1 Network Security: Policies and Guidelines for Effective Network Management Department of Electrical and Computer Engineering, Federal University of Technology, Minna, Nigeria. Abstract Network security and management in Information and Communication Technology (ICT) is the ability to maintain the integrity of a system or network, its data and its immediate environment. The various innovations and uses to which networks are being put are growing by the day and hence are becoming complex and invariably more difficult to manage by the day. Computers are found in every business such as banking, insurance, hospital, education, manufacturing, etc. The widespread use of these systems implies crime and insecurity on a global scale. In addition, the tremendous benefits brought about by Internet have also widened the scope of crime and insecurity at an alarming rate. Also, ICT has fast become a primary differentiator for institution/organization leaders as it offers effective and convenient means of interaction with each other across the globe. This upsurge in the population of organizations depending on ICT for business transaction has brought with it a growing number of security threats and attacks on poorly managed and secured networks primarily to steal personal data, particularly financial information and password. This paper therefore proposes some policies and guidelines that should be followed by network administrators in organizations to help them ensure effective network management and security of ICT facilities and data. 7
2 Network Security: Policies and Guidelines for Effective Network Management Keyword ICT; Security; Network; Management; IT; Hardware; Software; Access; Risk; Control; Asset; Resources; Data; Passwords; Hacker. Introduction We are living in an information engrossed world and the premium placed on information in this digital age has made it to become a precious and an invaluable commodity that all nations and groups of individuals across the globe are scrambling to get. Since information is now a precious and an indispensable commodity, the need to protect the data that are being transmitted becomes mandatory. Also, there are a growing number of security threats and attacks on networks primarily to steal personal data, particularly financial information and passwords. In addition, fraudulent network users may trade off their subscribers password to a hacker for a fee. Network security and management in ICT is the ability to maintain the integrity of a system or network, its data and its immediate environment. This involves controlling access, regulating use and implementing contingency plans. It also involves the authorization and monitoring of access, investigation of unauthorized access and the protection of data, infrastructure and services. Breaches in security may be caused by human actions, which could be accidental, malicious or negligent, or through incorrect installation, configuration or operation. Thus, in view of the above, to ensure effective management of an organization network, each department within the organization should be responsible for developing procedures to implement and enforce a security plan that includes the general organizational policies as well as any additional policies necessary to maintain the security of its Information Technology (IT) resources. The policies and guideline should reflect the standard and goals of the organization/institution and should address the problems of global networking and other new technologies. This paper therefore presents policies and guidelines that should be followed to ensure effective management and security of any ICT network. The paper is written with the less experienced system administrator and information system manager in mind, to help them understand and deal with the risks they face daily on their networks. 8
3 This paper contributes to knowledge by suggesting policies and guidelines that must be implemented to solve the problems associated with poorly managed and secured networks. These policies and guidelines are presented along the following major headings: IT security policies, organizational security, asset classification and control, personnel security, operation management and information management. These guidelines if implemented by the appropriate authorities will go a long way in alleviating problems of network insecurity. IT Security Policy IT security policies are the rules and practices that an institution uses to manage and protect its information resources. These policies must be developed, documented, implemented, reviewed and evaluated to ensure a properly managed and secured network. Hence, the need for IT security policies in any institution cannot be overemphasized. Developing Security Policies Developing security policies involves developing the following: Program policies, System-specific policies and Issue-specific policies , . Program policies: addresses overall IT security goals and it should apply to all IT resources within an institution. The institution s president or an appointed representative must direct policy development to ensure that the policies address the IT security goals of all systems operating within the institution. For instance, program policies can address confidentiality or service availability. All program policies should meet the following criteria: Comply with existing laws, regulations, and state and federal policies. Support and enforce the institution s mission statement and organizational structure. The components of an adequate program policy are defined in table 1. System-specific policies: addresses the IT security issues and goals of a particular system. Large facilities may have multiple sets of system-specific policies that address all levels of security from the very general (access control rules) to the particular (system permissions that reflect the segregation of duties among a group of employees). Issue-specific polices address particular IT security issues such as, Internet access, installation of unauthorized software or equipment, and sending/receiving attachments. 9
