1. Scope of the ISMS
L’abast del sistema de gestió de seguretat de la informació (SGSI) cobreix tots els serveis prestats per Intergrid (Opengea SCCL), incloent:
- Cloud Hosting, Dedicated Hosting and VPS.
- Registration and management of domains.
- Cloud-based web applications.
- Physical infrastructure hosted in advanced Data Centers in Germany, Finland, United States and Singapore, and fully managed by Intergrid from Barcelona.
2. Information Security Policy
Intergrid is committed to protecting the confidentiality, integrity, and availability of its own information and that of its clients, through appropriate technical and organizational controls, continuous risk assessment, and continuous improvement of the ISMS.
3. Risk Analysis and Treatment Methodology
- Identificació d’actius, amenaces i vulnerabilitats.
- Avaluació d’impacte i probabilitat (Alt, Mitjà, Baix, Nul).
- Assignment of measures and controls to reduce risks.
- Documentation of residual risk and responsible party.
4. Declaració d’aplicabilitat (SoA)
This statement certifies the commitment and actual implementation of the requirements of the ISO/IEC 27001:2022 standard through a responsible declaration by the organization.
S’han seleccionat i aplicat controls de l’annex A de la norma ISO/IEC 27001 segons l’avaluació de riscos. Incloent:
- A.5: Polítiques de seguretat
- A.6: Organització de la seguretat
- A.8: Gestió d’actius
- A.9: Control d’accés
- A.12: Seguretat operativa
- A.13: Seguretat de les comunicacions
- A.15: Relacions amb proveïdors
- A.16: Gestió d’incidents de seguretat
- A.17: Continuïtat del negoci
5. Security Objectives
- Prevent data leaks from hosted web services
- Assegurar l’autenticació i accés legítim a sistemes
- Ensure complete and available backups
- Ensure compliance with the GDPR
6. Key Records
- Registre d’actius i responsabilitats
- Security Training Record
- Security incidents
- Internal audits and management reviews
7. Specific Procedures
Gestió d’incidents de seguretat
Tots els incidents s’han de reportar immediatament al responsable del SGSI. Es documentaran en el registre d’incidents i es realitzarà una anàlisi per identificar causes, impacte i accions correctives.
Control d’accessos
- Access limited according to roles and needs
- Strong Authentication: complex keys and 2FA
- Periodic review of permissions
Backup Policy
- Automatic daily and weekly backups
- Replication in Multiple Data Centers (independent physical locations)
- Regular restoration tests
Política d’ús acceptable
Els usuaris i tècnics només poden utilitzar els recursos d’Intergrid per a finalitats autoritzades. Qualsevol ús abusiu, il·legal o que comprometi la seguretat serà objecte de sanció.
Third-party and supplier management
- Confidentiality agreements with collaborators
- Control de l’accés dels proveïdors a sistemes interns
- Periodic review of subcontracted services
Business continuity
- Georedundant backups and constant monitoring
- Disaster recovery procedures
- Assignment of key roles in crisis situations
Audits and continuous improvement
- Periodic internal audits of the ISMS
- Review of policies and procedures
- Registre d’accions correctives i de millora
Device and equipment management
- Inventari actualitzat d’equips i dispositius
- Screen lock policy and disk encryption
- Limitació de l’ús de dispositius externs (USB, etc.)
Email Security
- Filtering of suspicious emails (spam, phishing)
- Configuration of SPF, DKIM, and DMARC
- Restriccions d’enviament i revisió de campanyes
Classification and handling of information
- Labeling according to sensitivity (confidential, internal...)
- Distribution restrictions according to classification
- Secure destruction of obsolete information
Training and awareness
- Periodic training sessions on safety
- Awareness campaigns for all staff
- Periodic phishing simulation tests
Management of records and evidence
- Record preservation during the period established by regulations
- Access control to confidential records
- Integrity and availability guaranteed through redundant systems
Specific policies for projects and clients
- Assignment of security managers for project
- Limited privacy controls and sharing according to contracts
- Security validation before deploying services to clients
Aquesta documentació és bàsica i extensible segons l’evolució del SGSI. Es recomana revisar-la com a mínim anualment o després d’incidents significatius.
Risk Analysis (ISMS - ISO 27001)
Empresa: Intergrid (Opengea SCCL)
Translation: \"Date:\" 15-10-2024
Scope: Serveis de hosting (cloud, dedicat, VPS), dominis i aplicacions web.
