AGENCY IT SECURITY HANDBOOK

[TECHNICAL CONTROLS](#technicalcontrols)

> *The Technical Controls Handbook focuses on security controls that the
> computer* system *executes. These controls are dependent upon the
> proper functioning of the system for their effectiveness. The
> implementation of technical controls, however, always requires
> significant operational considerations -- and should be consistent
> with the management of security within the Agency.*

Version 2

###### November 2001  {#november-2001 .unnumbered}

TABLE OF CONTENTS

1\. TECHNICAL SECURITY [3](#technical-security)

1.1. PURPOSE [3](#purpose)

1.2. BACKGROUND [3](#background)

1.3. POLICY [3](#policy)

1.4. RESPONSIBILITIES [9](#responsibilities)

[2.]{.underline} [SOFTWARE]{.underline} AND DATA SECURITY
[11](#software-and-data-security)

2.1. PURPOSE [11](#purpose-1)

2.2. BACKGROUND [11](#background-1)

2.3. POLICY [11](#policy-1)

2.4. RESPONSIBILITIES [15](#responsibilities-1)

[3.]{.underline} [NETWORK]{.underline} AND COMMUNICATION SECURITY
[17](#network-and-communication-security)

3.1. PURPOSE [17](#purpose-2)

3.2. BACKGROUND [17](#background-2)

3.3. POLICY [17](#policy-2)

3.4. RESPONSIBILITIES [25](#responsibilities-2)

4\. APPENDIX A [26](#appendix-a)

4.1. ACRONYMS [26](#acronyms)

5\. APPENDIX B [27](#appendix-b)

5.1. GLOSSARY [27](#glossary)

6\. APPENDIX C [34](#appendix-c)

6.1. REFERENCES [34](#references)

# TECHNICAL SECURITY

## PURPOSE

### This chapter provides policy and guidance to implement [technical controls](#technicalcontrols) that will reduce the exposure of computer equipment and assist in achieving an optimum level of protection for the Agency information technology (IT) [system](#system)s.

### The policy contained in this chapter covers all the Agency IT resources maintained in-house or in the interest of the Agency. These policies are mandatory on all organizational units, employees, contractors, and others having access to and/or using the IT resources of the Agency.

### This policy applies to all [automated information system](#automatedinformationsystem)s currently in existence and any new automated technology acquired after the effective date of this policy document.

## BACKGROUND

### The issues that will be covered in this chapter under technical security are: 

-   [Identification](#identification) and
    [Authentication](#authentication)

-   Authorization/ [Access Control](#access-control)

-   [Audit Trail](#audittrail)s

### Identification and Authentication are critical building blocks of computer security since they are the basis for most types of access control and for establishing user accountability. Identification and Authentication are technical measures that prevent unauthorized people (or unauthorized processes) from entering an automated information system. Access control usually requires that the system be able to identify and differentiate among users. Access control is based on [least privilege](#leastprivilege), which refers to the granting to users of only those accesses minimally required to perform their duties. User accountability requires the linking of activities on a system to specific individuals and therefore, requires the system to identify users.

### Access to the Agency's IT resources must be managed by a combination of technical and administrative controls. Uniform policy for access control across all the Agency systems and [network](#network)s is needed to support today's highly inter-connected environment and ensure that weaknesses at one facility do not place all the Agency information assets at unnecessary [risk](#risk). These controls will ensure that only authorized individuals gain access to information systems resources, that these individuals are assigned an appropriate level of privilege and that they are individually accountable for their actions. Access will be controlled and limited based on positive identification and authentication mechanisms. 

## POLICY

### Identification is the means by which a user provides a claimed identity to the system. The most common form of identification is the user ID.

#### [Unique Identification]{.underline}. Every Agency information system must ensure that users are uniquely identified before being allowed to perform any actions on the system.

#### [Correlate Actions to Users]{.underline}*.* Each system must internally maintain the identity of all active users and be able to link actions to specific users.

#### [Maintenance of User IDs]{.underline}: 

-   Offices and facilities must ensure that all user IDs belong to
    currently authorized users

-   Identification data must be kept current by adding new users and
    deleting former users

-   Inactive User IDs. User IDs that are inactive for 90 days must be
    disabled

### Authentication is the means of establishing the *validity* of this claim. There are three means of authenticating a user's identity *which can be used alone or in combination*: something the individual knows (a secret --e.g., a [password](#password), Personal Identification Number (PIN), or cryptographic key); something the individual *possesses* (a token -- e.g., a bank's ATM card or a [smart card](#smartcard)); and something the individual *is* (a biometric -- e.g., characteristics such as a voice pattern, handwriting dynamics, or a fingerprint).

#### [Require Users to Authenticate]{.underline}*.* Users must authenticate their claimed identities on all IT resources. 

#### [Limit Log-on Attempts]{.underline}*.* [The Agency facilities](#narafacilities) must limit the number of log-on attempts to five (5). This helps to prevent guessing of authentication data. Where round-the-clock system administration service is available, [system administrator](#systemadministrator) intervention will be required to clear a locked account. Where round-the-clock system administration service is not available, accounts will remain locked out for at least ten (10) minutes.

#### [Administer Data Properly]{.underline}*.* The Agency facilities must have procedures to disable lost or stolen passwords and must monitor systems to look for stolen or shared accounts.

#### [Passwords]{.underline} - Acceptable passwords must be carefully chosen by the user and enforced by the system. Controls must be implemented to require strong passwords. 

#### Acceptable passwords must include each of the following characteristics:

-   Letters - Upper or Lower Case Letters (A, B, C,.....Z, a,
    b,c,......z)

-   Westernized Arabic Numerals (0, 1, 2.....9)

-   Non-alphanumeric "special characters." For example, punctuation or
    symbols. (\[};"!\$=)

#### At a minimum, user passwords must be at least **8** characters long.

-   The password must not contain the user's e-mail name, user ID or the
    full name as shown in the domain registry.

-   New passwords shall never be the same as any of the last 3
    passwords.

-   The password must not contain dictionary words from any language
    because numerous password-cracking programs exist that can run
    through millions of possible word combinations in seconds. Simply
    adding a number onto the end of a word is not sufficient. The
    numeric and/or special characters should be integrated into the
    password. However, a complex password that cannot be broken is
    useless if you cannot remember it. For security to function, you
    must choose a password you can remember and yet is complex. For
    example, Msi5!Yold (My son is 5 years old) or IhliCf5#yN (I have
    lived in California for 5 years now).

-   Passwords must be stored in irreversible encrypted form and the
    password file cannot be viewed in unencrypted form.

-   A password must not be displayed on the data entry/display device.

-   [Operating system](#operatingsystem)s, systems software, and other
    systems at high risk of compromise are sometimes installed with a
    standard set of [default](#default) accounts and associated standard
    passwords. Like all accounts, these access routes must be protected
    by strong passwords. Additional measures, such as disabling,
    renaming, or decoying these standard accounts, will be employed.

-   During the first instance of access with a new account, the initial
    password must be changed by the individual responsible for the
    account, in compliance with the password controls defined in this
    policy.

-   The proper and secure use of passwords must be included in user
    training.

#### If system-supplied password generation is available, it must enforce the above requirements and also include the following additional features:

-   The system will give the user a choice of alternative passwords from
    which to choose.

-   Passwords will be reasonably resistant to brute-force password
    guessing attacks.

-   The generated sequence of passwords will have the property of
    randomness (i.e., consecutive instances shall be uncorrelated and
    the sequences shall not display within a predictable time period).

### **Access Control/Authorization** - Access is the ability to perform a function with a computer resource (e.g., use, change, or view). Access controls are the system-based means by which the ability is explicitly enabled or restricted in some way. Access controls can prescribe not only who (a user) or what (a process) is to have access to a specific system resource, but also the level of access that is permitted. 

#### The Agency facilities must establish a process to authorize and document access privileges based on a legitimate and demonstrated need to have system access. 

#### Access privilege documentation must be maintained in a manner that makes it easily retrievable by individual user account. 

#### Prior to initial account distribution, positive identification of individuals receiving accounts must be conducted. Positive physical identification can be done by anyone the system administrator can trust to perform this task. For example, if an employee needs access to a system located off-site, the employee's supervisor can make positive physical identification of the employee and request access via electronic mail. During the first instance of access with a new account, the initial password must be changed by the individual responsible for the account, in compliance with the password controls defined in this policy.

