> ![](media/image1.jpeg){width="1.5458333333333334in"
> height="1.4743055555555555in"}
>
> **General Services Administration**
>
> **Public Buildings Service**

Security Handbook\
and\
Standard Operating Procedures

> Infrastructure Division
>
> \(202\) 501-9135

**Table of Contents**

Managers M-[1](#__RefHeading___Toc501251392)

Awareness Programs M-[1](#__RefHeading___Toc501251393)

Incident Handling M-[2](#__RefHeading___Toc501251394)

Alerts and Advisories M-[3](#__RefHeading___Toc501251395)

Warning Banners M-[5](#__RefHeading___Toc501251396)

Employee Termination Procedures M-[6](#__RefHeading___Toc501251397)

Certification Accreditation M-[10](#__RefHeading___Toc501251398)

Training M-[12](#__RefHeading___Toc501251399)

Personnel Security M-[13](#__RefHeading___Toc501251400)

Internet Use M-[14](#__RefHeading___Toc501251401)

Email M-[15](#__RefHeading___Toc501251402)

Sensitive Information M-[16](#__RefHeading___Toc501251403)

System Security M-[17](#__RefHeading___Toc501251404)

Physical Security M-[18](#__RefHeading___Toc501251405)

System Administrators SA-[1](#__RefHeading___Toc501251406)

Passwords SA-[1](#__RefHeading___Toc501251407)

Alerts and Advisories SA-[3](#__RefHeading___Toc501251408)

Incident Handling SA-[4](#__RefHeading___Toc501251409)

System Log Books SA-[5](#__RefHeading___Toc501251410)

Vendor Patches SA-[6](#__RefHeading___Toc501251411)

Audit Logs SA-[7](#__RefHeading___Toc501251412)

Warning Banners SA-[9](#__RefHeading___Toc501251413)

Certification Accreditation SA-[11](#__RefHeading___Toc501251414)

Remote Access SA-[12](#__RefHeading___Toc501251415)

Email SA-[14](#__RefHeading___Toc501251416)

Backups SA-[16](#__RefHeading___Toc501251417)

Physical Security SA-[17](#__RefHeading___Toc501251418)

Anti Virus SA-[18](#__RefHeading___Toc501251419)

System Configuration SA-[19](#__RefHeading___Toc501251420)

Network Architecture SA-23

Users U-[1](#__RefHeading___Toc501251422)

Training U-[1](#__RefHeading___Toc501251423)

Email U-[2](#__RefHeading___Toc501251424)

Internet Usage U-[3](#__RefHeading___Toc501251425)

Passwords U-[4](#__RefHeading___Toc501251426)

Physical Security U-[6](#__RefHeading___Toc501251427)

Anti-Virus U-[7](#__RefHeading___Toc501251428)

Sensitive Information U-[8](#__RefHeading___Toc501251429)

Incident Reporting U-[9](#__RefHeading___Toc501251430)

**List Of Exhibits**

[Exhibit 1. Alert/Advisory Information Flow
M-3](#__RefHeading___Toc501500822)

[Exhibit 2. Event Log Settings Dialog Box
SA-7](#__RefHeading___Toc501500823)

[Exhibit 3. Audit Policy Dialog Box SA-8](#__RefHeading___Toc501500824)

[Exhibit 4. Mail Server Placement SA-14](#__RefHeading___Toc501500825)

[Exhibit 5. Firewall and Web Server Placement SA-21](#_Hlt511540461)

[Exhibit 6. Web and Mail Servers Without a Firewall
SA-22](#_Hlt511540387)

[Exhibit 7. GSA Cyber Incident Reporting Form
U-11](#__RefHeading___Toc501500828)

[Exhibit 8. Rules of
Behavior](#Exhibit_8._Rules_of_Behavior)....................................................................U-13

**Introduction**![](media/image2.jpeg){width="7.65in" height="0.9in"}

> *"The possibility that electronic information could be lost,
> corrupted, diverted, or misused represents a real threat to mission
> performance for GSA and other government agencies. Today GSA is more
> dependent than ever on information technology (IT). Information
> systems have gone from being important to being essential in the
> performance of these missions. However, even as GSA's dependence on
> information technology has grown, so too has the vulnerability of this
> technology and the range of external threats to it.*
>
> *"Information security is a key aspect of the interaction among many
> important societal issues---defense, terrorism, commerce, privacy,
> intellectual property rights, and computer crime. IT resources also
> consume a growing share of the Federal budget and are becoming
> increasingly important to daily life. As a result, a considerable body
> of applicable policy is in place, consisting of laws, statutes,
> regulations, Executive Orders, and other directives. GSA's IT Security
> Program, as well as those of other agencies, must operate within this
> complex policy landscape to ensure that the Government meets its
> obli­gations to the Nation. Providing for the security of IT resources
> is not only a difficult technical challenge, it is also a human
> challenge. Ultimately IT security is a human endeavor that depends
> heavily on the behavior of indi­vidual people."*

*Introduction to the\
GSA Security Action Plan*

This handbook is a tool to help you meet the ongoing challenge of
security. It provides guid­ance on topics relevant to your job role---the
specific actions you should take to protect GSA Public Buildings Service
(PBS) resources, as well as background information so you will know why
these steps are necessary. We intend this reference to be easy to use,
whether you have a security question, need a form, or are faced with an
emergency situation. Some of the sections may not apply directly to you,
but they are all included in one source, so you get a sense of the
larger picture and how it involves all of PBS. We have taken the
high-level policies and regulations and developed this practical guide
to security for day-to-day use.

> This handbook is a "living" document. This means that we have a good
> start on it, but we need your help to refine it. This handbook should
> reflect your day-to-day security practices. As those practices change
> and evolve, relevant handbook sections should be added, deleted, or
> modified. We have designed the topics with separate thumb tabs, so
> that the information here is easy to find and update.

