OWG 60 IT Backend Systems Approved Recommendations

Transcription

1 OWG 60 IT Backend Systems Approved Recommendations 1. Recommends working with OWG 62 on developing a comprehensive inventory tracking process for the new institution inventory and record all assets purchased and operated by the University. 2. Recommends that A/V (Audio/Visual) systems in labs and classrooms on both the Kennesaw and Marietta campuses adhere to a standard experience. The standard will include the user interface present in the room as well as the technology selected when designing future implementations. Systems will be designed on requirements that reflect the needs of the customer over specific technology. All existing system will remain in place and supported until time of life cycle replacement. 3. Recommends providing a link between the Kennesaw and Marietta campuses to enable data communication and collaboration. Peachnet provides data connectivity to both sites and can provide the connection. There will be initial startup costs and a recurring monthly fee to provide a bandwidth connection of 10Gb/s. 4. Recommends annually scan backup copies of systems for Personally Identifiable Information limiting impact to production services. 5. Recommends updating existing KSU configuration standards for servers, databases, and other IT services. Updating existing KSU best practices documents for servers, databases, and other IT services. Review and update all configuration and best practice documentation no less than annually. 6. Recommends consolidating the Enterprise Primary and Secondary Data centers at both sites to provide seamless, highly available, and highly reliable services to the faculty, staff, students, graduates, alumni, and guests in accordance with the Enterprise Wide Technical Architecture documentation. 7. Recommends establishing a Database Consolidation Guideline Document to assist system administrators in implementing the consolidation strategies as decided by the various OWGs and its sub-teams who are dependent on the availability of a back-end database for their applications or services. When a consolidation strategy is decided or communicated by functional OWGs, the OWG 60 Databases & Data Stores sub-team recommends maintaining business continuity of the database or databases following policies, standards and procedures as established by the New University. 8. Recommends to: Inventory all Class-A services both at the Kennesaw and Marietta campuses Expand existing Kennesaw Campus DR Services to include services at Marietta campus Build DR/COOP Plans around replication of critical services between campus and with Athens data center Test DR Plans for specific systems no less than annually 1

2 9. Recommends working with the new institution Network administrators and Windows Domain Administrators to expand Kennesaw Campus enterprise BlackHole DNS Service preventing phishing and malicious web content to Marietta campus. 10. Recommends expanding the Kennesaw Campus BlueCat implementation which encompasses DNS, DHCP, and IPAM to include the Marietta Campus. This implementation strategy will eliminate duplication of service and consolidate all of the services into a single management system. 11. Recommends to: Select an Endpoint Security solution for workstations that meets or exceeds the solution currently in place at both sites Select an Endpoint Security solution for servers that meets or exceeds the solution currently in place at both sites 12. Recommends unifying the management of both enterprise firewalls utilizing the Palo Alto Panorama system implemented at KSU. Implement a consolidated change management process for the rule base and policy. Perform an audit in accordance with the Information Security Office Firewall Configuration and Validation recommendation to ensure that each rule base is up to date. 13. Recommends that: The new institution should use the existing Kennesaw/Marietta campus Palo Alto firewalls Firewall rule request process should be standardized and will incorporate change management Firewall administration via one interface Firewall Audit conducted annually on both firewalls 14. Recommends utilizing existing Kennesaw Campus hardware and software for forensic capture and analysis at both sites. 15. Recommends that policies will be developed which, at a minimum, encompass the current scope of policies at KSU: Computer Usage Policy / Acceptable Usage Policy Data Security Policy Usage Policy Enterprise Information Security Policy Information Security Incident Response Policy Network Access Policy New Server Policy Open Computer Lab and Technology Classroom Policy Technology Purchasing, Relocation, and Surplus Policy Telephone and Fax Policy User Accounts and Password Policy 2

