2 INTRODUCTION Multiple federal regulations exist today requiring government organizations to implement effective controls that ensure the security of their information systems. Additional legislation exists to provide for the protection of information managed by private companies. The goal of these regulations is to establish a set of policies and controls that reduces the risk of unauthorized access to information or systems, and to improve detection and containment of security breaches to reduce their effect. This paper provides an overview of some of the more important regulations, in particular how they impact the security issues relating to remote support, and how SecureLink can help businesses and agencies meet security requirements. EXECUTIVE SUMMARY A typical government entity or public company may have 50 to 100 vendors requiring access to the network in order to provide support. CIO s are faced with the conflicting goals of maintaining security by restricting access and controlling costs by reducing the number of on-site visits needed for system support. The problem is compounded by the fact that vendors do not use the same type of connectivity. Managing multiple VPNs, desktop sharing, point-to-point networks and modems creates a security nightmare. SecureLink offers a single secure platform for managing remote support connections. SecureLink acts as a gatekeeper for all vendors needing access to the network, providing authentication, encrypted networking, and detailed auditing. In order to better understand where SecureLink helps organizations meet security obligations, let s first take a look at some of the more important compliance requirements. GENERAL FEDERAL REGULATIONS AND OVERSIGHT AGENCIES Federal Information Security Management Act of 2002 FISMA imposes a mandatory set of processes for all information systems used or operated by a US Government federal agency or by a contractor or other organization on behalf of a US Government agency. These processes are detailed through a combination of Federal Information Processing standards (FIPS) and the special publications issued by NIST. NIST The National Institute for Standards and Technology is the source of guidelines for implementing security for Federal information systems. NIST is a non-regulatory agency inside the Department of Commerce whose mission is to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life. NIST issues FIPS and additional publications that help define Federal government security standards. NIST Special Publications (SP) includes a series of documents with specific recommendations for applying security controls, such as SP Recommended Security Controls for Federal Information Systems. Federal Information Processing Standards (FIPS) FIPS are developed by National Institute of Standards and Technology (NIST) and cover a very wide range of information technology standards. The key standards include: FIPS 200 Outlines the minimum security requirements for Federal information and information systems FIPS 199 Provides the standards for security categorization of Federal information and information Systems
3 AGENCY OR INDUSTRY SPECIFIC REGULATIONS HIPAA Title II of the Health Insurance Privacy and Portability Act was passed in 1996 to regulate the use and disclosure of protected health information. HIPAA applies to any agency or covered entity in the business of creating, managing, or using protected health information, including firms providing support to covered entities. Sarbanes-Oxley Also known as the Public Accounting Reform and Investor Protection Act of 2002, the legislation was passed in the wake of the Enron scandal to clearly define the financial accounting reporting obligations of public companies. Of key interest to IT professionals is the requirement that the CEO and CFO attest to their companies having proper internal controls. Because most companies financial reporting integrity is tightly linked to the security of the IT system in general, and the financial application in particular, IT security is a key component of Sarbanes Oxley compliance. Gramm-Leach-Bliley Act GLB was Passed in 1999 to open up competition between banks and other financial institutions. With respect to Security, GLBA defined requirements for these institutions to protect customer information. GLBA compliance is mandatory; whether a financial institution discloses nonpublic information or not, there must be a policy in place to protect the information from foreseeable threats in security and data integrity. PCI DSS The Payment Card Industry Data Security Standard was developed by the major credit card companies to help organizations that process credit cards reduce credit card fraud, cracking and other security vulnerabilities. The standard includes