#### When system users are no longer part of an organization, or their duties change, their account access must be appropriately modified or terminated. Requests to change access privileges must be signed and forwarded to the appropriate designated individual by the responsible manager. (See Chapter 1 "Personnel/User Security" in the Agency Operational Handbook).

##### The default "Guest" account on servers and workstations will be disabled. Use of Guest-type accounts is strongly discouraged but, if needed, these accounts must conform to the naming conventions and the password policy established in this policy.

##### In NT operating systems, the Security Account Manager (SAM) must be protected using the System Key option.

##### The Agency facilities must control access to resources based on the following access criteria, as appropriate:

-   *Identity* (user ID). The identity must be unique in order to
    support individual accountability.

-   *Roles.* Access to information must also be controlled by the job
    assignment or function (i.e., the role) of the user who is seeking
    access.

-   *Location.* Access to particular system resources will be based upon
    physical or logical location.

-   Access would be denied for a sixth user, even if the user were
    otherwise authorized to use the application.

-   *Access Modes.* The Agency facilities will consider the types of
    access, or access modes. Common access modes, which can be used in
    both operating and application systems, include read, write,
    execute, and delete.

#### Access Control Mechanisms. The Agency facilities must implement both internal and external access control mechanisms. *Internal* access controls are a logical means of separating what defined users (or user groups) can or cannot do with system resources. *External* access controls are a means of controlling interactions between the system and outside people, systems, and services. When setting up access controls, the Agency facilities shall incorporate the following mechanisms where appropriate and applicable:

-   *Access Control Lists (ACLs)*. ACLs are a register of users
    (including groups, machines, and processes) who have been given
    permission to use a particular system resource and the types of
    access they have been permitted. The Agency facilities will maintain
    Access Control Lists and establish a procedure to identity and
    remove users who have left the organization or whose duties no
    longer require access to the application. Access Control Lists will
    be reviewed regularly.

-   *Constrained [User Interface](#userinterface)s.* The Agency
    facilities will restrict access to specific functions by never
    allowing users to request information, functions, or other resources
    for which they do not have access.

-   *[Encryption](#encryption).* Encrypted information can only be
    decrypted, and therefore read, by those possessing the appropriate
    cryptographic key. While encryption can provide strong access
    control, it is accompanied by the need for strong key management.
    Encryption will be utilized where appropriate and available.

-   *[Port Protection Device](#portprotectiondevice)s.* Fitted to a
    communications [port](#port) of a host computer, a port protection
    device (PPD) authorizes access to the port itself, often based on a
    separate authentication (such as a dial-back [modem](#modem))
    independent of the computer's own access control functions.

-   *Secure [Gateway](#gateway)s/[Firewall](#firewall)s.* Secure
    gateways block or filter access between two networks (e.g.
    [Intranet](#intranet), [Internet](#internet), universities,
    contractors, vendors, and other federal agencies). Secure gateways
    allow internal users to connect to external networks while
    protecting internal systems from compromise. Additional information
    and requirements regarding gateways and firewalls are contained in
    the "Network" Chapter of this Handbook and on the Agency's
    Information Security web site.

-   *Host*-*Based Authentication*. Host-based authentication grants
    access based upon the identity of the host originating the request,
    instead of the identity of the user making the request. the Agency
    facilities shall use network applications utilizing host-based
    authentication where appropriate and available.

-   *System Log-On Banner.* A security log on banner is incorporated on
    all networked systems. This is displayed to users as part of the log
    on dialogue, followed by a pause requiring manual intervention to
    continue. The Agency NET banner displayed each time a user logs on
    to the Agency NET is a reminder that any use of the Agency
    information technology resources is made with the understanding that
    such use is generally not secure, is not private, and is not
    anonymous. See the Agency 802.10, Appropriate Use of the Agency
    Office Equipment.

> *WELCOME TO THE AGENCY*
>
> This is a United States Government system operated and maintained by
> the Agency . We encourage you, as an Agency employee, researcher,
> contractor, or member of the public, to use this system. You should
> not expect privacy while using this system and your activity may be
> monitored to protect the system from unauthorized use. Authorized
> employees have the right to examine active and stored email and files
> within all systems. By using this system you expressly consent to such
> monitoring and to reporting your unauthorized use to the proper
> authorities. Unauthorized use of this system is a violation of Federal
> law 18 U.S.C. Section 1030. Unauthorized access may be prosecuted to
> the full extent of the law.

### ***[Audit Trail](#audittrail)s*** - Audit trails maintain a record of system activity by system or application processes and by user activity. In conjunction with appropriate tools and procedures, audit trails provide a means to help accomplish several security-related objectives, including individual accountability, reconstruction of events, intrusion detection, and problem identification. 

#### The Agency facility audit trails will be used for the following:

-   Individual Accountability. The audit trail supports accountability
    by providing a trace of user actions. While users cannot be
    prevented from using resources to which they have legitimate access
    authorization, audit trail analysis can be used to examine their
    actions.

-   Reconstruction of Events. The Agency will use audit trails to
    support after-the fact investigations of how, when, and why normal
    operations ceased.

-   Intrusion Detection. The Agency facilities will design and implement
    their audit trails to record appropriate information to assist in
    intrusion detection. Intrusions can be detected in [real
    time](#realtime), by examining audit trails as they are created or
    after the fact, by examining audit records in a batch process.

-   Problem Identification. The Agency facilities will use audit trails
    as online tools to help identify problems other than intrusions as
    they occur. This is often referred to as real-time auditing or
    monitoring.

-   The Agency ISO must be notified of all investigative audits of IT
    resources.

#### Contents of Audit Trail Records. An audit trail must include sufficient information to establish what event occurred and who (or what) caused them. The scope and contents of the audit trail will balance security needs with performance needs, privacy, and costs. At a minimum the event record must specify:

-   Type of event

-   When the event occurred (time and day)

-   User ID associated with the event

-   Program or command used to initiate the event

#### Audit Trail Security. The Agency offices and facilities will protect the audit trail from unauthorized access. The following precautions will be taken:

-   Control online audit logs. Access to online audit logs will be
    strictly controlled.

-   [Separation of duties](#separationofduties). The Agency facilities
    will ensure separation of duties between security personnel who
    administer the access control function and those who administer the
    audit trail.

-   Protect confidentiality. The Agency offices and facilities will
    ensure the confidentiality of audit trail information.

#### Audit Trail Reviews. Audit trails will be maintained, at a minimum, for six months. The following must be considered when reviewing audit trails:

-   Recognize normal activity. Reviewers must know what to look for to
    be effective in identifying unusual activity. They need to
    understand what normal activity looks like.

-   Utilize a search capability. Audit trail review can be easier if the
    audit trail function can be queried by user ID, device ID,
    application name, date and time, or some other set of parameters to
    run reports of selected information.

-   Follow-up reviews. The appropriate system administrator will review
    the audit trails following a known system or application software
    problem, a known violation of existing requirements by a user, or
    some unexplained system or user problem.

-   Develop review guidelines. Application owners, data owners, system
    administrators, and the ISO will determine how much review of audit
    trail records is necessary, based on the importance of identifying
    unauthorized activities.

#### Automated tools. Traditionally, audit trails are analyzed in a batch mode at regular intervals (e.g., daily). Audit analysis tools, such as those based on audit reduction, attack signature, and variance techniques, can be utilized in real-time or near real-time fashion. the Agency facilities should use the many types of tools that have been developed to help reduce the amount of information contained in audit trails, as well as to distill useful information from the raw data.

#### All the Agency information systems must have the ability to audit password activity, specifically when and who last changed a password, and when and who last changed account privileges.

#### Annually, individual accounts must be audited to ensure compliance with the minimum standards outlined in this policy.

### The Agency IT systems that cannot meet these minimum standards must be modified to remedy any deficiencies. Until such time as deficient systems are brought up to these security standards, [system owners](#systemowner), as part of their OMB mandated A-130 security plans and risk assessments, must accept in writing any risk to the Agency Enterprise.

## RESPONSIBILITIES

### **The Agency CIO.** Ensures that the provisions of this chapter are implemented at all facilities within the Agency.

### **Office Heads, and Facility Directors.** Ensure that adequate technical security controls are implemented on all systems for which they hold responsibility.

### **The Agency CIO**: 

#### Certifies the systems under their control. The technical controls must be in place and functioning as intended, prior to certification of the system. 

#### Ensures that during the development and acquisition phase of developing local systems that security requirements and specifications are incorporated into any purchase of [automated information system](#automatedinformationsystem)s.