4 Network Security: Policies and Guidelines for Effective Network Management Once you have identified the IT security issues you need to address, develop issue-specific policies using the components defined in table 2 The guidelines for developing security policies are: Obtain a commitment from senior management to enforce security policies. Establish working relationships between departments, such as human resources, internal audit, facilities management, and budget and policy analysis. Establish an approval process to include legal and regulatory specialists, human resources specialists, and policy and procedure experts. Allow enough time for the review and respond to all comments whether you accept them or not. Table 1. Component of an adequate program policy Component Description Purpose Statement Explains why the program is being established and what IT security goals it will address. Scope Define which IT resources are address by the program, such as hardware, software, data, personnel etc. Assignment of Defines responsibilities for IT program management. responsibilities Compliance Describe how the institution will develop and enforce the program. Also establish any disciplinary process for breaches of the program policy. Documenting Security Policies Once an institution has developed its IT security policies, all policies and procedures should be documented. Each department should protect its networks, critical information systems, and sensitive information from unauthorized disclosure, modification or destruction. Information security policies and procedures must be documented to ensure that integrity, confidentiality, accountability, and availability of information are not compromised. The documentation guideline for this security policy is summarized in table 3 . Implementing Security Policies Successful implementation of IT security policies requires security awareness at all levels of the organization. You can create awareness through widely disseminated documentation, newsletters, , a web site, training programs, and other notifications about security issues. Table 4 outlines the guidelines for implementing IT security policies: 10
5 Component Issue statement Statement of the institution s position Applicability Compliance Points of contact Table 2. Issue Specific Policy Description Identify the terms, definitions, and conditions pertinent to the issue. For instance, how do you define unauthorized software or acceptable Internet use? Include the rationale or justification for the policy. Reflects management s decision on the policy. E.g. the use of unauthorized software is prohibited. Specifies where, how, when, to whom, and to what the policy applies. Defines who is responsible for enforcing the policy Identifies resources for information and guidance. Reviewing and Evaluating Policies Institutions/organizations should review their security policies periodically to ensure they continue to fulfill the institutions security needs. Each department is also responsible for reviewing and evaluating the effectiveness of their policies and the accompanying procedures. After an institution/organization has developed IT security policies, the appointed security team will evaluate the policies and provide feedback. Policy Review within the Institution Each institution/organization should develop a plan to review and evaluate their IT security policies once they are in place. The guidelines are : 11
6 Network Security: Policies and Guidelines for Effective Network Management Guideline Define policies Define standards Define guidelines Define enforcement Define exceptions Table 3. Documentation guideline for security policy Description Define policies by documenting the following information: Identify general areas of risk. State generally how to address the risk. Provide a basis for verifying compliance through audits. Outline implementation and enforcement plans. Balance protection with productivity. Define IT security standards by documenting the following information: Define minimum requirements designed to address certain risks. Define specific requirements that ensure compliance with policies. Provide a basis for verifying compliance through audits. Outline implementation and enforcements plans. Balance protection with productivity. Define IT security guidelines by documenting the following information: Identify best practices to facilitate compliance Provide additional background or other relevant information Define how policies will be enforced by documenting the following information: Identify personnel who are authorized to review and investigate breaches of policy. Identify the means to enforce policies. Define the possible exceptions to the IT security policies. Table 4: Guidelines for implementing IT security policies Guideline Description Create awareness Create user awareness using the following methods: Notify employees about the new security polices. Update employees on the progress of new security policies. Publish policy documentation electronically and on paper. Develop descriptive security documentation for users. Develop user-training sessions. Require new users to sign a security acknowledgement. Maintain Maintain user awareness of ongoing and new security issues using the awareness following methods: Web site Posters Newsletters for comments, questions, and suggestions Assign responsibility for reviewing policies and procedures. Implement a reporting plan in which departments report security incidents to designated security personnel 12