twelve requirements for compliance, organized into six logical groups called control objectives. Companies processing, storing, or transmitting payment card data must be PCI compliant or risk losing their ability to process credit card payments. CJIS The Criminal Justice Information Services division of the FBI serves as the focal point and central repository for criminal justice services in the FBI. Programs initially consolidated under the CJIS Division include the National Crime Information Center (NCIC), Uniform Crime Reporting (UCR), and Fingerprint Identification. CJIS Security Policy defines the measures law enforcement agencies, municipalities, and contractors must meet to be able to connect with the FBI s systems. HIERARCHY DIAGRAM 1. FISMA overriding legislation a. Specified NIST as developer of standards 2. NIST developed minimum standards (FIPS 200), categorization (FIPS 199), specific details (e.g. FIPS 197, FIPS 140-2) and guidelines for implementation SP-800 a. FIPS 200 minimum security requirements b. FIPS 199 categorization c. SP guidelines for applying security controls (in particular see page 20 sec 2.4 security controls in external environments) 3. Additional specific security requirements in areas governed by other agencies a. HIPAA b. Sarbanes-Oxley c. Gramm-Leach-Bliley
4 These statues and organizations cover a tremendous range of security and privacy topics but they all have some key elements in common: categorizing data, systems, and processes that are covered by the legislation (or in the purview of the agencies), defining standards to make federal 3 and federally regulated information systems more secure, and defining metrics to determine ongoing compliance. The following table summarizes the relevant components of each piece of legislation. (Note: The table is focused on security issues related to the use of remote support and how that affects information systems security. It does not attempt to cover all of the security legislation or the details covered in the documents in the table.) FISMA Sec 301 and 302 Information Security and Management of Information Technology Sec 3541 Purposes Sec 3542 Definitions Sec 3544 Agency Responsibilities Sec Responsibilities for Federal information systems standards 1. Provide comprehensive security framework 2. Recognize highly networked nature of Federal computing environment 3. Provide for development and maintenance of minimum security controls Information Security protecting information and information systems from unauthorized access, use, disclosure, disruption in order to provide: Integrity Confidentiality Timely and reliable access Provide information security commensurate with the risk and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction. Prescribe mandatory standards and guidelines on the basis of standards and guidelines developed by NIST Sec 303 NIST 1. Develop standards, guidelines, an associated methods and techniques for information systems 2. Categorize information and information systems for providing appropriate levels of security according to a range of risk levels 3. Define minimum security requirements for each category
5 FIPS FIPS 200 FIPS 199 NIST SP-800 Mandatory minimum security requirements for Federal information and information systems including: 1. Access Control 2. Audit and accountability 3. Identification and authentication 4. System and communications protection 5. System and information integrity Standards for security categorization of Federal information and information systems: Low, Moderate, High. Recommended Security Controls for Federal Information Systems The guidance deocument and recommendations for picking security controls to meet FIPS 200. IA - 2 Identification and Authentication - The information system uniquely identifies and authenticates uses (or processes acting on behalf of users). AU-2 Auditable Events The information system generates audit records for the organization defined events. Compile audit records from multiple components throughout the system into a system wide, time-correlated audit trail. AU-3 Content of Audit Records The information system produces audit records that contain sufficient information to establish what events occurred, the sources of the events, and the outcomes of the events. AC-17 Remote Access - The organization authorizes, monitors, and controls all mehtods of remote access to the information system. Automated mechanisms, cryptography, limited access points, privileged functions only. MA-4 Remote Maintenance The organization authorizes, monitors and controls any remotely executed maintenance and diagnostic activities, if employed. Audit all remote maintenance sessions, requires maintenance provider to have security at least the level of agency being supported.