### **System administrators**: 

#### Ensures that the technical controls are functioning as expected and report any significant discrepancies noted to the ISO. 

#### Monitors the system by reviewing system logs and utilizing various automated tools such as virus scanners, check-summing, password crackers, integrity verification programs, intrusion detectors, and system performance monitoring.

#### Evaluates account and password [management controls](#managementcontrols) yearly to ensure that the Agency password policy is being technically implemented.

#### Ensures that the ISO is notified of all investigative audits of IT systems.

### **ISO/AISO**:

#### Assists the the Agency CIO in performing sensitivity assessments and in determining security requirements and specifications for technical controls in any new systems to be purchased and operated at the facility. 

#### Audits the technical controls. This can be accomplished by conducting regular audits of the system. The ISO must work with the system manager and the the Agency CIO in developing effective measures to audit the various systems in a facility.

#### Develops procedures and policy concerning authorizing and documenting access privileges for users based on a legitimate and demonstrated need to have system access.

### **Individual users:** Select strong passwords in accordance with this policy. 

# SOFTWARE AND DATA SECURITY

## PURPOSE 

### This chapter provides security guidance on software selection, development, testing, implementation and maintenance of the Agency software. 

### Security controls for operating system and application software are detailed below and are applicable to all software (the Agency developed and [Commercial Off-The-Shelf (COTS)](#cots)) used in the Agency IT resources. 

## BACKGROUND 

### The Agency currently buys COTS software. Security controls must be met in these circumstances to ensure that mission critical and all other sensitive data is established, maintained, transported and utilized in a secure manner.

## POLICY

### General Software Security Elements are:

#### [Controlling what software is used on a system]{.underline}

-   All COTS application software purchases must be certified and
    accredited prior to use.

-   Application software used on the Agency IT resources must be
    obtained through authorized procurement channels.

-   Each system installation of the Agency developed or off-the-shelf
    software must be reviewed and approved by the review board prior to
    installation. This also includes software acquired by any other
    means (e.g., public domain software, bulletin board services,
    personally owned software, Internet obtainable freeware). See the
    Agency 802, Appropriate Use of the Agency Office Equipment and the
    Agency 815, New Desktop Software Requests.

-   All application software authorized to run on the Agency IT resource
    must be identified in the system's [security plan](#securityplan).

#### [Ensuring that software has not been modified without proper authorization]{.underline}

-   Willful and intentional modification of the Agency software for
    illegal or disruptive purposes or for personal gain is a crime.
    There must not be any modifications of these programs except by an
    authorized agent of the CIO.

-   Safeguards must be in place to detect and minimize inadvertent or
    malicious modification or destruction, or attempts to do so, of the
    Agency's IT application software, operating system software, and
    critical data files. The safeguards should achieve the integrity
    objectives and be documented in the system's security plan. The
    level of protection must be commensurate with the sensitivity of the
    information processed.

-   Approved software, regardless of source, must be scanned for viruses
    prior to initial use.

-   Anti-Virus and malicious code (software) must be employed on every
    the Agency IT resource to protect the integrity of the software and
    data.

#### [Ensuring that software is properly licensed, as required]{.underline}

-   Use of copyrighted software will comply with copyright laws and
    license agreements.

-   The Agency licensed software may not be installed on other systems
    without management approval (e.g. anti-virus software).

### **Operating System Software Controls**. The operating system software employed to process data by multiple users, including [local area network](#localareanetwork)s, must control user access to resources and capabilities that are required and authorized. The operating system software should also have the capability to identify, journal, report, and assign accountability for the functions performed or attempted by a user and to deny user access to capabilities or resources that have not been authorized. At a minimum, the operating system must:

#### Control all transfers between memory and on-line storage devices between a central computer and remote devices and between on-line storage devices.

#### Control all operations associated with allocating system resources (e.g. memory, [peripheral device](#peripheraldevice)s, etc.), memory protection, system interrupts and changes between the privileged and non-privileged states.

#### Identify a valid system user and direct the user to authorized options or applications. Use of such a feature (log-on dialogue) limits user access and protects system programs and data files from unauthorized access.

#### Provide the capability to limit the types of operations (e.g., read, write, and delete) that can be performed by individual users on given data or program files.

#### Control system access through an approved form of user authentication. 

#### Provide the capability to record actual or attempted access to the system and other activity.

#### Provide the capability to terminate a process automatically and log-off a user when an access session remains inactive for some specified length of time.

#### Provide the capability upon a break of connection or a log-off to terminate an access session.

#### Control programs or utilities which may be used to maintain and/or modify the operating system, access control systems, sensitive databases and other software modules which could affect or compromise the integrity of the general purpose software or sensitive applications.

#### Prevent a user program from executing privileged instructions.

#### Isolate the programs and data areas of one user from those of other users and the operating system software.

#### Assure error detection when accessing memory as well as [parity](#parity) and hardware register checking.

#### Cause a screen warning message to be displayed at logon to identify to the user that access is restricted to authorized users for legitimate purposes only and that their activities are subject to monitoring.

#### Be maintained by the minimum number of authorized persons. This is accomplished by limiting the number of employees with administrative privileges.

#### Be copied after each modification with the copy to be immediately stored as a backup for emergency use.

### **Application Software Controls**. An application that processes sensitive data, or requires protections because of the risk and magnitude of loss or harm that could result from improper operation, manipulation or disclosure must be provided protection appropriate to its sensitivity. The following will be considered as the minimum controls to be applied to sensitive applications, with additional controls or safeguards to be imposed if appropriate:

#### The Agency approved security requirements and specifications will be defined prior to acquiring or starting development of applications, or prior to making a substantial change to the existing application.

#### Design reviews will be conducted at periodic intervals during the developmental process to assure that the proposed design will satisfy the functional and security requirements specified.

#### New or substantially modified sensitive applications must be thoroughly tested prior to implementation to verify that the user functions and the required administrative, technical, and physical safeguards are present and are operationally adequate. This is to be accomplished as part of the certification and accreditation process.

#### Sensitive data or files will not be used to test applications software until software integrity has been reasonably assured by testing with non-sensitive data or files.

#### Sensitive application software will not be placed in a production status until the system tests have been successfully completed and the application has been properly certified and accredited. Prototypes that process production data must be certified and accredited before they are deployed or implemented.

#### Current [backup](#backup) copies of critical application software, documentation, data bases and other resources required for its operation, will be maintained and be readily available for use in the event of an emergency.

#### Sensitive applications will be re-certified every three years or following major changes.

#### Sensitive software documentation must be provided the same degree of protection as that provided for the software.

### **Software Security Implementation Procedures**. Software designed to provide information security is limited by the effectiveness of the procedures implemented to support it. Procedural issues, which relate to the use of the system software and which should be addressed, are as follows: 

#### A minimum length of eight characters is required for passwords. The minimum length will be software controlled. 

#### [Default](#default) User Accounts. Operating systems are sometimes installed with a standard set of default user accounts and associated standard security passwords. The access route shall be protected by either disabling the standard user account or by changing the passwords.

#### All security problem fix software, patches, command scripts, and the like provided by vendors, official computer emergency response teams (CERTs), and other trusted third parties must be promptly installed and documented. 

### **Processing Environments**. The Agency automated information systems use several processing environments that meet the specific and varied needs of users. Following are descriptions of processing environments and the unique information security aspects related to them: 

#### [Production environment]{.underline} is the environment for the processing of official data utilized in support of office and facility missions and management. Information security procedures for production environments must specifically address controls for: 

-   Viewing, modifying, downloading or deleting production system data
    and programs

-   Generation and disposition of outputs

-   Tracking production program version changes (maintenance of a
    software update history log is required under [configuration
    management](#configurationmanagement) discussed in Chapter 4 of the
    Agency Operational Controls Handbook)

-   Access to the computer and its peripheral devices

#### [Development and Verification]{.underline} is the environment for the development, testing, and verification of program code for the maintenance, modification or enhancement of existing applications, or the development of new applications. Information security procedures for this environment must specifically address controls for: 

-   Viewing, modifying, or deleting test data

-   Creating, viewing, modifying, or deleting development programs

-   Generation and disposition of outputs

-   Transfer of application programs and data files from the development
    and verification environment to the production environment

-   The computer system and its peripheral and telecommunication devices

#### [Demonstration and/or Training]{.underline} enables use of system or application software functions in an on-line mode (using production or development computer resources) without affecting the production or development environments. The demonstration and/or training environment must simulate on a demonstration or training disk, the production environment and use non-sensitive data to test, train, or demonstrate the system. Information security procedures for this environment must specifically address: 

-   Protecting production and development system programs and data files

-   Accessing the \"Demonstration\" account by the general public (other
    than the Agency staff)

-   Limiting user access to only those capabilities necessary to utilize
    the demonstration programs

-   Limiting access to the computer and its peripheral and
    communications devices

-   Generic access codes may be used to enter the \"Demonstration\"
    environment and is the only exception to the mandated requirement
    for individual password codes

## RESPONSIBILITIES

### **Agency Software Developers**: 

#### Ensure that security controls are incorporated in the design, development, and testing of contractor-developed software.