7 Implement regular reviews to evaluate the following: o Nature, number, and impact of recorded security incidents. o Cost and impact of controls on business efficiency, including third-party vendor compliance. o Effects of changes to organizations or technology. Organizational Security These are security measures that any organization should consider particularly when granting others access into its network. Each department in an institution/organization that develops, uses, or maintains information systems will also develop and maintain an internal information security infrastructure. An information security infrastructure protects an institution s information assets by defining assets and the necessary resources to protect them, and assigning responsibility for assets. This infrastructure must consist of information and programs that ensure the confidentiality, availability, accountability, and integrity of information assets. Institution must be able to identify the following for a viable security infrastructure : Managing Risks from Third-Party Access Any institution that allows third party to access its IT resources should analyze the risk and develop security procedure to control access. The most significant risk in third-party access to many institution/organization IT resources is network-network connections that allows multiple users or systems from the third-party to interact with their system. Any department that allows third-party access to its information systems should conduct risk assessment and identify risk, and provide measures for checking this. In other to manage risk from third-party, security awareness must be created and control access should be implemented. Contracting with Third-Party Entities Institution/organization as well as departments under them that allow third-party access to its information should address the security issues of that access and require the third- 13
8 Network Security: Policies and Guidelines for Effective Network Management party to adhere to all established security policies. Some of the guidelines that should be followed when contracting with a third party are: (1) Control access; (2) Protect asset; (3) Manage service; (4) Manage liabilities; (5) Ensure compliance; (6) Secure equipment; (7) Manage personnel. Defining Security Requirement for Outsourcing Contract Outsourcing agreements should address all IT security issues identified for the particular resources included in the contract. Asset Classification and Control Assets should be classified in order to determine which are sensitive or mission critical assets. This section contains guidelines for the following policies , : Classifying assets Developing and maintaining an asset inventory Analyzing and assessing risk Classifying Assets Once an IT security plan have been developed, it is important to classify the information assets to determine which information systems, data, facilities, equipment, and personnel constitute the critical information infrastructure of the institution. The guidelines for classifying IT assets are outline in table 5. Developing and Maintaining an Asset Inventory An important component of IT security is establishing accountability for all IT resources. A documented asset inventory helps identify and assign responsibility for all resources. Asset inventories allow every institution and their departments to account for all purchases made with public funds. As items become out of date or no longer in use they should be removed from the inventory lists in accordance with institutional asset management procedures. 14
9 Analyzing and Assessing Risk Once the critical IT assets have been identified, a risk analysis and assessment can help one to identify the vulnerabilities and risks associated with those assets. Risk Analysis Risk analysis is used to analyze the risk to critical IT assets by finding and documenting the vulnerabilities. A thorough analysis requires the assistance of experts in the hardware and software used at the institution. A risk analysis should analyze areas of control, critical asset elements, and areas of potential compromise . Guideline Organize assets Review relevant information Interview personnel Conduct surveys Identify interdependencies Classify assets Table 5. Guidelines for classifying IT assets Description Organize assets into basic categories, such as: Data, Equipment, Hardware/software, Personnel, Facilities and Operations Review reports, databases, and documents with information about personnel, information and equipment. Interview personnel, such as managers, customers, suppliers, users, and others to help determine critical assets. Develop survey questions to identify critical assets, such as: What are the mission critical or sensitive activities and/or operations? Where is critical or sensitive information stored or processed? Where are the mission critical or high value equipment or material located (onsite or off)? What kind of physical security, access control, and other