QAD/PLPM/01

Issue # 02
NISHAT MILLS LIMITED 09/02/2022
Factory Security Manual

CYBER SECURITY
Cybersecurity is the activity or process that focuses on protecting computers, networks, programs, and data
from unintended or unauthorized access, change or destruction. It is the process of identifying, analyzing,
assessing, and communicating a cyber-related risk and accepting, avoiding, transferring, or mitigating it to an
acceptable level, considering costs and benefits taken.
We are committed for comprehensive and documented cyber security policy to protect IT systems with
identify and resolve threats. Policy is reviewed and updated annually.
IT systems have taken following security measures:
1-Password Protection
2-Email
3-Personnel

CYBER INCIDENT: porting: incident@cert.ncb.mu

 A cyber incident is a violation or imminent threat of violation of computer security policies, acceptable use
policies, or standard security practices.
 It is also an even that threatens the confidentiality, integrity, or availability of Information Systems or
institutional data.
 Examples include, but no limited to:
 Attempts (either failed or successful) to gain unauthorized access to a system or its data
 Unwanted disruption or denial of service
 Unauthorized use of a system for the processing or storage of data
 Changes to system hardware, firmware, or software characteristics without the owner's knowledge,
instruction, or consent.
CYBER INCIDENT REPORTING SYSTEM:
 All department supervisors, in-charges of IT Dept. shall report and notify any cyber incident which leads
to suspicious activities, serious property accidents, internal conspiracy, attempted thefts or other crimes
relating to company’s property or personnel to The IT Dept. Head I.e. Manager IT and HR Head.
 Facility will communicate cyber security threats to internal and external business partners, customers,
suppliers, management and government agencies.
 Company Security team of IT department shall investigate all complaints and reports and shall act as a
liaison with the FIA cybercrime wing and other departments.
 Company Security team of IT department shall work closely with the Production Personnel, the office of
Human Resources, and other commercial departments.
 Company Security shall make regular security surveys to identify security problems, and shall make
recommendations to correct deficiencies.
The below mentioned points are well explanatory regarding above measures.

ALERTING AND RESPONDING

When a session matches the conditions in a rule, it responds with a specific action or combination of actions that
alert the appropriate party. The following types of alert and response methods are to be applied.
1. Logging event details
2. Blocking a session
3. Defining a blocking rule
4. Displaying an alert message
5. Adding event details to the NT event log
6. Sending an Email message
7. Adding event details to a file
8. Defining an SNMP trap
9. Defining a rule on Firewall and Malware-1 (upgraded after every 1 hour)
10. Sending a message to an NT workstation
 QAD/PLPM/01
Issue # 02
NISHAT MILLS LIMITED 09/02/2022
Factory Security Manual

BLOCKING
To block specific users from using specific servers, or to block access to the following TCP/IP or UDP based
services including:
1. Email (POP and SMTP)
2. Web browsing (HTTP)
3. News (NNTP)
4. Telnet
5. FTP
In order to block network games (e.g. Doom and Quake) and customized protocols (e.g. IRC and Point Cast), we
have the ability to block or disrupt sessions based on the protocol being used, the origin or destination address,
the URL, or the content. We can block by rule or in real-time in response to an alert. When a session matches the
conditions of a rule, we can also define an action that will dynamically build a new rule to block future sessions
with these properties, or terminate a session when an intrusion is detected or a company security policy is
violated.

WEB USAGE MONITORING AND BLOCKING

We allow users to decide which sites users can access. Using the reports on Web usage, we can choose which
categories (e.g. games and dating services) are not work-related and which sites should be monitored according
to their ratings. Sites categorized as violence, sex, nudity and language can be rated at different levels of
severity.

EMAIL USAGE MONITORING AND RELEVANT RULES DEFINITION

We log all incoming and outgoing Email messages, enabling to view the actual content of the messages. We can
also define rules to log or block details of Email messages from or to specific stations and messages that contain
certain strings of text e.g. abusive language.