#### Ensure that the Agency developed application software and patches are certified prior to release to the agency.

### **Agency CIO, Technical Services, or designee**:

#### Accredit all the Agency software and patches prior to release to the agency

#### Ensure that all the Agency facilities are in compliance with the policy outlined in this chapter.

### **Office Heads, and Facility Directors:** Ensure that adequate application security controls on locally purchased application software are implemented at their sites.

### **tAgency CIO**:

#### Ensures that the operating system and application software security controls on all software used throughout the agency meet the Agency requirements.

#### Ensures that any COTS applications purchased by offices and regional facilities meet the Agency security controls.

### **System administrators**:

#### Maintain the software utilized on their systems.

#### Ensure that the operating system and application software controls are operating as intended on the systems under their responsibility.

#### Install all problem fix software, patches, command strips on appropriate systems in a timely manner.

### **ISO/AISO**:

#### Ensure that locally procured software has been approved by the review board and certified and accredited by the office head or facility director.

#### Audit to ensure that software (application and operating system) controls are in place and functioning as designed. 

# NETWORK AND COMMUNICATION SECURITY

## PURPOSE 

### This chapter provides guidance and policy related to network and communication security for the Agency sites. Independent Internet gateways, electronic mail, [facsimile](#facsimile) (fax) transmissions, [local areas networks](#localareanetwork) (LANs), and [wide area network](#wideareanetwork)s (WANs) need security controls established to ensure the confidentiality, integrity, and availability of the data being transmitted.

### The policy contained in this chapter covers all the Agency IT resources maintained in-house or in the interest of the Agency. These policies are mandatory on all organizational units, employees, contractors, and others having access to and/or using the IT resources of the Agency.

### This policy applies to all the Agency automated information systems processing sensitive data currently in existence and any new automated technology acquired after the effective date of this policy document.

## BACKGROUND

### Network security is not any different from single host security in terms of confidentiality, integrity, and availability of resources. The real difference in providing basic security services occurs because of the increased complexity of the networked environment. Providing confidentiality of information, for example, is difficult enough when the entire system resides in a single room. Consider the implications of allowing access to information from multiple locations both inside and outside of the Agency. Security for a single host is generally the responsibility of a single individual. In a networked environment, the security of individual systems is the responsibility of numerous individuals. Intruders to networks continually count on finding a single weak link in the network chain that will then allow them access to the rest of the network. Network security measures must account for this, as well as other complexities, in an attempt to maintain the security of the network data and resources.

## POLICY

### **General** **Network Policy**

#### The Agency safeguards must ensure the privacy of sensitive information during storage, processing, and transmission. {#the-agency-safeguards-must-ensure-the-privacy-of-sensitive-information-during-storage-processing-and-transmission. .unnumbered}

#### The Agency users will be granted access to the Agency networks based upon duty requirements and the need to access resources.

#### The Agency facilities will implement the necessary mechanisms and procedures to protect information processed on networks, to include:

-   Maintaining a record of authorized users of a network and their
    network privileges and reviewing this record on a regular basis to
    ensure that access to the network is limited to only those
    individuals with a justified need.

-   Ensuring that all networks are certified and accredited. (See
    Management Controls Handbook for details)

-   Ensuring that computer systems are configured to terminate a user
    process if that user-network connectivity is interrupted before a
    proper log out.

-   Ensuring that the network and systems automatically terminate
    sessions after periods of inactivity.

-   Establishing individual accounts for each user on the network.
    "Generic accounts" that allow users access to network resources
    anonymously, are prohibited.

-   Establishing formal reporting procedures for unexpected events and
    activity.

### **External Connections**. An external connection is any connection (not just an Internet connection) from an outside network (a source other than the Agency) that is electronically linked to a system or network that is owned or operated by or in behalf of the Agency. 

#### External connections must incorporate adequate controls to safeguard the Agency IT resources. 

#### At a minimum, all external connections must incorporate a [firewall](#firewall). Network firewalls are devices used to protect a trusted computer network from an untrusted one. 

#### The Agency policy has established the following as the minimum specifications for a firewall:

##### Configuration and Installation:

-   Activate the minimum set of operating system services to support
    firewall operation. Activate no other operating system services.

-   Configure the firewall computer's operating system with all current
    patches and plugs to known exploits.

-   Support high availability configurations and load balancing through
    integrated capabilities or by integration of third party products.

-   Configure the firewall so that it cannot be identifiable as such to
    other network(s), or, at most, appears to be just another
    [router](#router).

-   Disguise or hide internal Domain Name Systems (DNS) to prevent
    direct external requests.

-   Ignore service requests like "echo" or "chargen" that could be used
    in a denial of service attack.

-   Prevent network connections from bypassing the firewall.

-   Be installed in locations that are physically secure from tampering.

##### Access Management: 

-   Restrict use of a particular application only to customers
    authorized to access the application.

-   Implement a "deny all services except those specifically permitted"
    design policy.

-   Implement two-factor authentication for administrative log-in to
    permit secure remote log-in by the authorized system administrator.

-   Support integration of external authentication databases, such as
    RADIUS or [LDAP](#ldap).

-   Employ techniques such as content filtering to permit or deny
    services to specific external hosts, such as web sites that the
    Agency staffs are restricted from accessing.

-   Incorporate and operate a systematic method of intrusion detection.
    Data from intrusion detection must be stored such that it can serve
    as evidence in forensic investigations.

##### Auditing and Filtering

-   Log access to and through the firewall.

-   Capture log-in attempts by authorized and unauthorized
    [user](#user)s.

-   Employ a flexible, user-friendly IP-filtering language that is easy
    to program and can filter on a wide variety of attributes, including
    source and destination IP addresses, protocol types, port numbers,
    and inbound and outbound interfaces.

-   Screen data coming through the firewall.

-   Concentrate, filter, and log dial-in access.

-   Generate an audit trail of calls passing through the firewall for
    review of security anomalies at future times.

-   Support third-party products for log analysis and data reduction.

### **Notification**

#### Provide notification of threats, including unsolicited distribution of executable files, and notification of efforts by accepted users to gain access to systems or applications that they do not have permission to enter. 

#### Generate alarms, predicated on the occurrence of a specific event or combination of events, on a timely basis (e.g., within 60 seconds) after the event occurs.

### **Future** **Security** **Enhancements**

#### Accommodate new services and needs to allow for changes in the Agency and the Agency security policy.

#### Contain advanced authentication measures, or the hooks for installing advanced authentication measures, if strong authentication for inbound access is required. 

#### External connections must be accredited prior to use. 

#### External connections will be periodically independently reviewed by an organization other than that which sponsors the use and administration of the external connection. These reviews will be conducted when there is significant change to the protected asset, or at least every other year after initial accreditation. These reviews will ensure that external connections remain in compliance with the minimum security standards outlined in this policy, and will ensure that risk assessments, security plans, and contingency plans remain current.

#### Where user access originates from outside the internal the Agency protected network, all users must be identified and authenticated at the gateway prior to being granted access to internal resources.

#### Where sensitive data is to be accessed from or through untrusted networks, the entire session must be encrypted.

### **Internet/Public** **Access**

#### There are several methods available for connecting to the Internet system. They include, but are not limited to purchasing a commercial service, establishing an independent gateway or connecting through the Agency Internet Gateways.

#### The Agency Internet Gateways have been established as a common resource for all the Agency facilities to use. The Agency Internet Gateways are provided to support information sharing, research, and education in and among the Agency facilities, research and instructional institutions, and other government agencies and commercial services. Although use of the Agency Internet Gateways is not mandatory, the Agency sites are strongly encouraged to use these systems for conducting business with the Internet community. 