protective measures are in place in these locations? What impact would a lost or damaged asset have on critical mission functions, operations, and customers? Identify interdependencies among the components of individual systems and the overall infrastructure. Classify assets based on your findings. Typically, the more goals an asset supports the more important it is. Risk Assessment Once you have identified the risks and vulnerabilities through a risk analysis, a risk assessment will help you determine which critical IT assets are most sensitive and at greatest risk. The cost of security enhancements typically exceeds available resources and the objective is to minimize the known vulnerabilities associated with the most critical IT assets. A risk assessment will help you prioritize IT security needs. A thorough risk assessment 15
10 Network Security: Policies and Guidelines for Effective Network Management should include the following questions : Can vulnerability be better minimized with physical or IT measures? How much would it cost to minimize the risk posed by the vulnerability? Are the security enhancement costs commensurate with the asset s overall importance? What is the countermeasure s function: deter, detect, delay, or destroy? Is the effectiveness of the countermeasure related to time or events? Is the countermeasure effective institution-wide or for a specific area only? Do projected plans or anticipated developments suggest that the vulnerability is likely to become irrelevant in the near future? How long will it take to fully implement the proposed security enhancement? Will a proposed security enhancement be defeated by IT advances in the near future? Personnel Security This addresses the security issues that network administrator must deal with with respect to personnel. The following areas must be considered to ensure a complete Personnel Security as regards Information Network Security, and contains guidelines for proper execution. Hiring new personnel When hiring new personnel, IT departments should implement security procedures to minimize the risks of human error, fraud, and misuse of resources. Security concerns should be addressed as early as the recruitment stage. The guidelines that should be enforced when screening employees should encompass the following: Screening potential employee. Outline employee responsibilities. Evaluate the duties of new employees. Ensuring appropriate use of technology Institution s facilities should provide IT resources to authorized users to facilitate the efficient and effective performance to their duties. Authorization imposes certain 16
11 responsibilities and obligations on users and is subject to institution/organization policies and applicable laws. Users at all levels should be trained in the appropriate use of IT resources. The guidelines for ensuring appropriate use of technology are: Development of appropriate user policies. Enforcement of those policies. Training users Users of IT resources should be trained to make them to be aware of potential security concerned and to understand their responsibility to report security incident and vulnerabilities. The guidelines for training users are: Establish information access. Establish acceptable use of software. Establish accepted use of system. Reporting security incidents and weaknesses All users should be trained to report incidents and weaknesses in accordance with policy. The guidelines for this are as follows: Report incidence. Manage incidence. Collection and sharing IT information. Develop user awareness. Define user responsibilities. Developing a disciplinary process A disciplinary process ensures correct and fair treatment of users who breach security and may also deter users from disregarding security procedures. The guidelines for developing disciplinary policies are: Development of disciplinary process. Development of disciplinary process for third parties. 17
12 Network Security: Policies and Guidelines for Effective Network Management Operation Management This section contains guidelines for the following policies: Developing network controls. Separating development and operational facilities. Securing external facilities management. Developing network controls Network controls ensure the security of information and connected services. To achieve and maintain security on computer networks a range of controls must be utilized. The common objective of these controls should be to protect all information and all connected service from unauthorized access. Security management of networks may span organizational boundaries and may involve protecting sensitive data passing over public networks. The guidelines for developing network controls include: Separate operational responsibilities for networks and computer operations where appropriate. Establish remote equipment management Establish special controls to protect data passing over public networks and connected systems. Use network management tools and procedures to ensure controls are consistently applied and services are optimized. Separating Development and Operation Facilities Separation of development, operation, and test systems reduces the risk of unauthorized changes or access. To operate properly, each type of computing system requires a known and stable environment. Guidelines for separating facilities are: Operate development and operational software on different computer processors, in different domains, or in different directories. Separate development and testing activities from production activities Prevent the access of software development utilities from operational systems, unless required. 18
