|
|
____________________________________________________________ SOUTHSIDE VIRGINIA COMMUNITY COLLEGE INFORMATION TECHNOLOGY SECURITY POLICIES ____________________________________________________________
2009
Status: Approved 10-16-08 Introduction:
The SVCC IT Security Plan will meet the following objectives:
SVCC must take appropriate steps to ensure its information systems are properly protected. All SVCC information systems shall be protected, regardless of storage or transmission medium.
The SVCC Security Plan is predicated on the following concepts: 1. Information security is the responsibility of each individual employee. 2. All information access is granted on the basis of “least privilege” only.
The security policies and procedures given in this document were promulgated based on the concepts given above.
SVCC IT Security Roles:Information technology security roles are assigned to individuals to ensure accountability and compliance among the information technology processes. The role or working title and assignment of personnel for each security role may differ at each college however it is critical that each function be identified and the individuals assigned have the appropriate skill sets. Individuals may be assigned multiple roles, as long as the multiple role assignments provide adequate separation of duties, provide adequate protection against the possibility of fraud, and do not lead to a conflict of interests. All roles are designated and approved by SVCC management as part of the Business Impact Analysis and Risk Assessment processes. Each employee’s IT security role will be reviewed and evaluated for accuracy, and updated annually on the Employee Work Profile (EWP) by the appropriate supervisors. SVCC IT Security Roles, Section B1, SVCC Security Plan. SVCC Information Security Officer: The SVCC ISO shall:
Other Security Roles:System Administrators: The System Administrator is an analyst, engineer, or technician who implements, manages, and/or operates a system or systems. The System Administrator assists College and System Office management in the day-to-day administration of the IT systems, and implements security controls and other requirements of the local IT security program on IT systems for which the System Administrator have been assigned responsibility. System administrators will be so designated on their SVCC Employee Work Profiles (EWP). Security Administrator: The Security Administrator manages security controls over networks and systems to prevent improper or unauthorized use of data. Security administrators will be so designated on their SVCC Employee Work Profiles (EWP). As a part of the AIS and SIS security model VCCS provides a special set of permissions, often described as the "Super User" role, which has access to all panels (navigations) available in the system except those supporting security administration and the “Enrollment” panel. The role as defined also permits those who are assigned this role full authority to read, change, and delete the information stored in the associated databases. Superusers will be so designated on their SVCC Employee Work Profiles (EWP). IT System Users: System users will be so designated on their SVCC Employee Work Profiles (EWP). Users are defined as COV employees having access to an information system or its data and not specifically given any other IT security role. Privacy Officer: (Jan 2010 Revision)
An agency must have a Privacy Officer if required by law or regulation, such as the Health Insurance Portability and Accountability Act (HIPAA), and may choose to have one where not required. The Privacy Officer provides guidance on: a. The requirements of state and federal Privacy laws. b. Disclosure of and access to sensitive data. c. Security and protection requirements in conjunction with IT systems when there is some overlap among sensitivity, disclosure, privacy, and security issues.