7 PCI DSS PAYMENT CARD INDUSTRY DATA SECURITY STANDARD 2: Passwords Do not user vendor supplied defaults for system passwords and other security parameters Use technologies such as SSH, VPN, or SSL/TLS for web-based management and other non-console administrative access 4: Transmission of Customer Data 7: Restrict Access Encrypt all transmissions of customer data over a public network Use strong cryptography and security protocols Restrict access by business need-to-know Limit access only to those individuals whose job requires such access Establish a mechanism for systems with multiple users that restricts access based on need-to-know and is set to deny all access unless specificially allowed 8: Unique ID Assign a unique ID to each person with computer access Implement two-factor authentication for remote access Ensure proper user authentication for non-consumer users 10: Monitor Network Access Track and monitor all access to network resources Establish a process for linking all access to system components to each individual user Implement automated assessment trails to reconstruct events Retain assessment trail history for at least one year, with a minimum of three months online availability CJIS CRIMINAL JUSTICE INFORMATION SERVICES VPN s 1. Implement VPN mechanisms using cryptography, key management, access control, authentication, and data integrity. 2. Implement an authentication method using pre-shard keys or digital signature. 3. At a minimum, a user shall be restricted from establishing a VPN session without first being authenticated by no less than a user id and password. Encryption 1. All transmitted CJIS data shall be protected with a minimum of 128-bit encryption. 2. After 2005, must meet FIPS MAINTAINING SECURITY IN A REMOTE SUPPORT ENVIRONMENT The economics of remote support are well understood. It is far less expensive and far timelier to remotely access a customer system over a network to provide support than it is to send technicians to the customer site. While deciding between on-site and remote support is simple for most businesses, those who have legislated security requirements must manage an additional set of issues. Specifically a) Authentication how to make sure the remote vendor accessing the system is who they claim to be, b) Restriction limiting access to only those systems and activities required to perform support, and c) Audit tracking, logging, and reporting the details of remote support sessions to be able to prove ongoing compliance with security policy. NIST SP covers each of these issues in its guidelines and additionally identifies multiple levels of protection for remote access and support.
8 NIST SP RECOMMENDED SECURITY CONTROLS FOR FEDERAL INFORMATION SYSTEMS Remote Access: The organization authorizes, monitors, and controls all methods of remote access to the information system. Additional levels of security (from low to moderate to high) require the following enhancements to the general guideline: 1. Implement VPN mechanisms using cryptography, key management, access control, authentication, and data integrity. 2. Implement an authentication method using pre-shard keys or digital signature. 3. At a minimum, a user shall be restricted from establishing a VPN session without first being authenticated by no less than a user id and password. Remote Support The organization authorizes, monitors, and controls any remotely executed maintenance and diagnostic activities, if employed. The general guideline is enhanced by the following additional controls: 1. All transmitted CJIS data shall be protected with a minimum of 128-bit encryption. 2. After 2005, must meet FIPS SECURELINK SECURITY FOR REMOTE SUPPORT SecureLink s remote support network is the first system designed specifically to address the issues involved in managing remote support connections for security conscious agencies and enterprises. SecureLink includes a dedicated server for hosting the remote connection management platform and client software called a Gatekeeper for establishing and defining a secure remote connection from vendor sites. SecureLink server provides all the tools needed by the support technician to create and maintain remote support connections including: Support vendor lists Gatekeepers associated with each vendor Session history for each vendor By consolidating connection types, application management and remote access from vendor systems onto a single platform, SecureLink greatly reduces the problem of tracking, auditing and reporting on remote support activities all of the remote connection session data is in one place. Let s review the specific ways SecureLink handles Authentication and Identification, Restriction, and Audit. AUTHENTICATION AND IDENTIFICATION SecureLink identifies and authenticates users in multiple ways. First, both sides of the remote access connection (the support technician and the agency) use a unique username and password when establishing and accessing a connection for remote service. In addition, restrictive password requirements are enforced on the SecureLink server for all users. RESTRICTION AND ACCESS CONTROL User authentication does not enable remote support connections to any system in the agency s environment however. With SecureLink, agency IT staff defines individual (or group) access to a specific server (or IP address), application, and capabilities that are enabled for support (read, write, file access, FTP, chat). Any remote support connection coming through the SecureLink server must be approved first by the agency (through the enabling of the Gatekeeper). Agencies have a great deal of flexibility and control to define Gatekeeper access:
9 Connectivity Settings - Access is either enabled or disabled. A remote connection can be made to the agency system only when the Gatekeeper access is enabled. Gatekeeper connection status can be managed in three ways: 1) on a defined schedule (day, date, hour), 2) disabled after an elapsed time access (within n hours), or 3) manually. Encryption - Users can choose between several encryption options to secure the communications between SecureLink server and support vendor: 1) AES in 128, 192, and 256 bit modes required to meet FIPS 140-2, 2) Triple-DES required to meet FIPS 197, and 3) Blowfish. Vendor Privileges - The services used by the support technician to diagnose and resolve software issues (FTP, shared desktop, command prompt) are included in the Gatekeeper and enabled (or disabled) by the agency. When configuring the Gatekeeper, agencies build an access list that contains hosts or IP addresses and ports the vendor is allowed to access. Using the Gatekeeper access list, the agency controls a) the host and ports accessible to the software