**Glossary**

ADP Automated Data Processing

AV Anti-Virus

C&A Certification and Accreditation

CBT Computer-Based Training

CE Office of Management Controls and Evaluation

CERT®/CC CERT® Coordination Center (originally, the Computer Emergency\
Response Team)

CIO Chief Information Officer

CM Configuration Management\
CPO Chief People Officer

DAA Designated Approving Authority

DMZ Demilitarized Zone

DNS Domain Name System

EO Executive Order

FEDCIRC Federal Computer Incident Response Capability

FIPS Federal Information Processing Standard

FMFIA Federal Managers Financial Integrity Act

FOIA Freedom of Information Act

FTP File Transfer Protocol

GSA General Services Administration

HSSO Heads of Services and Staff Offices

HVAC Heating, Ventilation, and Air Conditioning

IA Interim Authority

IATO Interim Authority to Operate

INFOSEC Information Security

ISSE Information System Security Engineer

ISSM Information Systems Security Manager

ISSO Information Systems Security Officer

IT Information Technology

LAN Local Area Network

NAC(I) National Agency Check with Local Inquiries and Credit Check

NARA National Archives and Records Administration

NIAP National Information Assurance Partnership

NIST National Institute of Standards and Technology

NSA National Security Agency

OMB Office of Management and Budget

OS Operating System

OSI Open Systems Interconnection

PBS Public Buildings Service

PM Program Manager

POC Point of Contact

PUB Publication

RA Regional Administrator

RAS Remote Access Service

SA System Administrator

SAM System Account Manager

SANS System Administration, Networking, and Security

SID System ID

SOP Standard Operating Procedure

STU-III Secure Telephone Unit, Third Generation

UPS Uninterruptible Power Supply

[]{#__RefHeading___Toc501251392 .anchor}Managers\
![](media/image3.jpeg){width="5.230555555555555in"
height="4.753472222222222in"}

[]{#__RefHeading___Toc501251393 .anchor}![](media/image4.wmf) Awareness
Programs

**Requirement:** CIO 2100.1, GSA IT Security Action Plan

**Description:**

From the GSA Information Technology Security Action Plan, we see that
security awareness contains the following Core competencies:

-   Policy

-   Cultural and Functional

-   Changes

-   User and Mgmt Requirements

-   Threat Sensitivity

-   Legal

-   INFOSEC Awareness.

Security awareness is the first of three areas of instruction: Security
Awareness, Security Training, and Security Education.

**How to:**

Managers are responsible for ensuring their personnel are briefed and
understand their roles in IT security. Managers will do this by:

-   Informing all personnel of the statutes and policies surrounding IT
    security by conducting periodic security awareness briefings.

-   Ensuring that posters are provided for view in the PBS office area.

-   Providing opportunities for personnel to take advantage of the GSA
    CIO Security 30‑minute, computer-based training (CBT) module.

-   Ensuring that PBS Security Notices are posted.

[]{#__RefHeading___Toc501251394 .anchor}Incident Handling

**Requirement:** CIO 2100.1

**Description:**

Incident reporting is a vital way to defend against intrusions and other
misuse of PBS systems. It requires the cooperation of everyone, from
management to users. Specific guidance is provided below and describes
the PBS specific handling of incident reports.

**How to:**

PBS personnel will use the GSA Cyber Incident Reporting Form (Exhibit
7). Regional Security Managers will ensure that all users are aware of
reporting procedures. All regions will report incidents to the Office of
the GSA CIO and PBS ISSM.

GSA will establish an automated capability to provide help to users when
a security incident occurs in the system and to share information
concerning common vulnerabilities and threats. The goal for initial
reporting is within 1 hour of detecting the incident, even if
information for the initial report is incomplete.

[]{#__RefHeading___Toc501251395 .anchor} Alerts and Advisories

**Requirement:** CIO 2100.1

**Description:**

Alerts and Advisories are periodically released that detail newly
discovered vulnerabilities and other security information. This
information may require action on the part of the System Administrators
or the users. Advisories may come from a variety of sources, but they
will be released primarily by the CERT® Coordination Center
(CERT®/CC[^1]) and the Federal Com­puter Incident Response Capability
(FEDCIRC). The PBS system for dissemi­na­tion of Alerts and Advisories
provides a mechanism for accountability.

**How to:**

The flow of information is illustrated in the diagram below.

[]{#__RefHeading___Toc501500822 .anchor}Exhibit 1 Alert/Advisory
Information Flow

Both GSA and PBS Security staff monitor and receive periodic security
notices from various sources and prepare this information for
dissemination to all the regional offices. Upon receipt, the regional
security officer will ensure dissemination to the System Administrators
via the Information Management Officer or equivalent. Regions must
acknowledge receipt of the advisory within 3 hours of dissemination. PBS
must report all regions' receipt of the information collectively within
4 hours to GSA CIO; therefore, security notices require prompt
attention.

Upon receipt of alerts and advisories requiring action, the following
actions may occur:

-   Compliance with the required action.

-   A statement of waiver with reasons that the actions cannot be
    implemented.

-   Compliance or waiver actions will be reported to the PBS main office
    security staff within the allocated time to make the system changes.
    This time will be different for each alert or advisory.

[]{#__RefHeading___Toc501251396 .anchor} Warning Banners

**Requirement:** CIO 2100.1 (Part 4, Paragraph 9.j.)

**Description:**

All GSA systems shall display warning banners upon connection to a given
system. These banners shall display a warning that states the system is
for legitimate use only, is subject to monitoring, and carries no
expectation of privacy.

The use of warning banners on PBS computers and networks provides legal
notice to anyone accessing them that they are using a U.S. Government
system that is subject to monitoring. Users should also be notified of
the possible sanctions, such as loss of privileges or even prosecution,
if they misuse or access the network without authorization.

This requirement falls under the category of basic control requirements
and is part of the minimum security requirements established by the GSA.

**How to:**

Your System Administrators should know how to install the banners;
instructions are provided in this handbook (in the System Administrator
section). The information contained in the banners is standard and must
be approved by the PBS legal staff. You should use only the wording
provided by the PBS main office. The current wording is as follows:

**This is a U.S. General Services Administration Federal govern­ment
computer system that is "FOR OFFICIAL USE ONLY." This system is subject
to monitoring. Therefore, no expectation of privacy is to be assumed.
Individuals found performing unauthor­ized activities are subject to
disciplinary action including criminal prosecution.**

[]{#__RefHeading___Toc501251397 .anchor}Employee Termination Procedures

**Requirement:** GSA Policy Letter

**Description:**

This procedure describes those activities that will occur when an
employee terminates his or her employment with PBS. It is a PBS addition
to the GSA Guidance, which requires the Chief People Officer (CPO) to
provide the Chief Information Officer (CIO) with a monthly list of
terminated employees. Employees' supervisors are responsible for
notifying the IT office of terminations.