13 Avoid using the same log-on procedures, passwords, and display menus for both operational and test systems to reduce the risk of accidental log-on and other errors. Implement controls to ensure that administrative passwords for operational systems are closely monitored and controlled. Define and document the procedures for transferring software from development to operational status. Such transfers should require management approval. Securing External Facilities Management External facilities management introduces additional security risks that require special precautions. Specific risks should be identified in advance and appropriate controls should be agreed upon with the contractor. Guidelines for securing external facilities management are: Identify sensitive or critical applications that should be retained in-house. Obtain approval of business application owners to utilize external facilities. Consider business continuity plan implications. Specify security standards and compliance measurement processes. Implement procedures to effectively monitor all relevant security activities. Perform background checks and other techniques to screen vendor personnel and require confirmation that background checks have been successfully completed. Define responsibilities and procedures for reporting and handling security incidents. Define the security parameters for communications and data to the external site. Information Management This section contains guidelines for the following policies: Handling information & Disposing of media. Handling Information Electronically stored information should be protected from unauthorized access or misuse. Each department in an institution should establish internal procedures for the secure handling and storage of its electronically stored information to prevent unauthorized access or misuse. The guidelines for handling electronically stored information are: 19
14 Network Security: Policies and Guidelines for Effective Network Management Develop procedures to invoice and manage the following: Documents, Computing systems, Networks, Mobile users, Postal services, , Voice mail, Voice communications, Fax machines, Multi-media and Other sensitive items Develop methods for handling and storing media. Develop access restrictions to identify unauthorized users. Maintain formal records of the recipients of data. Store media in accordance with manufacturer s specifications Restrict distribution of information. Indicate the authorized recipient of all copies of data. Disposing of Media To ensure the security of information, Institutions should develop procedures to render information unrecoverable before disposing of media. Each department should develop a media disposal process based on the sensitivity of the data as determined by law and the data owners. Guidelines for disposing of media are: Dispose of paper media Cleanse magnetic or optical media Develop disposal procedures Conclusions Once an institution has agreed upon on a set of security policies, then the procedure, plans, guidelines and standards that support those policies should be documented and disseminated to the appropriate managers and users. In addition, a back-up plan is necessary to ensure that essential stored data be recovered in the event of a system failure or disaster. References 1. National Communications System, Public Switched Network Security Assessment Guidelines, National Communications System publication,
15 2. Swanson Marianne and Federal Computer Security Program Managers Forum Working 3. Group, Guide for Developing Security Plans for Information Technology Systems, NIST Special Publication , British Standard Institution, BS7799: A Code of Practice for Information Security, British,Standard Publication, London. 5. Stoneburner, G. Risk Management Guide. Draft Rev, NIST Special Publication,800-30, Information Systems Audit and Control Foundation, Control Objectives for Information and Related Technology (COBIT), 3rd Edition, July Office of Information and Instructional Technology, Information Technology, Security Guidelines. Gaithersburg, MD, National Institute of Standards and Technology. 21
ISO 27001 s and Objectives A.5 Security policy A.5.1 Information security policy Objective: To provide management direction and support for information security in accordance with business requirements
FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1
Sample Information Security Policies Sample Information Security Policies May 31, 2011 1 13740 Research Blvd Suite 2, Building T Austin, TX 78750 512.351.3700 www.aboundresources.com Boston Austin Atlanta
1. Introduction 1.1. Purpose and Background 1.2. Central Coordinator Contact 1.3. Payment Card Industry Data Security Standards (PCI-DSS) High Level Overview 2. PCI-DSS Guidelines - Division of Responsibilities
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable
SITA Information Security SITA Security Requirements for Third-Party Service Providers that Access, Process, Store or Transmit Data on Behalf of SITA September, 2012 Contents 1. Introduction... 3 1.1 Overview...
Introduction This reference document for the University of Birmingham lists the control objectives, specific controls and background information, as given in Annex A to ISO/IEC 27001:2005. As such, the
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT OF PUBLIC WELFARE INFORMATION TECHNOLOGY POLICY Name Of : DPW Information Security and Privacy Policies Domain: Security Date Issued: 05/09/2011 Date Revised: 11/07/2013