vendor and b) the services available on those hosts. One of the key security features in the SecureLink design is that the entity whose systems are accessed (and who has the obligation of protecting the data) defines and enforces the rules of remote access. Remote support connections are managed through the SecureLink server, but are enabled and defined by the Gatekeeper. The agency sets levels of security on the Gatekeeper, defines which systems can be accessed and what services are available to the support technician, and sets the schedule for remote access. The SecureLink Gatekeeper enables the establishment of a de facto security policy for remote support with minimal agency overhead (no code to write, no additional applications to integrate). AUDIT SecureLink creates historical audit reports of each remote support session including detailed log files. The reports detail who accessed the system, when it was accessed, what parts were accessed, what was done (at the command level), and what tools were used. Information recorded for each session includes: Session information and status Owner Registration code Creation date, completion date, session duration Which support technicians participated during the session What services the support technician accessed, what happened, and how long it took:»» Start and end time of each activity»» Telnet logs»» Files transferred»» Bytes sent and received during desktop sharing»» Chat history SecureLink makes the history of each remote connection session available to both the agency and the software vendor. Both the agency and the vendor have the detail they need to prove compliance.
10 SUMMARY Legislation and business requirements have created a class of enterprises that must maintain a high level of security. This includes well defined processes for how systems are accessed by vendors providing remote support. When considering large numbers of customers and support technicians, and the variety of connectivity types, application versions, and hosting servers, the problem of managing remote support connections becomes immense and creates significant security risk. Federal agencies and business that operate under Federal regulations must meet information system security requirements or risk losing accreditation, access to key government systems, or, in the most severe cases, criminal and civil penalties. Remote support is a fact of life for large information systems users, and it s critical that IT professionals find ways to manage remote access by support vendors that does not diminish the overall information security environment. SecureLink manages complexity and enables security by providing a single platform from which to manage remote support connections. Multiple levels of identification and authentication, agency defined access and control, and detailed audit, reporting and real-time monitoring capability for every remote support session all work together to enable security process definition by the agency and to provide easily verifiable proof of compliance.
11 LEGISLATIVE REQUIREMENT SECURELINK FEATURE FIPS 200 Access Control Audit and Accountability Identification and Authentication Customer configurable Restrict access as to time, scope, function and file System or user level access rights Unilateral ability to terminate session at any time Detailed logging of each support connection session Complete historical reporting Multi-level authentication Both sides of connection must authenticate Unique username/password combination for all logins Unique randomly generated key for each connection FIPS 140-2, FIPS 197 Encrypted Communications Customer configurable encryption AES in 128, 192, and 256 bit modes Triple DES, Meets FIPS certification #918 NIST SP-800 Identification and Authentication Auditable Events Content of Audit Records Remote Maintenance Multi-level authentication Both sides of connection must authenticate Unique username/password combination for all logins Unique randomly generated key for each connection Detailed logging of each support connection session Complete historical reporting Session information and status Owner Registration code Creation date, completion date, session duration Which support technicians participated during the session What services the support technician accessed, what happened, and how long it took Authoritization, monitoring, and control of all remote access for remote maintenance and diagnostic activity HIPAA Access Control, Unique user indentification, automatic logoff Mult-level authentication Unique usnername/password combination for all logins Restrict access as to time, scope, function, and file System or user level access rights Unilateral ability to terminate session at any time Automatic logoff after 10 minutes of inactivity
12 Audit controls Data Integrity Transmission Security Detailed logging of each support connection session Complete historical reporting Strict control of remote access to limit support related data corruption Detailed audit to identify changes and enable corrections Customer configurable encryption AES in 128, 192, and 256 bit modes Triple DES SARBANES-OXLEY Audit and Accountability, Management Assessment of Internal Controls Detailed logging of each support connection session Complete historical reporting GRAMM-LEACH-BLILEY Identification and Authentication Overseeing Service Provider Arrangements Multi-level authentication Both sides of connection must authenticate Unique username/password combination for all logins Unique randomly generated key for each connection Authorization, monitoring, and control of all remote access for remote maintenance and diagnostic activity Customer configurable remote access control Restrict access as to time, scope, function, and file System or user level access rights Unilateral ability to terminate session at any time PCI DSS Password Control Unique username/password combination for all logins Unique randomly generated key for each connection Secure Data Transmission Customer configurable encryption AES in 128, 192, and 256 bit modes Triple DES CONTACT US SecureLink, Inc Hill Country Blvd Suite 200 Austin, TX phone: fax: Unique ID Monitor Network Access Multi-level authentication Both sides of connection must authenticate Unique username/password combination for all logins Unique randomly generated key for each connection Authorization, monitoring, and control of all remote access for remote maintenance and diagonstic activity Customer configurable remote access control Restrict access at to time, scope, function, and file System or user level acess rights Detailed logging of each support connection session Complete historical reporting 2014 SecureLink, Inc. All rights reserved.