IP SECURITY POLICY MANAGEMENT

Nishat has IP Security Policy Management to configure Windows Internet Protocol security (IPSec), a key line of
defense against internal, private network, and external (Internet, extranet) attacks. Although most network
security strategies have focused on preventing attacks from outside the organization's network, a great deal of
sensitive information can be lost by internal attacks that interpret data on the network. Most data is not protected
when it travels across the network, so employees, supporting staff members, or visitors may be able to plug into
your network and copy data for later analysis. Likewise, they can mount network level attacks against other
computers. Firewalls offer no protection against such internal threats, so using IPSec offers significantly greater
security for corporate data.
IPSec is designed to encrypt data as it travels between two computers, protecting it from modification and
interpretation if anyone were to see it on the network. An administrator must first define how the two computers
will trust each other, and then specify how the computers will secure their traffic. This configuration is contained in
an IPSec policy that the administrator creates and applies.
IMPLEMENTED MICROSOFT ISA SERVER
Nishat has implemented Microsoft ISA server as a firewall for both incoming and outgoing traffic. IT dept has
restricted user for specific sites. We have implanted security on internet access. We allow limited users to access
internet and block ports for instant messaging. We have blocked specific ports for spamming and specified
destination sets and protocols for the users.
NML PASSWORD POLICY AND GUIDELINE
This document has been formulated with the following goals in mind:
 To ensure security, reliability and integrity of Nishat Mills Limited systems and network, the systems and
network of NML Clients
 To avoid situations that may cause Nishat Mills Limited to incur System instability and security of the entire
network.
Finally, please note that this policy applies only to NML that carry the NML computer security,
The network of NML is secured using different devices and security firewalls, we use industry-standard Security
polices to protect data transmissions
PASSWORD POLICY
 QAD/PLPM/01
Issue # 02
NISHAT MILLS LIMITED 09/02/2022
Factory Security Manual

Passwords are an important aspect of computer security. They are the front line of protection for
user accounts. A poorly chosen password may result harmful for company and user data all the users are
responsible for taking the appropriate steps, as outlined below, to select and secure their passwords. The
purpose of this policy is to establish a standard for creation of strong passwords, the protection of those
passwords, and the frequency of change. As per this password policy user account information at NML is
password-protected for privacy and security.
SCOPE
The scope of this policy includes all personnel who have or are responsible for an account (or any form of access
that supports or requires a password) on any system that resides at NML
USER RIGHTS
We have assigned rights to each user on database level. User cannot enter, update or delete data records unless
he has the specified rights.
GENERAL
All system-level passwords (e.g., root, enable, NT admin, application administrator user accounts, email
administrator accounts etc.) must be changed on at least a quarterly basis.
All user-level passwords (e.g., email, web, desktop computer, etc.) must be changed at least every three
months. The recommended change interval is every 15 days.
User accounts that have system-level privileges granted through group account or programs such as "oracle"
must have a unique password from all other accounts held by that user.
Passwords must not be inserted into email messages or other forms of electronic communication.
All user-level and system-level passwords must conform to the guidelines described below.

GENERAL PASSWORD CONSTRUCTION GUIDELINES

Passwords are used for various purposes at NML. Some of the more common uses include: user level accounts,
web accounts, email accounts, and local router logins. Everyone should be aware of how to select strong
passwords.
Poor, weak passwords have the following characteristics:
The password contains less than ten characters.
The password is a word found in a dictionary (English or foreign).
The password is a common usage word such as:
 Names of family, pets, friends, co-workers, fantasy characters, etc.
 Computer terms and names, commands, sites, companies, hardware, software.
 The words "<Company Name>", "Nishat", "rafhan" or any derivation.
 Birthdays and other personal information such as addresses and phone numbers.
 Word or number patterns like aaabbb, qwerty, zyxwvuts, 123321, etc.
 Any of the above spelled backwards.
 Any of the above preceded or followed by a digit (e.g., secret1, 1secret)
CHARACTERISTICS OF STRONG PASSWORDS
Strong passwords have the following characteristics:
 Contain both upper and lower case characters (e.g., a-z, A-Z)
 Have digits and punctuation characters as well as letters e.g., 0-9,!@#$ %^&*()_+|~-=\`{}[]:";'<>?,./)
 Are at least ten alphanumeric characters long and is a pass phrase (Ohmy1stubbedmyt0e).
 Is not a word in any language, slang, dialect, jargon, etc?
 Are not based on personal information, names of family, etc.
 Passwords should never be written down or stored on-line. Try to create passwords that can be easily
remembered. One way to do this is create a password based on a song title, affirmation, or other phrase. For
example, the phrase might be: "This May Be One Way to Remember" and the password could be:
"TmB1w2R!" or "Tmb1W>r~" or some other variation.

2) VISITORS/OUTSIDERS
3) All kind of visitors, auditors, contractors, consultants who are not directly employed by the Nishat will not be
allowed to access company electronic computerized database to comply with the complete IT security
measures.
 QAD/PLPM/01
Issue # 02
NISHAT MILLS LIMITED 09/02/2022
Factory Security Manual

APPLICATION USERS POLICY

Application users programs contain the following security precautions.
should not store passwords in clear text or in any easily reversible form.
One user can not take over the functions of another.