#### Those sites electing to establish their own connection to the Internet or to other networks external to the Agency (i.e., universities, vendors, other government agencies) must meet all of the security requirements established by the Agency. 

#### The Agency must approve external connections prior to operation. 

#### The Agency employees are expected to conduct themselves professionally in the workplace and must not use the Internet for activities that are inappropriate or offensive to co-workers or the public. Such activities include playing electronic games, or accessing sexually explicit materials or materials that ridicule others on the basis of race, creed, religion, color, sex, disability, national origin or sexual orientation.

#### Employees must ensure that all sites accessed have no cost attached. For example, a prompt to enter a special password, or to register prior to entering the database may indicate that it is fee-based.

#### Government-issued credit cards must not be used for personal access to the Internet, or to purchase items from the Internet for personal use.

#### Employees must not use dial-out modems to connect to commercial Internet service providers, such as America Online. If exceptions are required, approval must be obtained from senior management.

#### Employees using the Agency resources to access the Internet are subject to monitoring. Incidents of inappropriate access will be reported to supervisors and the ISO for disciplinary action.

#### All software and files downloaded from non-the Agency sources via the Internet (or any other public network) must be screened with virus detection software. The screening must take place prior to being run or examined via another program such as a word processing package.

#### All public access systems will be located outside the internal the Agency network.

#### Systems that are exposed to the Internet, such as the Agency public access systems, will not be permitted direct access to the internal the Agency network.

### **Modem** **communications** 

#### Data communication connections via modems are to be limited and tightly controlled as they pose a serious risk that can circumvent security controls intended to protect the Agency networks from external, "untrusted" networks. 

#### Employees are prohibited from connecting dial-up modems to the Agency workstations that are simultaneously connected to the Agency's network or another internal communication network.

#### Remote users (telecommuters and employees on travel) dialing into the Agency systems must be routed through a modem pool that includes an approved extended user authentication security system.

#### Reliable and confidential hardware and software authentication systems are to be incorporated into the Agency approved communication servers. Positive authentication is to be established prior to granting access to network resources.

#### Event logging functions are to be provided to enable a review of suspicious activities.

#### Controls are required for remote access to the Agency systems. A log will be maintained and reviewed quarterly of individuals granted remote access to ensure that accountability is maintained.

### **Electronic Mail** (email)

#### Only authorized email software may be used.

#### The Agency employees who utilize email systems will do so with the understanding that they have no expectation of personal privacy relating to that use.

#### When appropriately authorized by management, electronic mail messages flowing through the Agency systems may be monitored for internal policy compliance, suspected criminal activity, and other systems management reasons.

#### The Agency users are prohibited from sending or forwarding any messages via the Agency's information systems that a reasonable person would consider to be defamatory, harassing, or explicitly sexual. Employees are also prohibited from sending or forwarding messages or images via the Agency systems that would be likely to offend on the basis of race, gender, national origin, sexual orientation, religion, political beliefs, or disability.

#### When employees receive unwanted and unsolicited e-mail (also known as [SPAM](#spam)), they must refrain from responding directly to the sender. Instead, forward the message to the email administrator who will take steps to prevent further transmission.

#### The Agency projects and commercial products for secure electronic mail (email) systems are undergoing rapid development and will be available in the near future. Until such products are implemented, users must not send sensitive information via email.

#### The Agency system administrators establish and maintain a systematic process for the retention and destruction of electronic mail messages and accompanying logs. 

#### Users must regularly move important information from electronic mail message files to word processing documents, databases, and other files. Electronic mail systems are not intended for the archival storage of important information. Stored electronic mail messages are periodically expunged by system administrators, mistakenly erased by users, and otherwise lost when system problems occur.

### **Telecommuting** **Security** 

#### The security of the Agency property at an alternative work site (i.e., home, hotel, etc.) is just as important as it is at the Agency facility. At alternative work sites, reasonable precautions must be taken to protect the Agency hardware, software, and information from theft, damage, and misuse.

#### Users must not discard sensitive information at home, in hotel wastebaskets or other publicly accessible trash containers. Instead, sensitive information must be retained until it can be shredded, or destroyed by other approved methods.

#### Telecommuters must ensure that the systems they utilize remotely maintain the current anti-virus software.

#### Remote users should not maintain sensitive data on their systems unless adequately secured via [encryption](#encryption) or authenticated access control mechanisms. This is especially important if the system is also used to connect to the Internet.

#### Telecommuters must use the password facility in their screen saver.

#### Only authorized telecommuters will be given access to the Agency's networks. Managers must take steps to ensure that telecommuting employees do not compromise the integrity of the Agency systems.

#### Telecommuters must be authenticated prior to access to the Agency's network. Where possible, user access should be limited to specific systems specified during the log-in process.

#### Sensitive data should not be transmitted unless appropriately secured via encryption.

#### Employees are responsible for the integrity and confidentiality of the data on remote systems. Access controls must be in place to protect the Agency systems and electronic information located at remote sites (i.e., home, telecommuting work locations, hotels and convention centers).

### **Facsimile** **(fax)** **transmission**

#### Sensitive information will only be transmitted via a secure facsimile system (e.g., encrypted or via a protected network). Commercial-off-the-shelf (COTS) software and hardware are available to provide the necessary safeguards and should be employed as appropriate.

#### Each office and facility should develop policies and procedures to protect privacy while transmitting information via facsimile. The policy and procedures must:

-   Limit use to urgent situations

-   Ensure appropriate location of facsimile machines

-   Assign accountability for managing each facsimile machine

-   Define appropriate safeguards to ensure transmissions are sent to
    the appropriate individual

-   Define procedures for cases of misdirected transmissions and
    receipts

-   Routine disclosure of information should be made through regular
    mail or courier

-   Autofaxing, which allows automatic facsimile transmission of
    reports, should be set up carefully to ensure that they are
    necessary and that correct facsimile numbers are contained in the
    system

-   A cover letter should accompany each transmission and include:

-   Date/time transmission

-   Sending facility's name, address, telephone and facsimile numbers

-   Authorized receiver's name

-   Number of pages transmitted

-   Confidentiality notice, including instructions on re-disclosure and
    destruction

#### A procedure must be developed to cover instances when a site is notified that a fax was received by other than the intended recipient. The internal logging system of the facsimile machine should be checked to obtain the number to which the transmission was sent in error. If the number was incorrect a facsimile should be sent to that number explaining that the information was misdirected and ask for the documents to be returned by mail to the sending facility.

#### A procedure must be developed regarding the receipt of facsimile documents containing sensitive information. The procedure should address the following areas:

-   Accountability for monitoring the facsimile machine. A fax machine
    must be located in a secure, controlled area.

-   Ensuring the removal of documents promptly

-   Checking for completeness and legibility of received information

-   Notifying senders of transmission problems

-   Following the instructions on the cover page

-   Arranging for secure delivery of the documents

### **PBX** **(Telephone) Security**

#### Keep PBX attendant console rooms, telephone wiring closets, telephone equipment rooms, and Local Exchange Company (LEC) demarcation rooms locked and secured. These rooms shall meet the same physical security requirements as outlined in the Agency's Operations Handbook, Chapter 5 "Physical/Environmental Security."

#### Request positive identification from all service equipment vendors and technicians.

#### Ensure that any remote maintenance line phone number is unpublished, preferably not in the same numbers groups, and not recorded on jacks, wallfield, distribution frame, etc.

#### Secure any reports, documentation, or other information files that may reveal the trunk access codes or passwords.

#### Change all default passwords immediately after installation.

#### Choose passwords that meet the requirements as outlined in Chapter 1 "Technical Security" of this Handbook.

#### Deactivate unused codes and features.

#### Allow only three attempts to enter a valid access code.

#### Have the PBX wait four or five rings before answering the remote access line.

#### Restrict calling privileges to individual employees

#### Block area codes where business is not done, especially 900, 700, and 976.

#### Use the maximum authorization and Remote Access barrier code length.

#### Use security devices on all [port](#port)s.

#### Ensure that all unused ports are disconnected from the system.

### **Voice** **Mail**

#### Don't allow outgoing calls from a mailbox.

#### Block access to long distance trunks or local lines.

#### Toll restrict lines between the voice mail system and [PBX](#pbx).

#### Delete all unused voice mailboxes.

## RESPONSIBILITIES

### **The Agency CIO** Ensures that all IT systems in the agency are in compliance with the technical policy outlined in this chapter.