**How to:**

Prior to an employee's friendly termination, and not later than the
actual termination date, the supervisor will notify the IT staff
directly. In the event of an unfriendly termination, the IT staff must
be contacted immediately. This will be done via memo, although it is
advisable to place a telephone call to the IT office to allow them to
close any expired accounts immediately. The GSA memo format for employee
terminations is shown on the next page.

**MEMORANDUM FOR HEADS OF SERVICES AND STAFF OFFICES AND**

**REGIONAL ADMINISTRATORS**

**FROM: WILLIAM C. PIATT**

**CHIEF INFORMATION OFFICER (I)**

**GAIL LOVELACE**

**CHIEF PEOPLE OFFICER (C)**

**SUBJECT: IT Systems Access: Employee Termination or Transfer**

**Notification Procedures**

As we move more into an Electronic Government (E-Gov) environment, IT
security is increas­ingly more critical. In an effort to continuously
mitigate risks, threats, and vulnera­bil­ities to our IT resources and
help protect our IT investments, the Office of the Chief Informa­tion
Officer, will issue IT Security Procedural Guides. These Procedural
Guides will provide specific procedures on the implementation of our IT
Security Policy.

This memorandum transmits the first guide we are issuing. We have
developed, in coor­dination with the Office of the Chief People Officer,
procedures to address revocation or modification of access privileges of
terminated and transferred GSA employees. The procedures in this guide
must be implemented and enforced to maintain a secure IT environment and
apply to all Services and Staff Offices and Regions.

Your support of and commitment to GSA's IT Security Program will ensure
that we are successful in the implementation of our IT Security policies
and appropriately protect our IT environment.

If there are any questions regarding the implementation of these
procedures, please contact Ms. L. Diane Savoy, Director, Center for IT
Capital Planning at (202) 501-3535.

Attachment

cc: Official & Reading File -- IPCS

IPC, I, IPCS(Hardman & Taylor) C(Lovelace)

IPCS\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ DATE\_\_\_\_\_\_\_\_\_\_

CI\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ DATE\_\_\_\_\_\_\_\_\_\_

IPCS:WTAYLOR:cks:501-2451:06/13/00:termntn&trnfr2SSO.doc

![](media/image7.jpeg){width="7.572222222222222in"
height="9.415277777777778in"}

***When people change jobs\...\...***

**SECURITY NOTICE (SN-2001-01)**

**Security Procedures for Employee/Contractor Clearance**

Throughout the Federal Government, there has been an increased awareness
of the need to exercise all precautionary security measures to protect
our valuable resources. This is particularly critical in the Information
Technology (IT) area, where one can never be too sure when or where
risks and vulnerabilities may arise.

One additional measure that must be taken seriously is the proper
clearance of all Federal and Contractor personnel at the time of their
reassignments or other separations. It is requested that all PBS
supervisors and administrative personnel, who process these personnel
actions, include the required security debriefing and sign-off by the
designated Information Systems Security Manager (ISSM) or Information
Systems Security Officer (ISSO). The ISSM and ISSO functions are located
in both Central Office and the Regional Offices, and by signing the
Employee Clearance Checklist (GSA Form 1655), #8, they will ensure that
access by that individual to all IT resources (e-mail, business
applications, remote access) has been terminated.

This required clearance action is just as sensitive and critical to
security as requesting the office door keys, charge cards, and other
Government-issued resources. Additionally, this action benefits the
departing employee, since there can be no malicious activity via his/her
password(s) through a closed account. Project Managers and System
Administrators will also track these departures to maintain a clear and
updated list of users and associated access rights and responsibilities.

**If you have any questions or concerns, please contact**

**Marie Carmichael at (202) 501-9135.**

[]{#__RefHeading___Toc501251398 .anchor}Certification and Accreditation

**Requirement:** CIO 2100.1

**Description:**

Information Systems Security Officers (ISSOs) are required to complete
an evaluation to determine how well the controls for their sensitive
systems meet certain specific IT security and management control
objectives. For all major applications and general support systems,
certification statements based on the certification evaluation
procedures shall be completed either every 3 years or when a change that
affects the system's security posture is imple­mented. Information
Systems Security Managers (ISSMs) will review Certification and
Accreditation (C&A) statements before they are signed by the Designated
Approving Authority (DAA). ISSMs will forward copies of C&A statements
to the IT Security Program Manager once they have been signed by the
DAA. C&A statements are a required part of the IT Capital Planning
process documentation. For financial management systems, reporting
should be aligned with the Federal Managers Financial Integrity Act
(FMFIA) requirements to the extent practicable to avoid duplication.

Certification and accreditation are two distinct but related processes.
Certification is a short-term activity that is repeated after any
significant IT-related change and is a prerequisite for accreditation.
Accreditation is a long-term authorization for an IT resource to operate
based on the facts, plans, and schedules developed during certification.
All GSA major applica­tions and general support systems shall be
certified and accredited.

**How to:**

***Certification.*** Heads of Services and Staff Offices (HSSOs) and
Regional Administrators (RAs) shall implement a certification program to
test and eval­uate technical and non-tech­ni­cal IT security features and
other safeguards used in support of the accreditation process.
Certification shall primarily address software and hardware secu­rity
safeguards, but will also consider procedural, physical, and personnel
security measures employed to enforce the GSA IT security policy.

***Accreditation.*** All GSA major applications and general support
systems shall be accred­ited. HSSOs and RAs are appointed as DAAs
responsible for issuing a formal accreditation statement for systems and
networks under their program direction. The accreditation deter­mination
shall be based on findings, facts, and support documents produced during
the certi­fication process. The statement shall address the residual
risks associated with the respective system or network, subsequent to
the implementation of countermeasures applied during the system test and
evaluation.

Accreditation is the official management authorization for the operation
of an IT resource and provides a formal declaration by the DAA that an
IT resource is approved to operate in a particular security mode using a
prescribed set of safeguards. Accreditation is based on the
certification process as well as other management considerations. An
accreditation statement affixes security responsibility with the
accrediting authority and certifies that proper attention has been
afforded to the security of the IT resource.