Compliance and Industry Regulations Table of Contents Introduction...1 Executive Summary...1 General Federal Regulations and Oversight Agencies...1 Agency or Industry Specific Regulations...2 Hierarchy
ENTERPRISE REMOTE SUPPORT NETWORK I. INTRODUCTION EXECUTIVE SUMMARY MANAGING REMOTE SUPPORT IN A SECURE ENVIRONMENT Enterprise computing environments often include dozens, even hundreds of different software
Enterprise Remote Support Network Table of Contents I. Introduction - Executive Summary...1 Managing Remote Support in a Secure Environment...1 The Challenge...2 The Solution...2 II. SecureLink Enterprise
REMOTE SUPPORT NETWORK I. INTRODUCTION EXECUTIVE SUMMARY MANAGING REMOTE SUPPORT IN A SECURE ENVIRONMENT Enterprise software vendors strive to maximize support efficiency log on to the customer system,
HIPAA: MANAGING ACCESS TO SYSTEMS STORING ephi WITH SECRET SERVER With technology everywhere we look, the technical safeguards required by HIPAA are extremely important in ensuring that our information
REMOTE ACCESS TO A HEALTHCARE FACILITY AND THE IT PROFESSIONAL S OBLIGATIONS UNDER HIPAA AND THE HITECH ACT ARE YOUR AUTHENTICATION, ACCESS, AND AUDIT PARADIGMS UP TO DATE? BY KERRY ARMSTRONG, PRIVACY,
Remote Access to a Healthcare Facility and the IT professional s obligations under HIPAA and the HITECH Act Are your authentication, access, and audit paradigms up to date? Table of Contents Synopsis...1
Regulatory Compliance Solutions for Microsoft Windows IT Security Controls Supporting DHS HIPAA Final Security Rules Health Insurance Portability and Accountability Act Enterprise Compliance Auditing &
OVERVIEW Allscripts customers include all of the hospitals on America s Best Hospitals Honor Roll, and nearly half of the more than 100 organizations that have received Magnet Recognition Program status
Cyber-Ark Software and the PCI Data Security Standard INTER-BUSINESS VAULT (IBV) The PCI DSS Cyber-Ark s View The Payment Card Industry Data Security Standard (PCI DSS) defines security measures to protect
CHIS, Inc. and HIPAA CHIS, Inc. provides services to healthcare facilities and uses certain protected health information (PHI) in connection with performing these services. Therefore, CHIS, Inc. is classified
SecureTrack Supporting Compliance with PCI DSS 2.0 March 2012 www.tufin.com Table of Contents Introduction... 3 The Importance of Network Security Operations... 3 Supporting PCI DSS with Automated Solutions...
Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) Table of Contents Introduction... 1 1. Administrative Safeguards...