6 th Floor, Tower A, 1 CyberCity, Ebene, Mauritius T + 230 403 6000 F + 230 403 6060 E ReachUs@abaxservices.com INFORMATION SECURITY POLICY DOCUMENT Information Security Policy Document Page 2 of 15 Introduction
Stephen F. Austin State University Information Security Program Revised: September 2014 2014 Table of Contents Overview... 1 Introduction... 1 Purpose... 1 Authority... 2 Scope... 2 Information Security
Chapter 5 Central Services Data Centre Security 1.0 MAIN POINTS The Ministry of Central Services, through its Information Technology Division (ITD), provides information technology (IT) services to government
Information Security Policy Author: Responsible Lead Executive Director: Endorsing Body: Governance or Assurance Committee Alan Ashforth Alan Lawrie ehealth Strategy Group Implementation Date: September
University of Sunderland Business Assurance Information Security Policy Document Classification: Public Policy Reference Central Register Policy Reference Faculty / Service IG 003 Policy Owner Assistant
State of California California Information Security Office Information Security Program Management Standard SIMM 5305-A September 2013 REVISION HISTORY REVISION DATE OF RELEASE OWNER SUMMARY OF CHANGES
R345, Information Technology Resource Security 1 R345-1. Purpose: To provide policy to secure the private sensitive information of faculty, staff, patients, students, and others affiliated with USHE institutions,
BEFORE THE BOARD OF COUNTY COMMISSIONERS FOR MULTNOMAH COUNTY, OREGON RESOLUTION NO. 05-050 Adopting Multnomah County HIPAA Security Policies and Directing the Appointment of Information System Security
TABLE OF CONTENTS General Topics Purpose and Authorities Roles and Responsibilities Policy and Program Waiver Process Contact Abbreviated Sections/Questions 7.1 What is the purpose of this chapter? 7.2
State Agency Cybersecurity Survey v 3.4 The purpose of this survey is to identify your agencies current capabilities with respect to information systems/cyber security and any challenges and/or successes
Compliance HIPAA Security COMPLIANCE Checklist For Employers All of the following steps must be completed by April 20, 2006 (April 14, 2005 for Large Health Plans) Broadly speaking, there are three major
White Paper on Financial Institution Vendor Management Virtually every organization in the modern economy relies to some extent on third-party vendors that facilitate business operations in a wide variety
Hengtian Information Security White Paper March, 2012 Contents Overview... 1 1. Security Policy... 2 2. Organization of information security... 2 3. Asset management... 3 4. Human Resources Security...
Introduction This tool is designed to cover all the relevant control areas of ISO / IEC 27001:2013. All sorts of organisations and Because it is a general tool, you may find the language challenging at
Title: Rotherham CCG Network Security Policy V2.0 Reference No: Owner: Author: Andrew Clayton - Head of IT Robin Carlisle Deputy - Chief Officer D Stowe ICT Security Manager First Issued On: 17 th October
INFORMATION SECURITY MANAGEMENT SYSTEM Version 1c Revised April 2011 CONTENTS Introduction... 5 1 Security Policy... 7 1.1 Information Security Policy... 7 1.2 Scope 2 Security Organisation... 8 2.1 Information
Information Security Standards March 2015 Information & Technology Services Information Security Standards Table of Contents 1.0 Common Policy Elements... 7 1.1 Introduction and Scope... 7 1.2 Authority...
Risk Management of Outsourced Technology Services November 28, 2000 Purpose and Background This statement focuses on the risk management process of identifying, measuring, monitoring, and controlling the
Microsoft Online Subscription Agreement/Open Program License Amendment Microsoft Online Services Security Amendment Amendment ID This Microsoft Online Services Security Amendment ( Amendment ) is between
HALKYN CONSULTING LTD Supplier Security Assessment Questionnaire Security Self-Assessment and Reporting This questionnaire is provided to assist organisations in conducting supplier security assessments.
Client Advisory October 2009 Data Security Law MGL Chapter 93H and 201 CMR 17.00 For a discussion of these and other issues, please visit the update on our website at /law. To receive mailings via email,
Enrollment for Education Solutions Office 365 Data Processing Agreement (with EU Standard Contractual Clauses) Amendment ID Enrollment for Education Solutions number Microsoft to complete 7392924 GOLDS03081
INTRODUCED BY CONGRESSMAN RANDY NEUGEBAUER (R-TX) AND CONGRESSMAN JOHN CARNEY (D-DE) SECTION-BY-SECTION ANALYSIS Section 1: Short Title The Data Security Act of 2015. Section 2: Purposes The purposes of
HIPAA: In Plain English Material derived from a presentation by Kris K. Hughes, Esq. Posted with permission from the author. The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub.
Utica College Information Security Plan Author: James Farr (Information Security Officer) Version: 1.0 November 1 2012 Contents Introduction... 3 Scope... 3 Information Security Organization... 4 Roles
Information Shield www.informationshield.com 888.641.0500 firstname.lastname@example.org Information Security Policies Made Easy ISO 27002:2013 Version Change Summary This table highlights the control category
Information Security Incident Management Plan Version 0.8 January 5, 2009 Table of Contents Introduction... 3 Scope... 3 Objectives... 3 Incident Management Procedures... 4 Roles and Responsibilities...