| ⚠️ Actiu | Amenaça | Vulnerabilitat | Impacte | Probabilitat | Nivell de risc | Mesures aplicades | Risc residual | Responsable |
|---|---|---|---|---|---|---|---|---|
| Access to servers | Unauthorized access | Open ports / uncontrolled access | High | Null | Null | IP filtering, SSH key, 2FA, fail2ban | Very low | Systems Technician |
| Databases | Data leak | Unparameterized SQL | High | Baixa | Low | ORM, access control, audit | Very low | Backend Developer |
| Control Panel | Service outage | DDoS Attack | Medium | Average | Medium | Cloudflare, connection limitation | Low | DevOps |
| Backups | Data loss | Non-replicated copies | High | Average | High | Redundant backups in multiple locations | Low | Systems Technician |
| E-commerce service | Fraudulent modification | Nonexistent logs | High | Average | High | Active monitoring, alerts, auditing | Medium | Web development |
| DNS and domains | Manipulation of records | Exposed API Key | High | Baixa | Medium | Key regeneration and access control | Low | Domain Admin |
| Web d\'usuari | Identity theft | Weak authentication | High | Average | High | 2FA, attempt limitation, captchas | Low | Frontend Developer |
| Spam / phishing | Weak content validation | High | Average | High | SPF, DKIM, DMARC, Spamassassin, log review | Low | Correu | |
| Remote access of staff | Improper access | VPN without MFA | Medium | Average | Medium | VPN with MFA, restricted by IP | Low | Systems Technician |
| Internal Applications | Execution of unauthorized code | Absence of version control | High | Baixa | Medium | Version control, supervised deployment | Low | DevOps |
| Payments | Access or manipulation of payment data | Delegation to third parties without sufficient control | High | Baixa | Medium | Ús de Stripe com a plataforma PCI-DSS compliant; no s’emmagatzemen dades sensibles localment | Low | Legal / Technical Web Manager |
| Third-party software | Execution of malicious code | Lack of updates | High | Average | High | Periodic updates, vulnerability control (CVE) | Medium | DevOps |
| Human errors | Accidental deletion | Lack of training / incorrect permissions | Medium | Average | Medium | Training, reviews, limited permits | Low | All employees |
| Critical configurations | Malicious configuration injection | There is no automatic validation | High | Baixa | Medium | Configuration audits, automatic tests | Low | DevOps |
| Version control | Introduction of insecure code | Lack of review of changes or tests | High | Average | High | Peer review, continuous integration, automated tests | Medium | DevOps |
| Administration Portals | Illicit access | Publicly exposed interface | High | Baixa | Medium | IP-restricted access, 2FA, access logs | Low | Infrastructure |
| System updates | Exploitation of known vulnerabilities | Delay in patch application | High | Baixa | Medium | Periodic updates, vulnerability scanners | Low | Systems Technician |
| Custom Development | Leaks of sensitive data | Lack of input validation and sanitation | High | Average | High | Application of OWASP guides, training for developers | Low | Backend Developer |
| External providers | Critical dependence | Lack of SLA contracts or agreements | Medium | Average | Medium | Service Level Agreements (SLA), continuity analysis | Medium | Direction |
| Security logs | Omissió de proves en cas d’incident | Rotation or premature erasure | Medium | Average | Medium | Safe and controlled retention, restricted access, SIEM | Low | Systems Technician |
| Digital identities | Suplantació d’usuaris | Lack of account lifecycle management | High | Baixa | Medium | Automated provisioning and deactivation, periodic review | Low | ISMS Manager |
| Hiring of staff | Breach of confidentiality | Absence of NDA or prior training | Medium | Baixa | Low | Clàusules NDA, formació de benvinguda, control d’accés inicial | Very low | Direction |
| Public DNS server | Malicious redirection | Incorrect configuration of zones or registers | High | Baixa | Medium | Periodic review of areas, restricted access, change log | Low | Domain Admin |
| Sessions d’usuari | Undue persistence | No automatic expiration | Medium | Alta | High | Automatic expiration, inactive session logout | Low | Web development |
| System updates | Exploitation of known vulnerabilities | Postponed or incomplete updates | High | Average | High | Gestió centralitzada d’actualitzacions, proves abans de desplegar | Medium | DevOps |
| API Interfaces | Unauthorized access to data | Manca de control d’autenticació o quotes | High | Average | High | Tokens with expiration, IP limitation and strong authentication | Low | Backend Developer |
| Pre-production environments | Exhibition of real data | Replicated database with sensitive data | High | Baixa | Medium | Anònims, entorns separats, restriccions d’accés | Low | DevOps |
| Remote technical support | Filtració d’informació confidencial | Sessions not registered or monitored | Medium | Baixa | Medium | Canals segurs, registre d’activitat, limitació d’accés temporal | Low | Helpdesk |
| Document Management | Unauthorized access to internal documents | Uncontrolled shared files | Medium | Alta | High | Platform with granular permissions, review of shares | Low | ISMS Manager |
Information Security Policy (ISMS)
Empresa: Intergrid (Opengea SCCL)
Approval date: 15-10-2024
Approved by: Direcció Tècnica
- Objective: Garantir la Confidentiality, integrity and availability de la informació, dades de clients i sistemes.
- Scope: Tota la infraestructura de hosting i aplicacions desenvolupades o allotjades per Intergrid.
- Commitment: Aplicació del marc ISO/IEC 27001.
- Responsibility: Compliment per tot el personal.
- Key measures:
- Control d'accés per rol i 2FA
- Segregated backups
- Incident Monitoring
- Annual risk assessment
- Training and awareness
- Translation: \"Review:\" Anual.
Statement of Applicability (SoA) - ISO 27001
Translation: \"Date:\" 15-10-2024
Responsible for the ISMS: Jordi Berenguer / Director tècnic
| Control (Annex A) | Títol | Aplicable? | Estat | Comentaris |
|---|---|---|---|---|
| A.5.1 | Security policy | Sí | Implanted | Published and reviewed |
| A.5.11 | Data usage | Sí | Implanted | Client dropouts |
| A.6.1 | Security organization | Sí | Implanted | Defined roles |
| A.6.3 | Remote work | Sí | Implanted | VPN and encrypted laptops |
| A.7.1 | Backups | Sí | Implanted | Redundant backups |
| A.8.1 | Access Control | Sí | Implanted | ACLs and strong authentication |
| A.8.16 | Supervision of activities | Sí | Partial | In deployment |
| A.12.1 | Security applications | Sí | Implanted | OWASP, code review |
| A.14.1 | Secure communications | Sí | Implanted | HTTPS, SFTP |
| A.18.2 | Internal Audit ISMS | Sí | Planned | Q4 2025 |
Version: 4.8 — Last review: 15-10-2024