### **Office Heads, and Facility Directors**:

#### Ensure that the security technical controls are established on all the systems at their facilities.

#### Accredit all systems implementing external connections initiated from the site to non-the Agency sources.

#### Prior to implementation, ensure that the review board has approved all external connections initiating from the site that connects the Agency's network with an external non-the Agency network.

### **Agency CIO**: 

#### Ensures that the security technical controls outlined in this chapter are implemented on the Agency IT resources.

#### Ensures that all systems implementing external connections from the site to non-the Agency sources are secure and certified.

#### Ensures that all external connections from the Agency's network to non-the Agency networks meet the Agency security criteria and receive final approved of the review board prior to accreditation by the CIO.

#### Ensures that all systems implementing external connections from the site to non-the Agency sources are accredited prior to operation.

#### Ensures that all external connections are re-certified and accredited every other year after initial accreditation.

#### Ensures that all dial-up modems are justified and approved prior to use. 

### **ISO/AISO**:

#### Maintains a record of authorized users of a network and their network privileges. This may be delegated to the review board if appropriate.

#### Reviews this record on a regular basis to ensure that access to the network is limited to only those individuals with a justified need.

#### Work with the system administrators and the CIO to ensure that all systems are certified and accredited.

#### Conducts audits to ensure that technical controls are implemented and performing as required. 

# APPENDIX A

## ACRONYMS

> **ACL** Access Control List
>
> **AISO** Alternate Information Security Officer
>
> **CIO** Chief Information Officer
>
> **COTS** Commercial Off-The- Shelf
>
> **DOD** Department of Defense
>
> **DNS** Domain Name Systems
>
> **EMAIL** Electronic Mail
>
> **FAX** Facsimile
>
> **IP** Internet Protocol
>
> **IRS** Internal Revenue Service
>
> **ISO** Information Security Officer
>
> **IT** Information Technology
>
> **LAN** Local Area Network
>
> **LEC** Local Exchange Company
>
> **PBX** Private Branch Exchange
>
> **PIN** Personal Identification Number
>
> **PPD** Port Protection Device
>
> **SAM** Security Account Manager
>
> **SSA** Social Security Administration
>
> **WAN** Wide Area Network