- 1. Policy Statement All card processing activities and related technologies must comply with the Payment Card Industry Data Security Standard (PCI-DSS) in its entirety. Card processing activities must
California State University, Sacramento INFORMATION SECURITY PROGRAM 1 I. Preamble... 3 II. Scope... 3 III. Definitions... 4 IV. Roles and Responsibilities... 5 A. Vice President for Academic Affairs...
The Office of the Auditor General has conducted a procedural review of the State Data Center (Data Center), a part of the Arizona Strategic Enterprise Technology (ASET) Division within the Arizona Department
Miami University Payment Card Data Security Policy IT Policy IT Standard IT Guideline IT Procedure IT Informative Issued by: IT Services SCOPE: This policy covers all units within Miami University that
Information Shield Solution Matrix for CIP Security Standards The following table illustrates how specific topic categories within ISO 27002 map to the cyber security requirements of the Mandatory Reliability
Information Security: Business Assurance Guidelines The DTI drives our ambition of prosperity for all by working to create the best environment for business success in the UK. We help people and companies
You can learn more about the programme by downloading the information in the related documents at the bottom of this page. Information Security Document Information Security Policy 1 Version History Version
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy Threat and Vulnerability Management V1.0 April 21, 2014 Revision History Update this table every time a new edition of the document is
Ohio Supercomputer Center IT Business Continuity Planning No: Effective: OSC-13 06/02/2009 Issued By: Kevin Wohlever Director of Supercomputer Operations Published By: Ohio Supercomputer Center Original
M E M O R A N D U M DATE: November 10, 2011 TO: FROM: RE: Krevolin & Horst, LLC HIPAA Obligations of Business Associates In connection with the launch of your hosted application service focused on practice
HIPAA Compliance Review Analysis and Summary of Results Centers for Medicare & Medicaid Services (CMS) Office of E-Health Standards and Services (OESS) Reviews 2008 Table of Contents Introduction 1 Risk
IM&T Infrastructure Security Policy Board library reference Document author Assured by Review cycle P070 Information Security and Technical Assurance Manager Finance and Planning Committee 3 Years This
BALTIMORE CITY COMMUNITY COLLEGE INFORMATION TECHNOLOGY SECURITY PLAN FEBRUARY 2011 TABLE OF CONTENTS PURPOSE... 4 SCOPE... 4 INTRODUCTION... 4 SECTION 1: IT Security Policy... 5 SECTION 2: Risk Management
Information Resources Security Guidelines 1. General These guidelines, under the authority of South Texas College Policy #4712- Information Resources Security, set forth the framework for a comprehensive
UNIVERSITY OF MAINE SYSTEM STANDARDS FOR SAFEGUARDING INFORMATION ATTACHMENT C This Attachment addresses the Contractor s responsibility for safeguarding Compliant Data and Business Sensitive Information
Security Compliance Assessment Checklist ITO Security Services January 2011 V0.2 Intro This checklist is used to evaluate project compliance with the Government of Saskatchewan IT Security Standards 2010.