System Owner: The System Owner is the manager responsible for operation and maintenance of an IT system. System Owners will be so designated on their SVCC Employee Work Profiles (EWP). Data Owners: Data Owners are the entity, group or individual that has ultimate responsibility for the creation and modification of information stored in a database or other system. The data owner is responsible for ensuring that the System Owner has implemented sufficient security in the system platform to safeguard the applications and data stored on that server. Data Owners will be so designated on their SVCC Employee Work Profiles (EWP). Information Technology Security PoliciesThe SVCC Security Plan requires that good management practices be followed to implement information technology security safeguards based on the SVCC IT Risk Assessment and Business Impact Analysis. During the BIA and RA processes, data sensitivity (IT System and Data Sensitivity Classification), hardware and software resources, categorization and classification of data, and associated potential damages are addressed. Also, mission critical systems, allowable downtimes, manual processes and responsible personnel are identified. (Sections B2-B5, SVCC Security Plan) SVCC requires the participation of the System Owners and Data Owners in the development of the Business Impact Analysis. It is the responsibility of the System and /or Data Owners to provide accurate and detailed information for the specific business processes within their particular business unit. The SVCC Security Plan and associated policies is a dynamic document which must be reviewed at least annually and updated every three years. The following is a list of requirements for all information systems maintained at SVCC. Purpose: Maintain compliance with the COV ITRM Standard SEC501-01 and applicable VCCS IT Security standards. Scope: These policies are applicable to all SVCC students, employees, and /or contractors, consultants and third parties working on behalf of SVCC.Enforcement: Enforcement of SVCC Security Policy shall be performed as specified in the Enforcement Procedure section of the VCCS Personnel Security, Acceptable Use Standard. 1.1 Exemptions from Applicability: The following are explicitly exempt from complying with the requirements defined in this document: (as per COV ITRM Standard SEC501-01, Section 1.6, July 1, 2007 Revision 3)
Definitions: Sensitive data: Personal Health Information (PHI) or Personally Identifiable Information (PII) (a combination of a first name, or first initial, last name, and any of the following: financial account number, credit or debit card number and/or the corresponding password, security, or access code, social security number, drivers license number, identification card number, insurance data, or date of birth.) VITA definition of sensitive data may be found at: http://www.vita.virginia.gov/security/default.aspx?id=327 Academic Instruction and Research Systems: Those systems used by institutions of higher education for the purpose of providing instruction to students and/or by students and/or faculty for the purpose of conducting research. The VCCS is defining “Academic Instruction and Research Systems” as those used in the classroom by students and/or faculty for instructional purposes, and those systems used in a lab environment by students and/or faculty for the purpose of research in support of instruction. Further defined as those systems, applications, services, and related IT infrastructure that support the classrooms, student labs, and other instructional space for the purpose of instruction or research in the aid of instruction which are not used to access and/or store college administrative information. These exceptions do not apply to administrative systems (systems that access, process, or store college administrative information) that are used in the business operation of the college. It is important for the VCCS to define a separation of academic and administrative systems to ensure the highest level of security for the college and the VCCS enterprise while enabling the needs of instruction since the VCCS as an institution falls under the scope of applicability of the SEC501-01 Standard. 1.2 Exceptions to Security Requirements: (Jan 2010 Revision)
If an Agency Head determines that compliance with the provisions of this Standard or any related information security standards would adversely impact a business process of the agency, the Agency Head may request approval to deviate from a specific requirement by submitting an exception request to the CISO. For each exception, the requesting agency shall fully document:
Each request shall be in writing to the CISO and approved by the Agency Head indicating acceptance of the defined unmitigated risks. Included in each request shall be a statement detailing the reasons for the exception as well as mitigating controls and all unmitigated risks. Requests for exception shall be evaluated and decided upon by the CISO, and the requesting party informed of the action taken. An exception cannot be processed unless all unmitigated risks have been identified and the Agency Head has approved, indicating acceptance of these risks. Denied exception requests may be appealed to the CIO of the Commonwealth through the CISO. The form that Agencies must use to document exception requests is included in the Appendix to the SEC501 rev 5 document.