***Interim Authority to Operate (IATO).*** An IATO may be issued in
those cases in which systems must be implemented expeditiously, but the
IA should last no longer than 6 months. Existing operational systems
that have not been certified and accredited within the last 3 years
shall undergo certification and accreditation within 1 year of the issue
date of this order.

[]{#__RefHeading___Toc501251399 .anchor}Training

**Requirement:** CIO 2100.1

**Description:**

All authorized users are required to attend training on how to fulfill
their security responsibilities within 60 days of employment. They are
also required to participate in periodic training in information system
security awareness and accepted information system security practices,
as appropriate to their job functions and responsibilities. Users having
access to several applications shall attend training on each application
and in all general support sys­tems. The system security plan should
specify the type and frequency of training required.

**How to:**

IT and Security Managers should plan and prepare for two types of
training. These types of training involve Users and System
Administrators. Users are required to participate in certain training
activities specified in the Personnel Security section. These include
aware­ness training and various application training classes, which may
be offered periodically.

Additional guidance and training are also available on the GSA Intranet
at [http://insite.
gsa.private/cio/secframe.htm](http://insite.gsa.private/_cio/secframe.htm).

The second type is training the System Administrators (SAs) in security
competency. It is the manager's responsibility to ensure that the System
Administrators have been provided all the training needed to fulfill the
security requirements for which they are responsible.

Some sources for Government or commercial training are included as
suggestions, although they are not endorsed by GSA or PBS as the sole
source of training:

-   Local training companies, for OS and application-specific training

-   Community and local colleges and universities

-   The SANS (System Administration, Networking, and Security)
    Institute, for technical training

-   Information System Security Engineer (ISSE) (National Security
    Agency (NSA) and National Information Assurance Partnership (NIAP)),
    for certification and accreditation engineering training.

[]{#__RefHeading___Toc501251400 .anchor} Personnel Security

**Requirement:** CIO 2100.1

**Description:**

Personnel Security involves those activities that will make the users
aware of their respon­sibilities and the consequences of any failure to
abide by the regulations and rules for using the automation assets. This
is similar to the programs that are set up for working in secure areas.

Personnel security shall be part of the security control architecture.
Supervisors shall be responsible for coordinating and arranging system
access requests for all new or transferring employees and verifying an
individual's need to know.

**How to:**

Regardless of their position or job function, all personnel who have
access to the network will read and sign the acceptable rules of
behavior (Exhibit 8). They will attend periodic security train­ing; it is
the supervisor's role to set up, coordinate, and administer this
training for your site. Users will sign the usage agreement once, when
their email account is issued. Users will be briefed at least annually
on updates to the rules of behavior and the state of network security.
New procedures will be covered, and awareness of security concerns will
be reiterated. Training status will be annotated on the personnel
security forms.

Supervisors are also responsible for ensuring that all Government
property is returned and all access privileges are revoked when an
employee is terminated, detailed, or transferred. Super­­visors will
inform the ISSO of suspicious circumstances associated with personnel
employment status changes. Supervisors should consider suspending
employee access privileges when an employee will be or has been absent
for 30 days or more (e.g., due to a medical condition or travel), unless
remote access privileges have been granted.

> The details of such circumstances are protected by privacy regulations
> and should be treated as such.

The GSA Suitability and Personnel Security Handbook (ADM P 9732.1C)
describes the criteria and responsibilities for determining security
clearance requirements and ensuring per­sonnel with IT-related
responsibilities are properly cleared. All persons accessing sensi­tive
computer systems shall undergo background investigations, as described
in the hand­book. The handbook describes the minimum requirements for
background investigations; national agency checks shall be based upon
position and duties. GSA has determined that contractors who design,
operate, test, maintain, or monitor GSA systems shall be required to
have a minimum of a National Agency Check with Local Inquiries and
Credit Check (NAC(I)).

[]{#__RefHeading___Toc501251401 .anchor}Internet Use

**Requirement:** CIO 2100.1, Recommended Industry Best Practices

**Description:**

GSA employees and contractors shall use Government-provided information
systems for Government-related use in accordance with their job
functions and responsibilities. GSA employees and contractors are
prohibited from accessing systems that are not necessary for the
performance of their duties, or from performing functions on systems
that they are authorized to access but which are not related to their
job responsibilities. The GSA IT Security Action Plan specifies the
scope and applicability of system rules.

**How to:**

System administrators have the ability to audit network logs and perform
periodic checks for misuse.

[]{#__RefHeading___Toc501251402 .anchor} Email

**Requirement:** CIO 2160.2

**Description:**

It is your responsibility to ensure the appropriate use of email
systems. Various technical measures can assist in this goal.

**How to:**

Email is to be used primarily for official Government business. Persons
using GSA systems for sending electronic mail should make the same
provisions to ensure confidentiality as those that would be made for
sending hard copy correspondence. All activities on GSA infor­mation
systems are subject to monitoring; users should have no expectations of
privacy. By using GSA's email system, users agree to be governed by GSA
acceptable use policy regard­ing email. Detailed guidance is found in GSA
Order CIO 2160.2, dated September 24, 1998, "GSA Electronic Messaging
Policy."

[]{#__RefHeading___Toc501251403 .anchor}Sensitive Information

**Requirement:** CIO 2160.2

**Description:**

All personnel are responsible for the safeguarding and appropriate
handling of sensitive information. Sensitive information is defined as
that information which is critical to the operation of your regional
office, the National Office, PBS, GSA, U.S. Government operations, and
that information for which public release is inappropriate.

**How to:**

Ensure users are trained and briefed on how to handle sensitive
information. Maintain adequate access controls and accountability of
information. See GSA publications regarding the use and handling of
sensitive information.

[]{#__RefHeading___Toc501251404 .anchor} System Security

**Requirement:** CIO 2100.1, OMB A-130, Recommended Industry Best
Practices

**Description:**

Providing for system security requires planning and time. Managers will
ensure that the System Administrators have adequate resources to
establish and maintain system security levels. In order for managers to
understand some of the types of activities that must be performed, some
of these are described below. This list is only a representation of the
technical functions required by your System Administrators (SAs). It is
important to allocate time and training for them to be effective.

Listed below are additional areas with which managers should be
concerned.

