ISO/IEC 27001 Control 8.33: Test information
Control
Test information should be appropriately selected, protected and managed.
Necessity of MidPoint
MidPoint's contribution to implementation of this control is marginal.
Implementation of the control is mostly outside the scope of identity governance and administration (IGA), therefore midPoint cannot provide significant advantage. However, midPoint can still provide minor supporting information and functionality.
Implementation Overview
MidPoint provides supporting functionality for test information protection.
Implementation Details
MidPoint can control access both to production environment as well as testing environment in a consistent way, providing overall visibility. E.g. policy rules can be used to find users that have access to both environments, and therefore are able to copy production data to test environment.
Implementation Notes
-
We strongly recommend to apply equivalent security measures to development and test environments as are applied to production environments, which is also suggested by the control. MidPoint can be used to apply security and access control policies consistently across all environments.
-
While midPoint is designed to control access of users to testing environments, midPoint in its current version is not designed for management of testing data. I.e. midPoint can manage access of testers to testing environment, however it is not meant to create accounts that are testing data (e.g. customer accounts). Management of testing data would require special-purpose features, such as anonymisation/pseudonymization and/or other forms of data masking to protect personal information. Some midPoint features can be used for this purpose when customized (e.g mappings). However, such functionality is not provided out-of-the-box. See control 8.11 for more information.
Rationale
MidPoint provides general-purpose access control for all environments, which can provide supporting functionality for test information protection.