2.1 Continuity of Operations: SVCC shall address the development, implementation, exercise, and maintenance of the Continuity of Operations Plan as it relates to IT systems and data. The plan must be reviewed and updated annually, and identify the employees responsible for the plan. (Section C1, SVCC COOP Plan, Recovery Strategies)
3.1 Disaster Recovery Plan: SVCC must establish and document a Disaster Recovery Plan relating to its IT systems and related applications. (Section C 2, SVCC Disaster Recovery Plan, SVCC Emergency Procedures) The plan should address the following issues:
SVCC shall apply appropriate baseline security configurations to all IT systems. (Systems Hardening) SVCC IT Network Administrators are tasked with developing, implementing, maintaining, monitoring systems for security baselines and policy compliance, (Jan 2010 Revision) and documenting for audit purposes all security configurations. For IT systems that have been identified as high risk or that contain sensitive and confidential data, security configurations should be more restrictive. All security configurations must be reviewed annually by the SVCC IT staff and SVCC Security Committee. Review results will be documented and maintained by the college ISO. A Firewall should be placed between each campus network and the Verizon / VCCS WAN which provides SVCC with Internet access. Security logging shall be enabled on the firewall. At least once per year, a vulnerability scan will be done from outside the firewall. Results of the scan shall be documented by SVCC IT staff and forwarded to the College ISO. Where possible, individuals shall use only encrypted means of access across the Internet. Where this is not possible, individuals shall not pass sensitive college information. Encryption methods shall use at least 128 bit encryption keys, with large encryption keys preferred. Dial-in access to the SVCC network shall be strictly controlled. A list of all modems connected to the SVCC network shall be kept by SVCC IT Network Services. No modems shall be connected to the SVCC network without prior approval of the SVCC IT Network Administrators. The list of modems shall also specify which modems are granted dial-in access. 4.1.1 Phone System Security: The phone system is meant primarily to handle the business needs of SVCC. To this end, personal use of the college phone system should not interfere with the business operations of SVCC 4.1.2 Wireless Security: (Jan 2010 Revision) All SVCC wireless networking will be installed, maintained and monitored by the SVCC Information Technology Network Services department. No wireless networking equipment shall be installed by anyone other than these personnel, unless prior written approval is received from the IT Network Administrator. Monitoring shall be done to ensure that no rogue access points are installed. Any wireless equipment found that was not installed by Network Services, shall be removed immediately by Network Services staff. Access to the SVCC network through wireless equipment will be done using the authentication mechanisms comparable to that of the wired network. Non-COV owned devices shall not connect to the SVCC wireless production network. Access to the SVCC WLAN will be granted following the SVCC WLAN Access Procedure. Legal disclaimer shall be placed on all network access points. Disclaimers shall be set up as a logon banner upon network logon and as a link on the SVCC website home page. Workstation/Server Logon Banner: Clicking “OK” below indicates you have read and agree to the terms of the Information Technology Ethics Agreement and further consent to monitoring of your activities by technical support personnel during routine diagnostics of college-owned equipment. You can view the Acceptable Use Agreement from the of the College’s home page at: http://www.southside.edu/about/general/infosecurity/compethics.asp Web Disclaimer : Should any SVCC web site user discover something out of date, please contact the individual author at the email address given at the web site. If a user notices something in conflict with SVCC or VCCS policy, regulations or statutes of the Commonwealth of Virginia, or federal policy or law, please contact the College Webmaster and the individual author. Please see disclaimer at: http://www.southside.edu/privacy.as Router Logon Banner: “State law (article 7.1 of title 18.2 of the Code of Virginia) classifies damage to computer hardware or software (18.2-152.4), unauthorized examination (18.2-152.5) or unauthorized use (18.2-152.6) of computer systems as (misdemeanor) crimes. Computer fraud (18.2-152.3) and use of a computer as an instrument of forgery (18.2-152.14) can be felonies. The VCCS’ internal procedures for enforcement of its policy are independent of possible prosecution under the law.” 4.1.4 Malicious Code Protection: SVCC will inform employees of their responsibility concerning malicious programs via security awareness and training and explicitly prohibit: Intentional development or experimentation with malicious programs, and the intentional propagation of malicious programs. This may be distributed via syllabus, signage, VCCS email accounts, or College web sites. SVCC will strive to provide protection against malicious programs by using detection, protection, elimination, logging, and reporting capabilities.
4.1.5 Systems Interoperability:
SVCC shall require security agreements for sharing system information with other systems or data owners. A system interconnection may be defined as the direct connection of IT systems for the purpose of sharing data. This does not include instances where data is shared via tape or file exchanges. Note: SVCC only connects to enterprise systems and applications owned by the VCCS; no other system interoperability is required.
