ISO 20000:2011

This part of ISO/IEC 20000 is a service management system (SMS) standard. It Specifies requirement for the service provider to plan, establish, implement, operate, monitor, review, maintain and improve an SMS. The requirements include the design, transition, delivery and improvement of service to fulfill service requirements. This part of ISO/IEC 20000 can be used by:

1. An organization seeking services from providers and requiring assurance that their service requirement will be fulfilled.
2. An organization that requires a consistent approach by all its service provider, including those in a supply chain.
3. An service provider that intends to demonstrate its capability for the design, transition, delivery and improvement of service to fulfill service requirements.
4. A service provider to monitor, measure and review its service management processes and service.
5. A service provoder to improve the design, transition and delivery of service through effective implementation and operation of an SMS.
6. An assessor or auditor as the criteria for a comformity assessment of a service provider’s SMS to the requirements in this part of ISO/IEC 20000.

Figure 2 illustrates an SMS, including the service management processes. The service management processes and realitionships between the processes can be implemented in different ways by different service providers. The nature of the relationship between a service provider and the customers wil be influence how the service management processes are implemented.

DOWNLOAD

Read More

ISO/IEC 17021:2011

Certification of management systems (named in this International Standard “certification”) is a third-party conformity assessment activity (see ISO/IEC 17000:2004, 5.5). Bodies performing this activity are therefore third-party conformity assessment bodies (named in this International Standard “certification body/bodies”).

5.1.1 Legal responsibility
The certification body shall be a legal entity, or a defined part of a legal entity, such that it can be held legally responsible for all its certification activities. A governmental certification body is deemed to be a legal entity on the basis of its governmental status.

5.1.2 Certification agreement
The certification body shall have a legally enforceable agreement for the provision of certification activities to its client. In addition, where there are multiple offices of a certification body or multiple sites of a client, the certification body shall ensure there is a legally enforceable agreement between the certification body granting certification and issuing a certificate, and all the sites covered by the scope of the certification.

5.1.3 Responsibility for certification decisions
The certification body shall be responsible for, and shall retain authority for, its decisions relating to
certification, including the granting, maintaining, renewing, extending, reducing, suspending and withdrawing of certification.

5.2 Management of impartiality
5.2.1 The certification body shall have top management commitment to impartiality in management system certification activities. The certification body shall have a publicly accessible statement that it understands the importance of impartiality in carrying out its management system certification activities, manages conflict of interest and ensures the objectivity of its management system certification activities.

5.2.2 The certification body shall identify, analyse and document the possibilities for conflict of interests arising from provision of certification including any conflicts arising from its relationships. Having relationships does not necessarily present a certification body with a conflict of interest. However, if any relationship creates a threat to impartiality, the certification body shall document and be able to demonstrate how it eliminates or minimizes such threats. This information shall be made available to the committee specified in 6.2. The demonstration shall cover all potential sources of conflict of interests that are identified, whether they arise from within the certification body or from the activities of other persons, bodies or organizations.

DOWNLOAD

Read More

ISO 19011:2011

This International Standard provides guidance on auditing management systems, including the principles of auditing, managing an audit programme and conducting management system audits, as well as guidance on the evaluation of competence of individuals involved in the audit process, including the person managing the audit programme, auditors and audit teams.

It is applicable to all organizations that need to conduct internal or external audits of management systems or manage an audit programme. The application of this International Standard to other types of audits is possible, provided that special consideration is given to the specific competence needed.

Auditing is characterized by reliance on a number of principles. These principles should help to make the audit an effective and reliable tool in support of management policies and controls, by providing information on which an organization can act in order to improve its performance. Adherence to these principles is a prerequisite for providing audit conclusions that are relevant and sufficient and for enabling auditors, working independently from one another, to reach similar conclusions in similar circumstances.

