, which can become prime
targets for hackers. |