Introduction Keystone White Paper: Regulations affecting IT This document describes specific sections of current U.S. regulations applicable to IT governance and data protection and maps those requirements
WHITE PAPER MANAGED FILE TRANSFER: 10 STEPS TO SOX COMPLIANCE 1. OVERVIEW Do you want to design a file transfer process that is secure? Or one that is compliant? Of course, the answer is both. But it s
Reflection How Reflection Software Facilitates PCI DSS Compliance How Reflection Software Facilitates PCI DSS Compliance How Reflection Software Facilitates PCI DSS Compliance In 2004, the major credit
Policy/Procedure Description PCI DSS Policies Install and Maintain a Firewall Configuration to Protect Cardholder Data Establish Firewall and Router Configuration Standards Build a Firewall Configuration
WHITE PAPER MANAGED FILE TRANSFER: 10 STEPS TO HIPAA/HITECH COMPLIANCE 1. OVERVIEW Do you want to design a file transfer process that is secure? Or one that is compliant? Of course, the answer is both.
AlienVault for Regulatory Compliance Overview of Regulatory Compliance in Information Security As computers and networks have become more important in society they and the information they contain have
HIPAA considerations with LogMeIn Introduction The Health Insurance Portability and Accountability Act (HIPAA), passed by Congress in 1996, requires all organizations that maintain or transmit electronic
Online Lead Generation: Data Security Best Practices Released September 2009 The IAB Online Lead Generation Committee has developed these Best Practices. About the IAB Online Lead Generation Committee:
Overview and analysis of Memeo C1 and SSAE16 & SOX Compliance Requirements Memeo C1 Secure File Transfer and Compliance Comply360, Inc Contents Executive Summary... 2 Overview... 2 Scope of Evaluation...
FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1
Compliance and Data Governance for Google Docs Table of Contents Google Docs HIPAA Compliance Google Docs FERPA Compliance Google Docs FISMA Compliance Google Docs PCI DSS Compliance Google Docs PCI Compensating
How Managed File Transfer Addresses HIPAA Requirements for ephi 1 A White Paper by Linoma Software INTRODUCTION As the healthcare industry transitions from primarily using paper documents and patient charts
Information Security Policy and Handbook Overview ITSS Information Security June 2015 Information Security Policy Control Hierarchy System and Campus Information Security Policies UNT System Information
HIPAA Compliance Guide Important Terms Covered Entities (CAs) The HIPAA Privacy Rule refers to three specific groups as covered entities, including health plans, healthcare clearinghouses, and health care
Legislative Language SEC. 1. COORDINATION OF FEDERAL INFORMATION SECURITY POLICY. (a) IN GENERAL. Chapter 35 of title 44, United States Code, is amended by striking subchapters II and III and inserting
Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandated
OFFICE OF THE CHIEF INFORMATION OFFICER NETWORK AND AIS AUDIT, LOGGING, AND MONITORING POLICY OCIO-6011-09 Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: TABLE OF CONTENTS Section
White Paper The Role of Password Management in Achieving Compliance PortalGuard PO Box 1226 Amherst, NH 03031 USA Phone: 603.547.1200 Fax: 617.674.2727 E-mail: firstname.lastname@example.org Website: www.portalguard.com
Privacy and Encryption in egovernment Dewey Landrum Technical Architect CSO SLED West Sector CISSP August 11, 2008 Privacy Regulations Health Insurance Portability and Accountability Act (HIPPA) Gramm-Leach-Bliley
Security Trends and Client Approaches May 2010 Bob Bocchino, CISA ERM Security and Compliance Business Advisor IBU Technology Sales Support Industries Business Unit, Technology Sales Support 1 Mark Dixon
PCI Compliance Reporting Solution Brief Automating Regulatory Compliance and IT Best Practices Reporting Automating Compliance Reporting for PCI Data Security Standard version 1.1 The PCI Data Security
PCI Compliance Can Make Your Organization Stronger and Fitter Brent Harman Manager, Systems Consultant Team West NetPro Computing, Inc. Today s Agenda PCI DSS What Is It? The Regulation 6 Controls 12 Requirements
Keeping watch over your best business interests. 0101010 1010101 0101010 1010101 IT Security Services Regulatory Compliance Services IT Audit Services Forensic Services Risk Management Services Attestation