**How to:**

***Hardening Systems:*** No system should ever be placed on the network
without a security configuration setup. "Hardening" refers to the
process of disabling unnecessary services, installing all the latest
patches, installing security software (e.g., anti-virus software),
tuning the operating system, and documenting the system on the network.
This takes considerable effort to accomplish but should not be taken
lightly. It takes only one incorrectly configured system to allow an
intruder into your network. Since this is a time-consuming process, your
support is vital to making this practical for the administrators.

***Network Architecture:*** The way that the systems are placed on the
network affects the level of security you can expect. It is standard
practice to keep the internal network separate from its publicly
accessible portion. Publicly accessible portions include things like Web
servers and mail systems. The way the two sections of the network are
separated varies. In many cases, a firewall is used to create something
called a demilitarized zone (DMZ). This is a separate area of the
network where the Web servers and other publicly accessible systems are
placed. You should support the efforts of the administrators in creating
and maintaining this DMZ.

***User Authentication and Identification:*** All GSA systems shall
incorporate proper user "authentication and identification" methodology.
This shall include authentication schemes that are based on user IDs and
passwords, tokens, or biometrics. To protect its systems and data, GSA
reserves the right to require organizational entities having access to
GSA systems (whether contractors or other agencies) to use access
controls commensurate with those used by GSA. Additionally, these
systems shall undergo periodic review of user access privileges (not to
exceed semi­annually).

[]{#__RefHeading___Toc501251405 .anchor} Physical Security

**Requirement:** CIO 2100.1

**Description:**

Physical security is considered one of the layers of the network model
known as the Open Systems Interconnection (OSI) Reference Model.
Physical security is important to protect your systems and network from
harm. This protection extends from safekeeping the systems from theft or
physical damage to preventing unauthorized access. It can be
demonstrated that given physical access to a system, it is a simple
matter to break in and then gain access to important business data.

All GSA employees and contractors are responsible for taking every
reasonable precaution to ensure the physical security of their IT
hardware and other assets, including mobile and port­able systems, from
theft, abuse, hazards, or unauthorized use. GSA servers, routers, and
other communication hardware essential for maintaining the operability
of the GSA systems and their connectivity to the GSA Backbone Network,
as well as any other hardware used by GSA in support of production
systems, shall be placed in a controlled-access location (i.e., behind
locked doors).

**How to:**

Managers will ensure that the systems that comprise the network (such as
file servers, Web servers, mail servers, and any other equipment that
forms the basis of the network) will be secured in an area where access
is controlled. Only authorized personnel will have access to network
equipment.

Managers will ensure that the users' systems are as secure as practical.
This includes securing the systems from casual use by installing
password-protected screensavers and the ability for users to lock the
workstations when they leave their area. More specific guidance is as
follows:

The responsibility to safeguard IT assets does not include GSA employees
or contractors endangering themselves or others by attempting to
physically prevent the unauthorized removal or destruction of IT
hardware, accessories, or supplies. In such a case, employees should
notify a Federal Protective Officer or other law enforcement
professional and follow their guidance.

At a minimum, Heads of Services and Staff Offices (HSSOs) and Region
Administrators (RAs) shall consider environmental controls in the
following areas:

-   Fire protection

-   Water

-   Electrical power, including backup sources and uninterruptible power
    supply (UPS) systems

-   Temperature and humidity

-   Heating, ventilation, and air conditioning (HVAC).

The excerpt below is derived from the GSA physical security guidelines
(GSA Internal Physical Security Handbook, PMS P S930.1 CHGE 3, dated
November 6, 1992).