# APPENDIX B

## GLOSSARY

+-------------------+--------------------------------------------------+
| ##                | Security control designed to permit authorized   |
| ##### Access Cont | access to an IT system or application.           |
| rol  {#access-con |                                                  |
| trol .unnumbered} |                                                  |
+-------------------+--------------------------------------------------+
| **Accreditation** | A formal declaration by the Office Head that the |
|                   | IT is approved to operate in a particular        |
|                   | security mode using a prescribed set of          |
|                   | safeguards. Accreditation is the official        |
|                   | management authorization for operation of IT and |
|                   | is based on the certification process, as well   |
|                   | as other management considerations. The          |
|                   | accreditation statement affixes security         |
|                   | responsibility with the Office Head and shows    |
|                   | that due care has been taken for security.       |
+-------------------+--------------------------------------------------+
| [                 | Verification of the identity of a user, user     |
| ]{#authentication | device, or other entity, or the integrity of     |
| .anchor}*         | data stored, transmitted, or otherwise exposed   |
| *Authentication** | to unauthorized modification in an IT.           |
+-------------------+--------------------------------------------------+
| []{#audittrail    | A record showing who has accessed a computer     |
| .anchor}**Audit   | system and what operations he or she has         |
| Trail**           | performed during a given period of time. Audit   |
|                   | trails are useful both for maintaining security  |
|                   | and for recovering lost transactions.            |
+-------------------+--------------------------------------------------+
| **Automated       | An assembly of computer hardware, software       |
| Information       | and/or firmware configured to collect, create,   |
| System(s) (AIS)** | communicate, compute, disseminate, process,      |
|                   | store, and/or control data or information.       |
+-------------------+--------------------------------------------------+
| **Availability of | The state when data are in the place needed by   |
| Data**            | the user, at the time the user needs them, and   |
|                   | in the form needed by the user.                  |
+-------------------+--------------------------------------------------+
| []{#backup        | A copy of data and/or applications contained in  |
| .                 | the IT stored on magnetic media outside of the   |
| anchor}**Backup** | IT to be used in the event IT data are lost.     |
+-------------------+--------------------------------------------------+
| **Certification** | The comprehensive evaluation of the technical    |
|                   | and non-technical security features of an IT and |
|                   | other safeguards, made in support of the         |
|                   | accreditation process, that establishes the      |
|                   | extent to which a particular design and          |
|                   | implementation meet a specified set of security  |
|                   | requirements.                                    |
+-------------------+--------------------------------------------------+
| **Ciphertext**    | Form of cryptography in which the *plaintext* is |
|                   | made unintelligible to anyone, who intercepts it |
|                   | by a transformation of the information itself,   |
|                   | based on some key.                               |
+-------------------+--------------------------------------------------+
| **                | The concept of holding sensitive data in         |
| Confidentiality** | confidence limited to an appropriate set of      |
|                   | individuals or organizations.                    |
+-------------------+--------------------------------------------------+
| []{#config        | The process of keeping track of changes to the   |
| urationmanagement | system, if needed, approving them.               |
| .ancho            |                                                  |
| r}**Configuration |                                                  |
| Management**      |                                                  |
+-------------------+--------------------------------------------------+
| **Contingency     | A plan for emergency response, backup            |
| Plan**            | operations, and post-disaster recovery           |
|                   | maintained by an activity as a part of its       |
|                   | security program that will ensure the            |
|                   | availability of critical resources and           |
|                   | facilitate the continuity of operations in an    |
|                   | emergency situation.                             |
+-------------------+--------------------------------------------------+
| []{#cots          | Commercial Off The Shelf Software -- software    |
| .anchor}**COTS    | acquired by government contract through a        |
| Software**        | commercial vendor. This software is a standard   |
|                   | product, not developed by a vendor for a         |
|                   | particular government project.                   |
+-------------------+--------------------------------------------------+
| **Data            | The state that exists when automated data is the |
| Integrity**       | same as that in source documents, or has been    |
|                   | correctly computed from source data, and has not |
|                   | been exposed to alteration or destruction.       |
+-------------------+--------------------------------------------------+
| **Degaussing      | Method to magnetically erase data from magnetic  |
| Media**           | tape.                                            |
+-------------------+--------------------------------------------------+
| []{#default       | A value or setting that a device or program      |
| .a                | automatically selects if you do not specify a    |
| nchor}**Default** | substitute.                                      |
+-------------------+--------------------------------------------------+
| **Dial-up**       | The service whereby a computer terminal can use  |
|                   | the telephone to initiate and effect             |
|                   | communication with a computer.                   |
+-------------------+--------------------------------------------------+
| []{#encryption    | The process of making information indecipherable |
| .anch             | to protect it from unauthorized viewing or use,  |
| or}**Encryption** | especially during transmission or storage.       |
|                   | Encryption is based on an algorithm and at least |
|                   | one key. Even if the algorithm is known, the     |
|                   | information cannot be decrypted without the      |
|                   | key(s).                                          |
+-------------------+--------------------------------------------------+
| []{#facsimile     | A document that has been sent, or is about to be |
| .anc              | sent, via a fax machine.                         |
| hor}**Facsimile** |                                                  |
+-------------------+--------------------------------------------------+
| []{#firewall      | A system or combination of systems that enforces |
| .an               | a boundary between two or more networks.         |
| chor}**Firewall** |                                                  |
+-------------------+--------------------------------------------------+
| **Friendly        | The removal of an employee from the organization |
| Termination**     | when there is no reason to believe that the      |
|                   | termination is other than mutually acceptable.   |
+-------------------+--------------------------------------------------+
| []{#gateway       | A bridge between two networks.                   |
| .a                |                                                  |
| nchor}**Gateway** |                                                  |
+-------------------+--------------------------------------------------+
| **Hardware**      | Refers to objects that you can actually touch,   |
|                   | like disks, disk drives, display screens,        |
|                   | keyboards, printers, boards, and chips.          |
+-------------------+--------------------------------------------------+
| [                 | The process that enables recognition of a user   |
| ]{#identification | described to an IT.                              |
| .anchor}*         |                                                  |
| *Identification** |                                                  |
+-------------------+--------------------------------------------------+
| []{#internet      | A global network connecting millions of          |
| .an               | computers. As of 1999, the Internet has more     |
| chor}**Internet** | than 200 million users worldwide, and that       |
|                   | number is growing rapidly.                       |
+-------------------+--------------------------------------------------+
| []{#intranet      | A network based on TCP/IP protocols (an          |
| .an               | internet) belonging to an organization, usually  |
| chor}**Intranet** | a corporation, accessible only by the            |
|                   | organization's members, employees, or others     |
|                   | with authorization. An intranet's Web sites look |
|                   | and act just like any other Web sites, but the   |
|                   | firewall surrounding an intranet fends off       |
|                   | unauthorized access.                             |
+-------------------+--------------------------------------------------+
| **Intrusion       | Pertaining to techniques, which attempt to       |
| Detection**       | detect intrusion into a computer or network by   |
|                   | observation of actions, security logs, or audit  |
|                   | data. Detection of break-ins or attempts either  |
|                   | manually or via software expert systems that     |
|                   | operate on logs or other information available   |
|                   | on the network.                                  |
+-------------------+--------------------------------------------------+
| **ISO/AISO**      | The persons responsible to the Office Head or    |
|                   | Facility Director for ensuring that security is  |
|                   | provided for and implemented throughout the life |
|                   | cycle of an IT from the beginning of the concept |
|                   | development plan through its design,             |
|                   | development, operation, maintenance, and secure  |
|                   | disposal.                                        |
+-------------------+--------------------------------------------------+
| **Issue-specific  | Policies developed to focus on areas of current  |
| Policy**          | relevance and concern to an office or facility.  |
|                   | Both new technologies and the appearance of new  |
|                   | threats often require the creation of            |
|                   | issue-specific policies (e.g., e-mail, Internet  |
|                   | usage).                                          |
+-------------------+--------------------------------------------------+
| **IT Security**   | Measures and controls that protect an IT against |
|                   | denial of and unauthorized (accidental or        |
|                   | intentional) disclosure, modification, or        |
|                   | destruction of ITs and data. IT security         |
|                   | includes consideration of all hardware and/or    |
|                   | software functions.                              |
+-------------------+--------------------------------------------------+
| **IT Security     | The set of laws, rules, and practices that       |
| Policy**          | regulate how an organization manages, protects,  |
|                   | and distributes sensitive information.           |
+-------------------+--------------------------------------------------+
| **IT Systems**    | An assembly of computer hardware, software       |
|                   | and/or firmware configured to collect, create,   |
|                   | communicate, compute, disseminate, process,      |
|                   | store, and/or control data or information.       |
+-------------------+--------------------------------------------------+
| []{#ldap          | Short for Lightweight Directory Access Protocol, |
| .anchor}**LDAP**  | a set of protocols for accessing information     |
|                   | directories. LDAP is based on the standards      |
|                   | contained within the X.500 standard, but is      |
|                   | significantly simpler. And unlike X.500, LDAP    |
|                   | supports TCP/IP, which is necessary for any type |
|                   | of Internet access.                              |
+-------------------+--------------------------------------------------+
| [                 | The process of granting users only those         |
| ]{#leastprivilege | accesses they need to perform their official     |
| .anchor}**Least   | duties.                                          |
| Privilege**       |                                                  |
+-------------------+--------------------------------------------------+
| []{               | A short-haul data communications systems that    |
| #localareanetwork | connects IT devices in a building or group of    |
| .anchor}**Local   | buildings within a few square miles, including   |
| Area Network**    | (but not limited to) workstations, front-end     |
|                   | processors, controllers, switches, and gateways. |
+-------------------+--------------------------------------------------+
| []{#m             | Security methods that focus on the management of |
| anagementcontrols | the computer security system and the management  |
| .an               | of risk for a system.                            |
| chor}**Management |                                                  |
| Controls**        |                                                  |
+-------------------+--------------------------------------------------+
| []{#modem         | An electronic device that allows a microcomputer |
| .anchor}**Modem** | or a computer terminal to be connected to        |
|                   | another computer via a telephone line.           |
+-------------------+--------------------------------------------------+
| []{#network       | Two or more systems connected by a               |
| .a                | communications medium; a network is composed of  |
| nchor}**Network** | a communications medium and all components       |
|                   | attached to that medium whose responsibility is  |
|                   | the transference of information.                 |
+-------------------+--------------------------------------------------+
| []                | The most important program that runs on a        |
| {#operatingsystem | computer. Every general-purpose computer must    |
| .a                | have an operating system to run other programs.  |
| nchor}**Operating | Operating systems perform basic tasks, such as   |
| System**          | recognizing input from the keyboard, sending     |
|                   | output to the display screen, keeping track of   |
|                   | files and directories on the disk, and           |
|                   | controlling peripheral devices such as disk      |
|                   | drives and printers.                             |
+-------------------+--------------------------------------------------+
| **Operation       | Security methods that focus on mechanisms that   |
| Controls**        | primarily are implemented and executed by people |
|                   | (as opposed to systems).                         |
+-------------------+--------------------------------------------------+
| **Overwriting     | Method for clearing data from magnetic media.    |
| media**           | Overwriting uses a program to write (1s, Os, or  |
|                   | a combination) onto the media. Overwriting       |
|                   | should not be confused with merely deleting the  |
|                   | pointer to a file (which typically happens when  |