4.1.6 IT Systems Development Life Cycle: In accordance with the COV ITRM 501-01, SVCC should document the security related activities that must be adhered to in each phase of the development life cycle for College IT systems. Best practices for system development life cycle security are listed in Section D 4 of the SVCC Security Plan to assist in guiding the System Office and Colleges from project definition through disposal of IT application systems.
In compliance with the COV ITRM SEC-501-01 standards, certain aspects of the SVCC Security Plan must be reviewed, evaluated, and /or updated on an annual basis. The completion of these tasks collectively will be considered the SVCC internal audit of its Information Technology Security Plan. A list of these annual events, deliverables, completion dates, and personnel responsible is given in the SVCC Security Plan, Section B6, IT Security Audits. 4.1.8 Application Security: (Jan 2010 Revision) Application security requirements define the high-level specifications for securely developing and deploying Commonwealth applications. (SVCC Security Plan, Section D 6, Application Security) The SVCC IT Network administrator will be responsible for satisfying the requirements of this standard and maintaining auditable documentation for the same: 4.1.9 Patch Management: All operating system and application software patches and /or upgrades must be performed by, documented, and monitored for compliance by SVCC IT network staff only. These changes will be done as per the requirements of the SVCC Systems Hardening, Software Licensing 11.1.1, and Change Management 11.1.3 security policies.
Each System Owner of a Sensitive IT system shall:
assessment. This documentation shall include a description of: a. All IT existing and planned IT security controls for the IT system, including a schedule for implementing planned controls; b. How these controls provide adequate mitigation of risks to which the IT system is subject.
Head or designated ISO disapproves the IT System Security Plan, and resubmit the IT System Security Plan to the Agency Head or designated ISO for approval.
5.1 Logical Access Control:Southside Virginia Community College (SVCC) may provide user accounts for all faculty, staff, adjuncts and part time employees of the college as necessary and proper. Accounts issued to users are for college use only and will be audited for misuse. Access to all SVCC network servers, including but not limited to; domain controllers, phone system servers, voice mail servers, email servers, file servers, web servers, ftp servers, terminal servers, print servers and any general purpose server or workstation, and network hardware shall require a username and password, with the following exception:
All SVCC systems will be configured to allow least privilege access to users. NTFS permissions will be used to ensure that users will not have access to any system which is not part of their job function. Simply stated, remote access is the ability to get access to a computer or a network from a remote distance. Security measures for remote access shall be implemented by SVCC IT Network Service staff based on sensitivity and risk to System Office or College IT systems and data.
5.1.2 Authentication: The identity of each individual who accesses college information, must be verified before access is given to the information. This identification process is normally performed using the user ID/password process. The user ID determines who the user is claiming to be. The submission of a correct password is taken to mean that the person is actually who the user ID claims them to be.
In addition, to maintain good security, individual passwords should not have any relationship to other passwords in use. That way if an attacker obtains one password, they will not be able to gain access to other passwords maintained by the same person. Passwords should not be accessible by anyone except by the owner of the password. Passwords should be changed regularly.
5.1.4 Account Creation / Authorization:
All sensitive information shall be labeled either [confidential] or [internal use only] in the document containing the sensitive information; confidential and internal use only documents are not accessible to the general public. Data Custodians are individuals or organizations in physical or logical possession of data for Data Owners. All SVCC employees will be the Data Custodians responsible for protecting the data in their possession from unauthorized access, alteration, destruction, or usage.
VCCS allows flexibility in meeting this requirement based on approval from Tech Council. Colleges who have a legitimate need for flexibility in complying with this requirement must complete form VCCSITSEC002 providing the justification.
6.1.1 Redundancy and Tape Backups:
6.1.3 Protection of Sensitive Information on Non- Electronic Media: (Jan 2010 Revision) This section outlines the best practice steps that should be taken to protect sensitive Commonwealth information that may be stored on non-electronic media such as, the spoken word, paper documents, white or black boards, photographs, etc.