3 Video Monitoring of Public Spaces Policy Video Surveillance Needs Analysis Policy Word Wide Web Publishing Policy 16. Recommends utilizing current system and workflow in place at KSU: Maintaining documentation of the security controls, service definitions, and delivery mechanisms to be included in third-party agreements and purchases. 17. Recommends consolidating the Network Schema and logical network design between both sites into a single document addressing IP address space overlap. Design a change management process to manage this document. 18. Recommends expanding and developing a centralized patch management process, which is validated by enterprise standard, which requires monthly patching of enterprise systems at both sites. 19. Recommends collaborating with PeopleSoft administrators on the security of PeopleSoft financials at SPSU, as a foundation toward working on other critical issues. 20. Recommends consolidating physical implementation practices. Standardize physical hardware that will be utilized to provide connectivity at both campuses. Any new purchases should adhere to the equipment and implementation standards. Determine and setup a consolidated network monitoring system and alert notifications Recommends that Security Education, Training and Awareness material be developed and/or updated, including but not limited to: Information Security Office Website resources Computer Security Mini Workshop Compliance workshops in partnerships with administrative and academic departments SANS Securing the Human Web modules 22. Recommends that all server operating systems remain compliant with all policies and meet the requirements as described in the Enterprise Wide Technical Architecture documentation. Server Operating systems will be reviewed and updated at both sites in accordance to the technology needs at the new university and in accordance with the Information Security Office best practices and configuration documentation. Through site to site connectivity and the extension of domain name spaces improved backups, disaster recovery, and service availability will be realized. 23. Recommends that all servers and clusters remain compliant with all policies and meet the requirements as described in the Enterprise Wide Technical Architecture documentation: All proposed servers and clusters will be reviewed and approved the IT technology review process and by the designated data center operations POC prior to procurement 3

4 All server and cluster placement with in any enterprise data center will be at the discretion of the data center operations POC Servers and clusters will adhere to all guidelines outlined with in the current device standards, life cycle replenishment, and those outlined in the EWTA Through site to site connectivity and the extension of domain name spaces improved backups, disaster recovery, and service availability will be realized. All server and cluster configurations will be adjusted to reflect the domain name of the university through server consolidation, server decommissioning, and server Life Cycle. 24. Recommends that there will be a vulnerability-scanning engine on both the Kennesaw and Marietta campuses administered by the expanded Information Security Office. Expand and refine existing new server process for consolidated institution. 25. Recommends to: Continue with Unify phone system implementation at Kennesaw Campus. Retain existing Shoretel phone system at Marietta campus with no change at this time. Provide cross training and technical support between both campuses for suture assessments toward standardization 26. Recommends working with all IT, HR staff to identify all IT services provided by the new university in order to create a comprehensive account termination list. 27. Recommends creating business processes to support self-assessment: Creating tools to support self-assessment Expand existing self-assessment spreadsheet created by the Information Security Office to include updated USG IT Handbook 28. Recommends that the necessary hardware be put in place by Information Technology to accommodate expected peak bandwidth and usage of all systems on the proposed Content Management Solution for the Enterprise. Requirements will be gathered from all owners of content management sites not using the main University content management choice. If requirements match the usage of the main content management site for the University, it is recommended that the content be moved to the main Content Management System. 29. Recommends replicating current SSID services (unique ID naming wireless networks) on both campuses, in case some of the assumptions or back end requirements has not been meet at the time of roll out. Given the relative similarities between the implementations on both campuses, is recommended to delay the unification of hardware until the next natural refreshment period (life cycle replacement). 30. Recommends that digital signage in its current implementation be left in place. Digital signage will adhere to a standard process of implementation in the new University and will be coordinated with the organization that administers the content of digital signage in the new University. 4

5 Audio/Visual will take operating requirements from the content management organization and install/implement Audio/Visual standards and best practices for hardware deployment. 31. Recommends that IT investigate the impacts to the Marietta Campus Security Network in light of these recommendations and make adjustments to the infrastructure accordingly. Specifically, IT will determine which Marietta Campus network traffic can be eliminated through Centrex monitoring and voice circuits, if the remaining traffic should be shunted to the campus primary data network, and if services should be relocated to existing campus data centers. 5