|                   | a "delete" command is used).                     |
+-------------------+--------------------------------------------------+
| []{#password      | Protected/private character string used to       |
| .an               | authenticate an identity or to authorize access  |
| chor}**Password** | to data.                                         |
+-------------------+--------------------------------------------------+
| []{#parity        | The quality of being either odd or even. The     |
| .                 | fact that all numbers have parity is commonly    |
| anchor}**Parity** | used in data communication to ensure the         |
|                   | validity of data. This is called parity          |
|                   | checking.                                        |
+-------------------+--------------------------------------------------+
| []{#pbx           | Short for private branch exchange, a private     |
| .anchor}**PBX**   | telephone network used within an enterprise.     |
|                   | Users of the PBX share a certain number of       |
|                   | outside lines for making telephone calls         |
|                   | external to the PBX.                             |
+-------------------+--------------------------------------------------+
| []{               | Any external device attached to a computer.      |
| #peripheraldevice | Examples of peripherals include printers, disk   |
| .an               | drives, display monitors, keyboards, and mice.   |
| chor}**Peripheral |                                                  |
| Device**          |                                                  |
+-------------------+--------------------------------------------------+
| []{#port          | An interface on a computer to which you can      |
| .anchor}**Port**  | connect a device.                                |
+-------------------+--------------------------------------------------+
| []{#por           | A device that authorizes access to the port      |
| tprotectiondevice | itself, often based on a separate authentication |
| .anchor}**Port    | independent of the computer's own access control |
| Protection        | functions.                                       |
| Device**          |                                                  |
+-------------------+--------------------------------------------------+
| **RADIUS**        | Short for Remote Authentication Dial-In User     |
|                   | Service, an authentication and accounting system |
|                   | used by many Internet Service Providers (ISPs).  |
|                   | When you dial in to the ISP you must enter your  |
|                   | username and password. This information is       |
|                   | passed to a RADIUS server, which checks that the |
|                   | information is correct, and then authorizes      |
|                   | access to the ISP system.                        |
+-------------------+--------------------------------------------------+
| []{#realtime      | Occurring immediately. Real time can refer to    |
| .anchor}**Real    | events simulated by a computer at the same speed |
| Time**            | that they would occur in real life.              |
+-------------------+--------------------------------------------------+
| **Remote Access** | The hookup of a remote computing device via      |
|                   | communication lines such as ordinary phone lines |
|                   | or wide area networks to access network          |
|                   | applications and information                     |
+-------------------+--------------------------------------------------+
| []{#risk          | The probability that a particular threat will    |
| .anchor}**Risk**  | exploit a particular vulnerability of the        |
|                   | system.                                          |
+-------------------+--------------------------------------------------+
| **Risk Analysis** | The process of identifying security risks,       |
|                   | determining their magnitude, and identifying     |
|                   | areas needing safeguards. Risk analysis is a     |
|                   | part of risk management.                         |
+-------------------+--------------------------------------------------+
| **Risk            | Process of identifying, controlling, and         |
| Management**      | eliminating or reducing risks that may affect IT |
|                   | resources.                                       |
+-------------------+--------------------------------------------------+
| []{#router        | An interconnection device that is similar to a   |
| .                 | bridge but serves packets or frames containing   |
| anchor}**Router** | certain protocols. Routers link LANs at the      |
|                   | network layer.                                   |
+-------------------+--------------------------------------------------+
| **Rules of        | Rules established and implemented concerning use |
| Behavior**        | of, security in, and acceptable level of risk    |
|                   | for the system. Rules will clearly delineate     |
|                   | responsibilities and expected behavior of all    |
|                   | individuals with access to the system. Rules     |
|                   | should cover such matters as work at home,       |
|                   | dial-in access, connection to the Internet, use  |
|                   | of copyrighted works, unofficial use of Federal  |
|                   | Government equipment, the assignment and         |
|                   | limitation of system privileges, and individual  |
|                   | accountability.                                  |
+-------------------+--------------------------------------------------+
| **Security        | An adverse event in a computer system or the     |
| Incident**        | threat of such an event occurring.               |
+-------------------+--------------------------------------------------+
| []{#securityplan  | Document that details the security controls      |
| .                 | established and planned for a particular system. |
| anchor}**Security |                                                  |
| Plan**            |                                                  |
+-------------------+--------------------------------------------------+
| **Security        | A detailed description of the safeguards         |
| Specifications**  | required to protect a system.                    |
+-------------------+--------------------------------------------------+
| **Sensitive       | Any information, the loss, misuse, modification  |
| Data**            | of, or unauthorized access to, could affect the  |
|                   | national interest or the conduct of Federal      |
|                   | programs, or the privacy to which individuals    |
|                   | are entitled under Section 552a of Title 5, U.S. |
|                   | Code, but has not been specifically authorized   |
|                   | under criteria established by an Executive order |
|                   | or an act of Congress to be kept classified in   |
|                   | the interest of national defense or foreign      |
|                   | policy.                                          |
+-------------------+--------------------------------------------------+
| []{#s             | A process that divides roles and                 |
| eparationofduties | responsibilities so that a single individual     |
| .an               | cannot subvert a critical process.               |
| chor}**Separation |                                                  |
| of Duties**       |                                                  |
+-------------------+--------------------------------------------------+
| **Server**        | The control computer on a local area network     |
|                   | that controls software access to workstations,   |
|                   | printers, and other parts of the network.        |
+-------------------+--------------------------------------------------+
| []{#smartcard     | A credit-card-sized device with embedded         |
| .anchor}**Smart   | microelectronics circuitry for storing           |
| Card**            | information about an individual. This is not a   |
|                   | key or token, as used in the remote access       |
|                   | authentication process.                          |
+-------------------+--------------------------------------------------+
| **Software**      | Computer instructions or data. Anything that can |
|                   | be stored electronically is software.            |
+-------------------+--------------------------------------------------+
| **Software        | The right of the copyright owner to prohibit     |
| Copyright**       | copying and/or issue permission for a customer   |
|                   | to employ a particular computer program.         |
+-------------------+--------------------------------------------------+
| []{#spam          | To crash a program by overrunning a fixed-site   |
| .anchor}**SPAM**  | buffer with excessively large input data. Also,  |
|                   | to cause a person or newsgroup to be flooded     |
|                   | with irrelevant or inappropriate messages.       |
+-------------------+--------------------------------------------------+
| []{#system        | Set of processes, communications, storage, and   |
| .                 | related resources that are under the same direct |
| anchor}**System** | management control, have the same function or    |
|                   | Mission objective, have essentially the same     |
|                   | operating characteristics and security needs,    |
|                   | and reside in the same general operating         |
|                   | environment.                                     |
+-------------------+--------------------------------------------------+
| **System          | The state that exists when required automated    |
| Availability**    | information can be performed within an           |
|                   | acceptable time period even under adverse        |
|                   | circumstances.                                   |
+-------------------+--------------------------------------------------+
| **System          | The quality that a system has when it performs   |
| Integrity**       | its intended function in an unimpaired manner,   |
|                   | free from deliberate or inadvertent unauthorized |
|                   | manipulation of the system.                      |
+-------------------+--------------------------------------------------+
| []{#sy            | The individual responsible for defining the      |
| stemadministrator | system's operating parameters, authorized        |
| .anchor}**System  | functions, and security requirements. This       |
| Administrator**   | individual is usually the person who maintains   |
|                   | the system on a day-to-day basis.                |
+-------------------+--------------------------------------------------+
| []{#systemowner   | The individual who is ultimately responsible for |
| .anchor}**System  | the function and security of the system.         |
| Owner**           |                                                  |
+-------------------+--------------------------------------------------+
| **TCP/IP**        | Transmission Control Protocol/Internet Protocol. |
|                   | The Internet Protocol is based on this suite of  |
|                   | protocols.                                       |
+-------------------+--------------------------------------------------+
| []{#              | Security methods consisting of hardware and      |
| technicalcontrols | software controls used to provide automated      |
| .a                | protection to the system or applications.        |
| nchor}**Technical | Technical controls operate within the technical  |
| Controls**        | system and applications.                         |
+-------------------+--------------------------------------------------+
| **Technical       | Specific protection conditions and/or protection |
| Security Policy** | philosophy that express the boundaries and       |
|                   | responsibilities of the IT product in supporting |
|                   | the information protection policy control        |
|                   | objectives and countering expected threats.      |
+-------------------+--------------------------------------------------+
| **Tel             | Any transmission, emission, or reception of      |
| ecommunications** | signals, writing, images, sound or other data by |
|                   | cable, telephone lines, radio, visual or any     |
|                   | electromagnetic system.                          |
+-------------------+--------------------------------------------------+
| **Threat**        | Any circumstance or event with the potential to  |
|                   | cause harm to a system in the form of            |
|                   | destruction, disclosure, modification of data,   |
|                   | and/or denial thereof.                           |
+-------------------+--------------------------------------------------+
| **Trojan Horse**  | Any program designed to do things that the user  |
|                   | of the program did not intend to do, or that     |
|                   | disguise its harmful intent. A program that      |
|                   | installs itself while the user is making an      |
|                   | authorized entry; and, then is used to break-in  |
|                   | and exploits the system.                         |
+-------------------+--------------------------------------------------+
| **Unfriendly      | The removal of an employee under involuntary or  |
| Termination**     | adverse conditions. This may include termination |
|                   | for cause, RIF, involuntary transfer,            |
|                   | resignation for "personality conflicts," and     |
|                   | situations with pending grievances.              |
+-------------------+--------------------------------------------------+
| []{#user          | Any person who is granted access privileges to a |
| .anchor}**User**  | given IT.                                        |
+-------------------+--------------------------------------------------+
| []{#userinterface | The part of an application that the user works   |
| .anchor}**User    | with. User interfaces can be text-driven, such   |
| Interface**       | as DOS, or graphical, such as Windows.           |
+-------------------+--------------------------------------------------+
| **Virus**         | A self-propagating Trojan horse (a program that  |
|                   | surreptitiously exploits the security/integrity  |
|                   | of a program), composed of a mission component,  |
|                   | a trigger component, and a self-propagating      |
|                   | component.                                       |
+-------------------+--------------------------------------------------+
| **Vulnerability** | A weakness in automated system security          |
|                   | procedures, technical controls, environmental    |
|                   | controls, administrative controls, internal      |
|                   | controls, etc., that could be used as an entry   |
|                   | point to gain unauthorized access to information |
|                   | or disrupt critical processing.                  |
+-------------------+--------------------------------------------------+
| []                | A physical or logical network that provides      |
| {#wideareanetwork | capabilities for a number of independent devices |
| .anchor}**Wide    | to communicate with each other over a common     |
| Area Network**    | transmission-interconnected topology in          |
|                   | geographic areas larger than those served by     |
|                   | local area networks.                             |
+-------------------+--------------------------------------------------+

# APPENDIX C

## REFERENCES

> Computer Security Act of 1987 (PL 100-235)
>
> OMB Circular A-123, Internal Control Systems
>
> OMB Circular A-130, Management of Federal Information Resources,
> Appendix III, "Security of Federal [Automated Information
> System](#automatedinformationsystem)s".
>
> Privacy Act of 1974 (PL-93-579) and Amendments
>
> NIST SP 800-12, An Introduction to Computer Security; the NIST
> Handbook
>
> NIST SP 800-14, Generally Accepted Principals and Practices for
> Securing Information Technology Systems.
>
> NIST AP 800-16, Information Technology Security Training Requirements:
> A Role- and Performance-Based Model
>
> the Agency Directive XXX, Information Technology Systems Security
> Policy