> **PART 1. GENERAL**
>
> 1\. Applicability.
>
> a\. GSA computer facilities covered by this standard are those
> computer operations that contain mainframes, groups of minicomputers,
> or groups of servers.
>
> b\. Selected guidelines are also provided for vital support
> operations. For the most part, these will involve interfacing with the
> security of other activities in the building.
>
> c\. Any proposals for changes in the locations of existing facilities,
> major modifications to an existing facility, or the establishment of
> new facilities (facilities covered are defined in subpar. 1a, above)
> are to be closely coordinated with the Office of Management Controls
> and Evaluation (CE).
>
> 2\. Aspects of data processing security. It is recognized that in the
> broad sense, physical security for automated data processing
> facilities normally includes controlling access to specific areas,
> equipment and physical input/output media, and minimizing
> vulnerability to fire and other natural disasters.
>
> 3\. Limitations. The standards in this chapter are limited to those
> concerning hardware systems and administrative procedures that are
> applied in controlling access to computer facilities, physical
> input/output media, and, where applicable, vital supporting utilities.
>
> 4\. Threats. Threats, other than natural disasters, affecting the
> physical security of computer equipment, physical input/output media,
> and vital supporting utilities are listed below and discussed in terms
> of their probability of occurrence.
>
> a\. Robbery. Computer facilities do not handle items of interest to
> robbers.
>
> b\. Burglary-skilled. GSA computer facilities contain no items of
> interest to skilled burglar; therefore, the probability of this threat
> approaches zero.
>
> c\. Burglary-semiskilled. GSA computer facilities contain certain
> office machinery (typewriters, calculators) and certain peripheral
> computer equipment (terminals, printers) that would be of interest to
> a semiskilled burglar. Since, however, most GSA computer facilities
> are located in office buildings which contain a large amount of office
> equipment, the probability of a semiskilled burglar attacking any one
> computer facility is low; but not so low that defense against the
> threat should not be considered.
>
> d\. Burglary-unskilled. Unskilled burglars do not normally target
> office buildings for break-ins. In any case, defense against the
> probability would be included in any countermeasures against
> semiskilled burglars.
>
> e\. Larceny by an outsider. Given the large number of visitors to
> Federal build­ings, some of whom may be skilled or semiskilled
> burglars, it is possible an attempt could be made by an outsider to
> steal the equipment in a computer facility. However, this probability
> approaches zero since the equipment is gener­ally in areas more remote
> than those containing equally valuable equipment.
>
> f\. Larceny by an authorized visitor. Persons who visit computer
> facilities on official business are very rarely thieves. The
> probability of this threat is very low.
>
> g\. Larceny by an employee. In general, the opportunity for larceny by
> employees is high. The probability of skilled employees stealing
> office machinery or com­puter equipment is low. It is more likely they
> will attempt to alter software or the database for financial gain or
> other reasons. Prevention or reduction of this threat is beyond the
> scope of this handbook.
>
> h\. Arson. Although the probability of arson is generally low, the
> effects of a successful attempt can be catastrophic. Security measures
> to offset the threat are based on more than considerations of
> probability. Although an arsonist may possess breaking and entering
> ability at the level of a skilled burglar, the proba­bility of a person
> possessing such ability attacking a GSA computer facility is
> considered very low. Arsonists possessing the skills of a semiskilled
> burglar are doubtless few in number but defenses against the
> possibility are included in countermeasures used against semiskilled
> burglars.
>
> i\. Vandalism and sabotage. The same considerations hold for these
> threats as for arson\--low probability, high damage potential.
> Therefore, security measures are based on more than the probability of
> occurrence.
>
> 5\. Conclusion. Since semiskilled burglary, larceny by outsiders,
> arson, vandalism, and sabotage are the primary threats relating to the
> physical security of GSA computer facilities, the countermeasures
> employed are designed to primarily address those threats and no
> others. The countermeasures for each threat are discussed in the
> following parts of this chapter.
>
> 6\. Implementation of standards. For each GSA computer facility under
> their control, Heads of Services and Staff Offices (HSSOs) and
> Regional Admin­is­trators must develop procedures and guidelines to
> implement the standards established in this chapter.
>
> 7\. Reserved.
>
> **PART 2. PERIMETER BARRIER STANDARDS**
>
> 8\. General.
>
> a\. The primary purpose of the perimeter barrier standards listed
> herein is to deny access (when the computer facility is unoccupied by
> employees) to semiskilled burglars, and to arsonists, vandals, and
> saboteurs who may possess the break­ing and entering ability of
> semiskilled burglars.
>
> b\. Computer facility barrier construction has traditionally focused
> on the fire resistance of walls, floors, ceilings, and their openings.
> Historically, fire has been the most frequent and expensive cause of
> computer facility damage. The HB, Facilities Standards for Public
> Buildings Service (PBS P 3430.1A), details build­ing materials' fire
> resistance and flame spread ratings for general Government occupancy
> with deference to national standards as they pertain to computer
> facility requirements.
>
> c\. The appropriate regional Public Buildings Service and Safety and
> Environ­mental Management Branch should be consulted when any new
> construction or remodeling is planned so as to guarantee that GSA fire
> codes and safety requirements are met.
>
> d\. The barriers required by PBS P 3430.1A are adequate for protection
> against semiskilled burglars provided they are augmented, where
> necessary, by the counter measures prescribed below.
>
> 9\. Computer center walls.
>
> a\. Fasten insert panels on computer facility walls so that they
> cannot be silently removed within 5 minutes.
>
> b\. Where ducts, pipes, and registers are in excess of 96 square
> inches as they pass through computer facility walls, floors or
> ceilings, they must be protected with one of the barriers prescribed
> in app. E, pt. 2. The Safety and Environmental Management Branch or
> host Buildings Manager must be notified of the planned barrier
> installation to ensure there will be no interference with heating and
> air conditioning systems.
>
> 10\. Windows.
>
> a\. Make windows in computer facility walls at ground level out of one
> of the "moderate" burglar resistant glazings prescribed in app. D-5.
> Window framing must meet those construction standards set forth in
> app. C, pt. 2.
>
> b\. Service counter shutters in computer facility administrative
> areas, placed in walls common to space not controlled by the ADP
> services activity, must have a padlock mounted on the interior that
> meets the specifications of app. B-12. Use this lock regardless of any
> that may be furnished with the shutter.
>
> 11\. Doors.
>
> a\. New doors selected for the computer facility perimeter must meet
> the con­struc­tion and hinge requirements of apps. A-6 and 13, and must
> be fire labeled in accordance with the HB, PBS P 3430.1A. Other
> options will be considered on a waiver basis (ch. 1-6) but requests
> must be coordinated with the appropriate Physical Security Coordinator
> and the regional Safety and Environmental Management Branch, Public
> Buildings Service.
>
> b\. Vision panels in computer facility doors are not to exceed a
> maximum of 100 square inches. Make vision panels in fire-rated doors
> of wired glass set in approved steel frames. Those panels on doors
> common with corridors not con­trolled by the computer facility must be
> covered on the interior with an opaque material. The covering must be
> removable for identification of those desiring entrance.
>
> c\. Doors to the area where the remote-site backup data files and
> vital utilities machinery are located must meet the requirements for
> security area perimeter doors prescribed by app. A.
>
> 12\. Locking devices. Secure entrance doors with locks as prescribed
> in apps. A and B when vital computer center operations are unattended.
> Do not use pad­locks for this purpose. As an exception to this locking
> requirement, mechanical and electromechanical latches and strike units
> are permitted to secure a vital-operation entrance when the area is
> temporarily unattended during business hours. Any installed locking
> device must allow for the occupants of the room to exit without the
> use of a key, tool, special knowledge, or effort. Doors must open with
> one easy motion.

[]{#__RefHeading___Toc501251406
.anchor}![](media/image8.jpeg){width="5.73125in"
height="2.9770833333333333in"}

[]{#__RefHeading___Toc501251407 .anchor} Passwords

**Requirement:** OMB A-130, CIO 2100.1

**Description:**

This guide captures various requirements and procedures for the
administration of the password system on PBS networks. Portions of
applicable regulations have been excerpted where appropriate.

**How to:**

-   Several factors should be considered when establishing an effective
    password policy. Hackers will often try to guess the System
    Administrator's (SA\'s) password. As part of the hardening process
    on Microsoft Windows NT systems, we recommend that the Administrator
    account name be changed. It should be noted that this is not always
    100 percent effective, since the ID is also associated with a System
    ID (SID), which is hard-coded. We also recommend that a series of
    other Administrator accounts be established and used for day-to-day
    administration; this allows a higher degree of protection for the
    administrator account. Store the SA user name and password in a
    sealed envelope in a locked container, for those cases when it has
    been forgotten.

The following items have been excerpted from Attachment 2 of CIO 2100.1,
"User ID/Password Guidelines":

-   Do not store passwords in a clear text file for referencing. Use a
    sealed envelope stored in a safe.

-   Passwords shall be changed or expire in 90 days or less.

-   Do not enable a password to be reused for at least four iterations.