Recommended Practices
These recommendations apply to non-electronic media:
1. While in use, limit access on a need to know basis by physically controlling access. Forexample, sensitive documents printed to a global printer should be retrieved without delay.
2. While not in use, store in a secure location with appropriate physical controls.
3. When no longer needed, securely destroy using appropriate destruction methods such as erasingwhiteboards and shredding paper.
7.1 Facilities Security:
8.1 Personnel Security:1. The Virginia Employee Standards of Conduct and Performance specifically includes unauthorized use or misuse of state records, falsification of records, the willful or negligent damage or defacing of records and records theft as violations. 2. The Government Data Collection and Dissemination Practices Act (formerly the Virginia Privacy Protection Act of 1976) specifically requires that State agencies and institutions take affirmative action to establish rules of conduct and to inform employees involved in the design, development, operation or maintenance of an information system that misuse of personal information, or failure to take steps to ensure that information is accurate and reliable, may result in the individual employee being subject to injunction and assessed the costs of court action. 3. The Virginia Computer Crimes Act (Code of Virginia § 18.2) imposes both misdemeanor and felony violations for the unauthorized viewing, copying, alteration or destruction of computer data, software or programs.
Therefore, SVCC has the following personnel security measures in place:
8.1.1 Security Awareness and Training:All SVCC employees involved with information technology must be aware of their security responsibilities and know how to fulfill them. Accordingly, SVCC has set up the SVCC Security Awareness and Training program. The program is implemented by using the Managed Ongoing Awareness Tools (M.O.A.T.) program. All employees at SVCC shall receive security awareness training. New employees must complete this training within 30 days from initial reporting date. If after 30 days, the user has not completed the training; their account will be disabled until the training is completed. All employees will be required to receive refresher training at least once per year. Users will be notified via email when they need to take the refresher training. After notification, users will have 30 days to complete the Security Awareness Training. If after 30 days, the user has not completed the training; their account will be disabled until the training is completed. All employee progress and certification status is monitored and tracked by the M.O.A.T. application which can generate reports based on various search criteria. The employee must also verify electronically that they have completed the training course. Upon successful completion of the course, the employee may print a hard copy of a program completion certificate.
http://www.southside.edu/student/infosecurity/tipofmonth.asp http://inside.southside.edu/security/security_awareness.asp
9.1 Network Usage Policy
9.1.1 Privacy:
9.1.2 Email Communications:
9.1.3 Electronic Communications: The Virginia Community College System is committed to using available technology to communicate among members of the campus communities and recognizes an expanding reliance on electronic communication among all VCCS constituencies. The VCCS will define the proper use of electronic communications, and ensure that:
and business activities are minimized.
10.1 Threat Management:
10.1.2 Security Monitoring and Logging: All actions relative to system security must be documented by SVCC IT Network Administrators. SVCC information systems will meet the following requirements:
Note: For investigative purposes, the CISO or ISO has the responsibility to authorize monitoring orscanning activities for network traffic; application and information access; user commands; emailand Internet usage; and message and information content for IT systems and data. As noted above,the use of key-stroke logging is prohibited, except when required for security investigations and adocumented business case outlining the need and unmitigated risk has been approved in writing bythe Agency Head. The CISO and the ISO shall notify each other when appropriate. (Jan 2010 Revision)
10.1.3 Threat Detection/Incident Handling: In accordance with the COV ITRM 501-01, incident handling is necessary to detect incidents, minimize loss, mitigate weaknesses and restore System Office and College resources promptly and efficiently. . Each agency shall document IT security incident handling practices and where appropriate the agency shall incorporate its service provider’s procedures for incident handling. (Jan 2009 Revision) Incident handling involves having the necessary tools and resources in place to appropriately handle an incident. The SANS Institute defines an incident as “An adverse event in an information system and/or network, or the threat of the occurrence of such an event. Incident implies harm or the intent to do harm.”