POSTAL REGULATORY COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT INFORMATION SECURITY MANAGEMENT AND ACCESS CONTROL POLICIES Audit Report December 17, 2010 Table of Contents INTRODUCTION... 1 Background...1
Citrix GoToMyPC Corporate and Payment Card Industry (PCI) compliance GoToMyPC Corporate provides industryleading configurable security controls and centralized endpoint management that can be implemented
Technical Safeguards is the third area of safeguard defined by the HIPAA Security Rule. The technical safeguards are intended to create policies and procedures to govern who has access to electronic protected
University of Sunderland Business Assurance PCI Security Policy Document Classification: Public Policy Reference Central Register IG008 Policy Reference Faculty / Service IG 008 Policy Owner Chief Financial
Federal Trade Commission Privacy Impact Assessment for: DCBE Websites and Blogs Consumer.ftc.gov, Consumidor.ftc.gov, OnGuardOnline, AlertaenLinea, Consumer.gov, Consumidor.gov and the BCP Business Center
HIPAA Information Security Overview Security Overview HIPAA Security Regulations establish safeguards for protected health information (PHI) in electronic format. The security rules apply to PHI that is
2: Do not use vendor-supplied defaults for system passwords and other security parameters 2.1: Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing
Complying with PCI Data Security Solution BRIEF Retailers, financial institutions, data processors, and any other vendors that manage credit card holder data today must adhere to strict policies for ensuring
This document is to be used to verify that a payment application has been validated against Visa U.S.A. Payment Application Best Practices and to create the Report on Validation. Please note that payment
Hamilton College Administrative Information Systems Security Policy and Procedures Approved by the IT Committee (December 2004) Table of Contents Summary... 3 Overview... 4 Definition of Administrative
Credit Card Security Created 16 Apr 2014 Revised 16 Apr 2014 Reviewed 16 Apr 2014 Purpose This policy is intended to ensure customer personal information, particularly credit card information and primary
Achieving PCI COMPLIANCE with the 2020 Audit & Control Suite 7. Restrict access to cardholder data by business need to know PCI Article (PCI DSS 3) Report Mapping How we help 7.1 Limit access to system
Get Confidence in Mission Security with IV&V Information Assurance September 10, 2014 Threat Landscape Regulatory Framework Life-cycles IV&V Rigor and Independence Threat Landscape Continuously evolving
LogRhythm and PCI Compliance The Payment Card Industry (PCI) Data Security Standard (DSS) was developed to encourage and enhance cardholder data security and facilitate the broad adoption of consistent
Best Practices for PCI DSS V3.0 Network Security Compliance January 2015 www.tufin.com Table of Contents Preparing for PCI DSS V3.0 Audit... 3 Protecting Cardholder Data with PCI DSS... 3 Complying with
UNIVERSITY OF MAINE SYSTEM STANDARDS FOR SAFEGUARDING INFORMATION ATTACHMENT C This Attachment addresses the Contractor s responsibility for safeguarding Compliant Data and Business Sensitive Information
Achieving PCI Compliance with Red Hat Enterprise Linux June 2009 CONTENTS EXECUTIVE SUMMARY...2 OVERVIEW OF PCI...3 1.1. What is PCI DSS?... 3 1.2. Who is impacted by PCI?... 3 1.3. Requirements for achieving
Issued by the EPA Chief Information Officer, Pursuant to Delegation 1-19, dated 07/07/2005 INFORMATION SECURITY INTERIM MAINTENANCE PROCEDURES V1.8 JULY 18, 2012 1. PURPOSE The purpose of this procedure
Implementation Guide PayLINK Implementation Guide Version 2.1.252 Released September 17, 2013 Copyright 2011-2013, BridgePay Network Solutions, Inc. All rights reserved. The information contained herein
Datto Compliance 101 1 Overview Overview This document provides a general overview of the Health Insurance Portability and Accounting Act (HIPAA) compliance requirements for Managed Service Providers (MSPs)
What Is It? The Payment Card Industry Data Security Standard (PCIDSS), in particular v3.0, aims to reduce credit card fraud by minimizing the risks associated with the transmission, processing, and storage