-   Allow only one user per account; never share UserIDs or passwords.

-   Never assign a login account a password that is the same string as
    the UserID or that contains the UserID.

-   Never install a guest/guest account.

-   Deactivate unused accounts monthly.

-   No accounts will be named anonymous, ftp, telnet, www, host, user,
    bin, nobody, etc.

-   Never set any password equal to the null string, which is equivalent
    to no password at all.

PBS and GSA guidance says passwords shall:

-   Be at least 8 characters in length.

-   Contain a combination of alphabetic, numeric, and special
    characters.

-   Contain a non-numeric in the first and last position.

-   Contain no more than three identical consecutive characters in any
    position from the previous password.

-   Not contain any dictionary word in any language.

-   Not contain any proper noun or the name of any person, pet, child,
    or fictional character. Passwords shall not contain any employee
    serial number, Social Security number, birth date, telephone number,
    or any information that could be readily guessed about the creator
    of the password.

-   Not contain any simple pattern of letters or numbers, such as
    "qwerty" or "xyz123."

-   Not be any word, noun, or name spelled backwards or appended with a
    single digit or with a two-digit year string, such as 98xyz123. The
    manager or owner of the host shall revalidate all user IDs at least
    annually.

It is useful for a System Administrator to know the different ways in
which a password can be compromised and what actions can be done to
prevent it.

"Social Engineering" is a term that is commonly used to describe taking
advantage of an employee's trust, ignorance of procedures, or apathy.
This includes calling employees and telling them that the caller is the
SA and needs the employee's user ID and password. This can only be
combated by educating your users. Let the policy be known:

**As a general rule PBS system administrators will not ask you for
your** **password. Should you be asked for your password over the phone
or via e-mail, you will need to verify the request with a third party
such as the Administrator\'s Supervisor or the help desk, whom you
should call yourself.**

A legitimate Systems Administrator should have sufficient access to make
changes without ever needing the user\'s password.

"Network sniffing" is a term that describes monitoring the traffic that
flows across a network. It is the same as using a network protocol
analyzer to see the actual data. The difference is that the attacker
will use a sniffer to look for user IDs and passwords, which are
generally sent across the network in plain text. This method eliminates
the need to "crack" or decrypt any passwords that have been encrypted.
The passwords can be seen flowing across in their unencrypted form.

"Password cracking" is the term that describes using software to guess
at a password or try to re-create the same password using a dictionary
of predefined words. The attacker gains access to the password file or
the System Account Manager (SAM) database, and then starts running a
cracker against the file. This is common enough that stringent password
controls must be used to ensure that passwords are not easily guessed.

Two methods that solve these various problems are smart card technology
or biometrics.

[]{#__RefHeading___Toc501251408 .anchor}Alerts and Advisories

**Requirement:** CIO 2100.1

**Description:**

Upon receipt of an alert or advisory, your role is to implement the
instructions. You should respond within a specified time frame regarding
either completed status or why the action cannot be completed.

**How to:**

Each Alert message will have specific instructions on how to implement
the security fix. Upon completion, the system log for each affected
system should be updated to reflect the changes made. You must report to
the security manager about the status of the Alert actions for each
affected system. Each Alert or Advisory may have suspense information
attached that sets timelines for completing the actions.

[]{#__RefHeading___Toc501251409 .anchor} Incident Handling

**Requirement:** CIO 2100.1

**Description:**

The incident handling duties of a System Administrator are different
from those of a user, in that the SA will respond to the incident.
Therefore, the role of the System Administrator consists of the
following parts and responsibilities:

-   You must facilitate incident reporting by receiving and forwarding
    the reports through the reporting process to PBS.

-   You must respond to the incident.

-   You must handle the incident while gathering and preserving forensic
    evidence.

**How to:**

System Administrator awareness of an incident may come from a variety of
sources. Often, the report may originate from outside the network when
another System Administrator notices unusual activity that involves your
network. At other times, awareness may originate from internal users,
FEDCIRC, or your IT shop.

Upon notification of an incident, the System Administrator will take
immediate action in the form of triage. Much like its name sounds,
triage is a form of first aid. Its purpose is to pro­vide immediate
protection and relief from an attack. This may involve such steps as
blocking IP addresses that are the source of the attack and isolating
ADP resources in a last-ditch effort. The goal is stop the intruder from
inflicting damage. This may take a bit of savvy on your part to
determine the type of attack and potential outcomes.

Should a breech be serious enough to warrant prosecution, law
enforcement will want to be able to show a chain of custody and records
of what actions were taken. Part of your duties, therefore, will include
recording all the actions you take, including triage steps and other
regular or routine work that happens to the affected systems. This log
should be separate from normal system logs, since it may be taken and
used as evidence.

Lastly, you will report all actions and work in coordination with your
Security manager, PBS, and any outside organization or agency with which
you are instructed to cooperate.

At no time will you report to law enforcement or outside agencies on
your own. All of these actions will be coordinated with the PBS main
office.

[]{#__RefHeading___Toc501251410 .anchor}System Log Books

**Requirement:** Recommended Industry Best Practices

**Description:**

One of the issues with information security, as with many other
disciplines, is the quality and amount of available system
documentation. System log books help record the status of net­work
equipment and provide continuity among administrators. It is an industry
standard practice to maintain system logs. This also helps to provide
answers and plan for recovery in the event of problems.

**How to:**

All systems that are a part of the network infrastructure will have a
log book. The network infrastructure includes servers such as mail, Web,
and file servers; routers; firewalls; and any other back-office
equipment. The log book may be in paper or electronic form. Information
to be recorded includes:

-   Date of the action

-   Administrator's name

-   Software that was loaded

-   Patches and patch numbers that were installed

-   Problems encountered

-   Any other information relevant to CM or system changes

-   System Administrator remarks

-   Backup software label when backups are performed.

In the event that a system must be reloaded, all relevant data on the
current OS and patch level will be recorded. The system should be
brought back to the patch levels in effect before reloading.

[]{#__RefHeading___Toc501251411 .anchor} Vendor Patches

**Requirement:** CIO 2100.1, Recommended Industry Best Practices

**Description:**

Maintaining patches is the single greatest action administrators can
undertake to secure their networks. Vendors will typically provide OS
patches and fixes for security problems, which can be loaded separately
from the application.