Note: The CISO, in conjunction with the Agency Head through the agency ISO or other Administration authorities as necessitated by circumstances, may authorize the confiscation and removal of any IT resource suspected to be the object of inappropriate use or violation of laws, regulations, policies or standards in order to preserve evidence that might be utilized in forensic analysis of a security incident. (Jan 2010 Revision)
10.1.4 Incident Response Team : SVCC must designate an Incident Response Team that includes personnel with the appropriate expertise and authority to respond to each phase of an incident report.
The SVCC team consists of the following personnel: Lydia Ramsey , IT Network Administrator: Daniel Campus Marysue Lewis , IT Network Administrator: Christanna Campus Dale Wooding, Buildings and Grounds Supervisor: Daniel Campus Roger Wray, Buildings and Grounds Supervisor: Christanna Campus Peter Hunt, VP of Finance and Administrative Services Christie Hales, Public Relations Officer Will Hamilton, ISO *Any other personnel as necessary
10.1.5 Data Breach Notification: When unencrypted COV personally identifiable information (PII) is subject to a breach in security resulting in unauthorized disclosure, the data owning agency shall provide appropriate notice to affected individuals. This notice should occur without unreasonable delay as soon as verification of a breach is made, consistent with the investigative needs of both COV CIRT and law enforcement entities. Where non-electronic records are involved or implied, the following are advisory in nature, but are strongly recommended: (Jan 2010 Revision) Each agency shall: 1. Identify all agency systems, processes, and logical and physical data storage locations (whether held by the agency or a third party) that contain Personally Identifiable Information (PII) which means a combination of a first name, or first initial, last name and any of the following: (Jan 2009 Revision) a. Social Security Number b. Drivers license or Identification card number c. Financial account number, credit or debit card number and/or the corresponding password, security, or access codes. (Jan 2009 Revision) d. Other personal identifying information, such as insurance data or date of birth. The individual Business Units at SVCC will be responsible for satisfying all the requirements of the IT Security Standard ITRM SEC501-01, section 9.5 as indicated in the SVCC Incident Handling document, Section I 2 of the SVCC Security Plan. The System and or Data Owners for each Business Unit will be responsible for the identification, resolution, and documentation of all compliance issues as given in the standard. The Business Units for SVCC are as follows:
11.1 IT Asset Management
Exceptions: Legacy software used for instructional and/or testing purposes may be exempt from the requirements of the SEC-501 standard if:
Commonwealth of Virginia policies and procedures for asset management are already a requirement and the System Office and Colleges may have an individual assigned to this duty for overall asset management. The VP of Finance and Administrative Services is tasked with this responsibility (See section 4.4, SVCC Faculty-Staff Handbook). A list of all agency hardware and software will be created and reviewed annually. Commonwealth of Virginia assets including hardware and software shall not be removed from the campus without completion of the Equipment Check-Out form and proper authorization. SVCC IT Network Services staff shall provide, and maintain documentation for, a general description of system architecture and functionality. Indicate the operating environment, physical location of all campuses, building plans indicating general location of users, and partnerships with external organizations/systems. SVCC Network Services staff shall provide a network diagram of the architecture, including security controls and telecommunications connections. This document shall be maintained and kept current by SVCC IT Networks Services staff. SVCC specifies that personal IT assets (assets not owned by COV) may be allowed on the premises. These devices include, but are not limited to, laptop computers, USB drives, PDA’s, cell phones, digital music players owned by employees, contractors, and students. These devices collectively referred to as mobile storage media may not be connected to any COV system. Also, data owned by the COV may not be stored on these devices. 11.1.3 Change Management: SVCC must have controls in place for developing, testing, authorizing, accepting, and documenting changes and configurations. See SVCC Change Control Procedure, Change Request form, Section J 3, SVCC Security Plan.
11.1.4 Surplus Equipment:
|