PDS (The Planetary Data System) Information Technology Security Plan for The Planetary Data System: [Node Name] [Date] [Location] 1 Prepared by: [Author] [Title] Date Approved by: [Name] [Title] Date 2
EASTERN OKLAHOMA STATE COLLEGE ACCEPTING AND HANDLING CREDIT AND DEBIT CARD PAYMENTS POLICIES AND PROCEDURES This document describes Eastern Oklahoma State College s policy and procedures for the proper
Vermont Information Technology Leaders HIPAA COMPLIANCE POLICIES AND PROCEDURES Policy Number: InfoSec 1 Policy Title: Information Privacy and Security Management Process IDENT INFOSEC1 Type of Document:
Newcastle University Information Security Procedures Version 3 A Information Security Procedures 2 B Business Continuity 3 C Compliance 4 D Outsourcing and Third Party Access 5 E Personnel 6 F Operations
THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ THIS CAREFULLY. DATA BREACH COVERAGE SCHEDULE OF COVERAGE LIMITS Coverage Limits of Insurance Data Breach Coverage $50,000 Legal Expense Coverage $5,000
TITLE AND INFORMATION TECHNOLOGY RESOURCES DOCUMENT # 1107 APPROVAL LEVEL Alberta Health Services Executive Committee SPONSOR Legal & Privacy / Information Technology CATEGORY Information and Technology
Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Business Continuity Management Standard for IT Systems This standard is applicable to all VCU School of Medicine
UCR Cashiering & Payment Card Services TERMINAL CONTROL MEASURES Instructions: Upon completion, please sign and return to email@example.com when requesting a stand-alone dial up terminal. The University
Cybersecurity Framework Security Policy Mapping Table The following table illustrates how specific requirements of the US Cybersecurity Framework  are addressed by the ISO 27002 standard and covered
Security Standard The security and risk management baseline for the lottery sector worldwide Updated by the WLA Security and Risk Management Committee V1.0, November 2006 The WLA Security Standard is the
Overview This policy sets out the requirements expected of third parties to effectively protect BBC information. Audience Owner Contacts This policy applies to all third parties and staff, including contractors,
SAMPLE TEMPLATE Massachusetts Written Information Security Plan Developed by: Jamy B. Madeja, Esq. Erik Rexford 617-227-8410 firstname.lastname@example.org Each business is required by Massachusetts law
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy Information Systems Acquisitions, Development, and Maintenance v1.0 October 15, 2013 Revision History Update this table every time a new
Management Standards for Information Security Measures for the Central Government Computer Systems April 21, 2011 Established by the Information Security Policy Council Table of Contents Chapter 1.1 General...
Any physical access to devices or data held in an Melbourne datacentre that houses a customer s cardholder data must be controlled and restricted only to approved individuals. PCI DSS Requirements Version
TABLE OF CONTENTS University of Northern Colorado HIPAA Policies and Procedures Page # Development and Maintenance of HIPAA Policies and Procedures... 1 Procedures for Updating HIPAA Policies and Procedures...
Information Technology Security Policy for IBTS Pakistan Stock Exchange Limited Table of contents Information Technology Security Policy for IBTS 1- INTRODUCTION AND SCOPE... 3 2- CHARTER OF THE DOCUMENT...
Guidelines 1 on Information Technology Security Introduction The State Bank of Pakistan recognizes that financial industry is built around the sanctity of the financial transactions. Owing to the critical
Supplier Information Security Addendum for GE Restricted Data This Supplier Information Security Addendum lists the security controls that GE Suppliers are required to adopt when accessing, processing,
PCI Data Security and Classification Standards Summary Data security should be a key component of all system policies and practices related to payment acceptance and transaction processing. As customers
REGULATIONS FOR THE SECURITY OF INTERNET BANKING PAYMENT SYSTEMS DEPARTMENT STATE BANK OF PAKISTAN Table of Contents PREFACE... 3 DEFINITIONS... 4 1. SCOPE OF THE REGULATIONS... 6 2. INTERNET BANKING SECURITY
goes to great lengths to ensure the security and availability of vcloud Air services. In this effort VMware has completed an independent third party examination of vcloud Air against applicable regulatory
Data Processing Agreement for Oracle Cloud Services Version December 1, 2013 1. Scope and order of precedence This is an agreement concerning the Processing of Personal Data as part of Oracle s Cloud Services
POSTAL REGULATORY COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT INFORMATION SECURITY MANAGEMENT AND ACCESS CONTROL POLICIES Audit Report December 17, 2010 Table of Contents INTRODUCTION... 1 Background...1
Notification of a Security Breach Personal Information Protection Act Information Sheet 11 Introduction Personal information is used by organizations for a variety of purposes: retail and grocery stores
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225
Information Security Policy and Handbook Overview ITSS Information Security June 2015 Information Security Policy Control Hierarchy System and Campus Information Security Policies UNT System Information
Your consent to our cookies if you continue to use this website.