DOWNLOAD
^ Dead link

Update Link:
Here

Read More

ISO-IEC 31010-2009

ISO 31010:2009 ini adalah tentang "Risk Management". Berikut link untuk melakukan download:

http://www.indowebster.com/iso_iec_31010_2009.html

Read More

ATM Dengan IP Address

ATM adalah kepanjangan dari Automatic Teller Machine yang berfungsi untuk melakukan penarikan uang atau transfer uang dan berbagai fungsi lainnya. Manusia pada jaman ini sangat bergantung sekali dengan mesin tersebut. Dengan ketergantungan ini, maka pasti ada sisi positif dan negatifnya.

Pada tahun 2009 dan 2010, di Indonesia dihebohkan dengan Skimmer dan saat ini juga banyak sekali fraud yang terkait dengan ATM atau alat transaksi yang menggunakan Debit Card / Credit Card. Dengan perkembangan jaman, menurut saya sangat wajar apabila terjadi hal-hal yang kita tidak inginkan.

Banyak contoh-contoh penipuan dengan modus-modus seperti:

1. Perusakan mesin ATM dengan berbagai cara sehingga menyebabkan apabila User memasukkan Kartu akan tersangkut atau tidak bisa melakukan kegiatan di ATM tsb dan si penjahat tersebut sudah menempelkan stiker pemberitahuan yang berisikan bahwa apabila terjadi kerusakan pada mesin ATM dapat menghubungi nomor yang tertera pada mesin tersebut. Dilapangan hal ini banyak terjadi dan sebenarnya itu adalah stiker ilegal yang dengan sengaja ditempelkan dengan niat buruk. Jadi apabila si User menelfon ke nomor tsb, si penjahat akan berpura-pura menjadi Call Center dan ujung2nya akan mencuri banyak informasi Nasabah dan Kadang2 malah minta PIN ATM tsb.
2. Pemasangan alat Skimmer dan alat tsb harganya tidak mahal sekali euy. Waktu itu saya sempat liat di Internet yang menjual alat tsb dengan harga kurang lebih 1 jutaan. Kenapa alat ini bisa terpasang dengan mudah ? Menurut saya pihak pemilik ATM tsb tidak melakukan monitoring ATM-nya secara rutin. Seharusnya disetiap ATM terpasang CCTV agar bisa dimonitoring aktifitas yang ada sehingga tidak terjadi hal-hal seperti itu.
3. Fraud yang dilakukan oleh internal pemilik atau pengisi uang ATM tsb. Banyak modus yang dapat dilakukan dan saya tidak akan membahasnya disini dikarenakan bakal panjang, klo mau bisa langsung menghubungi saya saja.

Sesuai dengan judul yang ada, manfaat ATM dengan menggunakan IP Address adalah:

• Dapat memonitor secara langsung aktifitas terkait mesin ATM. Contoh ATM tersebut sedang diisi uang, kerusakan pada salah satu hardware, dll.
• Koneksi menjadi lebih stabil dibandingkan dengan SNA.
• dll.

Akan tetapi dengan menggunakan IP juga mempunyai celah keamanan, seperti:

• Flooding / DDOS.
• Pengiriman Worm, Trojan, Backdoor dan sejenisnya.
• Interception informasi yang mengalir pada mesin ATM.
• dll

Untuk menghindari hal tersebut, maka harus dibuat SOP/Policy yang baik. Kemudian harus ada bagian yang selalu monitoring aktifitas ATM. Jangan hanya monitoring saja, tapi dilakukan review secara periodik atas LOG ATM tersebut. Memang ini tugas yang agak berat tapi nanti hasil yang didapatkan sangat setimpal. Pastikan bahwa antivirus, firewall, ids/ips sudah diaktifkan dan digunakan secara maksimal.

Mungkin ke depannya mesin ATM pun tidak begitu laku tapi saya berpikir yang akan maju adalah mesin EDC. Jadi orang tidak akan capek2 membawa uang tunai tapi cukup membawa segenggam kartu saja. Kali aja nanti untuk bayar taksi, bus, angkot, belanja di warung dan aktifitas lainnya dapat menggunakan mesin EDC. Klo hal itu terjadi, pasti asik sekali yah. Sekian dulu sharing dari saya dan semoga ada manfaatnya walau cuman sedikit :-).

Read More