WHITEPAPER Using Automated, Detailed Configuration and Change Reporting to Achieve and Maintain PCI Compliance Part 4 An in-depth look at Payment Card Industry Data Security Standard Requirements 10, 11,
WHITEPAPER XMEDIUSFAX CLOUD FOR HEALTHCARE AND HIPAA COMPLIANCE INTRODUCTION The healthcare industry is driven by many specialized documents. Each day, volumes of critical information are sent to and from
Version: Modified By: Date: Approved By: Date: 1.0 Michael Hawkins October 29, 2013 Dan Bowden November 2013 Rule 4-004G Payment Card Industry (PCI) Remote and Mobile Access Security (proposed) 01.1 Purpose
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225
BEFORE THE BOARD OF COUNTY COMMISSIONERS FOR MULTNOMAH COUNTY, OREGON RESOLUTION NO. 05-050 Adopting Multnomah County HIPAA Security Policies and Directing the Appointment of Information System Security
How do I secure and manage an out-of-band connection to network devices? ION Product(s): SA5600 Site Appliance, SM110 Secure Modem, ST510 Soft Token, PRIISMS Use Case Number: 19821 Issue Number: 2 Release
UNIVERSITY OF PITTSBURGH POLICY SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) DATE: March 18, 2005 I. SCOPE This
Technology Help Desk 412 624-HELP  technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.5) Directions and Instructions for completing this assessment The answers provided
DATA SECURITY AGREEMENT Addendum # to Contract # This Data Security Agreement (Agreement) is incorporated in and attached to that certain Agreement titled/numbered and dated (Contract) by and between the
Directed Circuits Meet Today s Security Challenges in Enterprise Remote Monitoring A White Paper from the Experts in Business-Critical Continuity TM Executive Summary With continued efforts to reduce overhead,
UPSTREAMCONNECT SECURITY OVERVIEW Upstream is committed to providing software products that are secure for use in all network environments. The UpstreamConnect software only collects critical imaging device
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V2.0, JULY 2015 Multiple Layers of Protection Overview Password Salted-Hash Thank you
Teleran PCI Customer Case Study Written by Director of Credit Card Systems for Large Credit Card Issuer Customer Case Study Summary A large credit card issuer was engaged in a Payment Card Industry Data
Any physical access to devices or data held in an Melbourne datacentre that houses a customer s cardholder data must be controlled and restricted only to approved individuals. PCI DSS Requirements Version
itrust Medical Records System: Requirements for Technical Safeguards Physicians and healthcare practitioners use Electronic Health Records (EHR) systems to obtain, manage, and share patient information.
Catapult PCI Compliance Table of Contents Catapult PCI Compliance...1 Table of Contents...1 Overview Catapult (PCI)...2 Support and Contact Information...2 Dealer Support...2 End User Support...2 Catapult
OFFICE OF THE INSPECTOR GENERAL SOCIAL SECURITY ADMINISTRATION CONTRACTOR SECURITY OF THE SOCIAL SECURITY ADMINISTRATION S HOMELAND SECURITY PRESIDENTIAL DIRECTIVE 12 CREDENTIALS June 2012 A-14-11-11106
Shipman & Goodwin LLP HIPAA Security Alert July 2008 EXECUTIVE GUIDANCE HIPAA SECURITY COMPLIANCE How would your organization s senior management respond to CMS or OIG inquiries about health information
goes to great lengths to ensure the security and availability of vcloud Air services. In this effort VMware has completed an independent third party examination of vcloud Air against applicable regulatory
89 Fifth Avenue, 7th Floor New York, NY 10003 www.theedison.com 212.367.7400 White Paper How to Avoid the High Cost of Security Audits Printed in the United States of America. Copyright 2009 Edison Group,
HIPAA Security S E R I E S Security Topics 1. Security 101 for Covered Entities 2. Security Standards - Administrative Safeguards 3. Security Standards - Physical Safeguards 4. Security Standards - Technical
National Institute of Standards and Technology (NIST) The Information Technology Lab Computer Security Division (893) Now What? What does NIST have for you to use and how do you get it? How do you contact
University of Northern Colorado Data Security Policy for Research Projects Contents 1.0 Overview... 1 2.0 Purpose... 1 3.0 Scope... 1 4.0 Definitions, Roles, and Requirements... 1 5.0 Sources of Data...