**How to:**

It is not always possible to test all of the various systems that may be
located in your region. Therefore, it is advisable to perform a level 0
backup on your systems before patch installation. This level 0 backup
should be preserved as part of the system's new OS and application
baseline.

Specific details on how to load patches can be obtained at the vendors'
sites.

[]{#__RefHeading___Toc501251412 .anchor}Audit Logs

**Requirement:** Recommended Industry Best Practices

**Description:**

Auditing logs is a good method to tune your systems, as well as review
them for security problems. At times, you will be able to tell if you
suffered an intrusion only by reviewing the logs.

**How to:**

Details on how to review and audit system and application logs can be
found on the vendors' sites. Examples for Microsoft Windows NT are shown
below.

Make the selections from Start Programs Administrative Tools menu
options. Samples of the Event Log Settings and Audit Policy dialog boxes
are shown below.

![](media/image9.png)

[]{#__RefHeading___Toc501500823 .anchor}Exhibit 2 Event Log Settings
Dialog Box

![](media/image10.png)

[]{#__RefHeading___Toc501500824 .anchor}Exhibit 3 Audit Policy Dialog
Box

[]{#__RefHeading___Toc501251413 .anchor}Warning Banners

**Requirement:** CIO 2100.1 (Part 4, Paragraph 9.j.)

**Description:**

You are required to ensure that appropriate warning banners are placed
on all systems. This includes banners for internal and local logins as
well as external logins using protocols like telnet and ftp. Use the
following text, which has been approved by PBS:

**This is a U.S. General Services Administration Federal government
computer system that is "FOR OFFICIAL USE ONLY." This system is subject
to monitoring. Therefore, no expectation of privacy is to be assumed.
Individuals found performing unauthorized activities are subject to
disciplinary actions including criminal prosecution.**

**How to:**

For ***Microsoft Windows NT:***

-   Edit the registry "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows
    NT\\Current Version\\Winlogon\\LegalNoticeCaption."

-   Set the value to "Legal Notice."

-   Then edit the registry
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Windows\\Windows NT\\Current
    Version\\Winlogon\\LegalNoticeText."

-   Change the value by adding the correct text as indicated above.

Software tools are available to help you manage warning banners on a
larger scale. Infor­ma­tion is not provided at this time, although
regional feedback could be provided here for the benefit of other
regions. If you have any experience with these tools, you are encouraged
to share the information.

For ***Unix*** the procedure can vary. Individual Operating Systems and
individual protocols may have slightly different procedures. For a
Solaris System, perform the following:

-   To change banner messages for incoming telnet and FTP connections,
    create the /etc/default/telnetd and /etc/default/ftpd files.

-   Add a line similar to the following: BANNER="my text"

It is also possible to change the banner message that the sendmail
process presents for incoming mail delivery connections.

-   Search the /etc/mail/sendmail.cf file for the following line:\
    SmtpGreetingMessage=\$j Sendmail \$v/\$Z; \$b

-   Change it to: SmtpGreetingMessage=My text.

[]{#__RefHeading___Toc501251414 .anchor}Certification and Accreditation

**Requirement:** CIO 2100.1

**Description:**

Site certification is the official government way of allowing the
network to continue oper­ating. The Information Systems Security Officer
(ISSO) will be heavily involved in this activity and will require your
assistance. Various information items must be gathered about the
network. This is an instance in which a diligently maintained system log
will prove to be a time saver and a resource.

**How to:**

Information required for certification depends on several factors.
Consult with the ISSO.

[]{#__RefHeading___Toc501251415 .anchor} Remote Access

**Requirement:** CIO 2100.1, OMB Circular A-130

**Description:**

The security of the internal network very often depends on the trust
relationships that extend beyond the network itself. In the case of
remote access, we accept the idea that the remote location is provided
with the same security levels that we require on our internal network.
Often, however, there is very little that can be done to ensure this. In
these cases, we have set a policy that we expect our users to comply
with. It is your job to administer this policy by using various control
mechanisms and training users when they establish their remote accounts.

In addition, we are dealing with remote access of outside systems from
within PBS. One way this is done is when users install modems on their
computers. This allows them to have an internal network connection and
dial out to other networks. This, in effect, bypasses the fire­wall and
other security measures that may be in place.

**How to:**

Two items from CIO 2100.1 describe the remote access concerns you will
have as follows:

> \(1\) According to OMB Circular A-130, for a community to effectively
> manage risk, it must control access to and from other systems. The
> degree of such control should be defined in the system security plan
> and all system users should be informed of any limitations on outside
> access. Technical controls to limit access should be implemented in
> accordance with guidance issued by FIPS Publication 83 (September
> 1980), "Guidelines on User Authentication Techniques for Computer
> Network Access Control" by the National Institute of Standards and
> Technology (NIST).
>
> \(2\) The degree of interconnection varies among systems. For example,
> some systems will be stand-alone, some will have restricted access
> (e.g., allowing only e-mail connections or remote access through
> sophisticated authentica­tion procedures); and others will be fully
> accessible. The management deci­sion to interconnect systems should be
> based on the availability and use of tech­nical and non-technical
> safeguards and should be consistent with the acceptable level of risk
> as defined in the system rules. If GSA systems inter­connect, they
> shall connect using a secure methodology (such as a firewall) that
> provides security commensurate with acceptable risk and limit access
> only to the information needed by the other system. Guidelines for
> Internet use and access are in Attachment 4.
>
> Additionally:
>
> **l. [Remote access]{.underline}.** Remote access to the GSA domain
> shall be restricted to secure methods using approved identification
> and authentication methods that provide detection of intrusion
> attempts and protection against unauthorized access.

[]{#__RefHeading___Toc501251416 .anchor} Email

**Requirement:** CIO 2160.2

**Description:**

This section contains information on setting up, configuring, and
maintaining email servers. Since the e-mail system (GSA Enterprise
Messaging Services or GEMS) is managed at the GSA level, this
information is provided as technical background.

**How to:**

At a minimum, the email server should be set up to perform only the job
of accepting and transmitting mail. This means that the email server
should be hardened according to the information provided in the System
Security section. The email server should be placed in the DMZ, if you
have one, and have the latest versions of email and bind software
required to fulfill its role.

"Spam" is often sent out using other mail servers without the knowledge
of the owners. Your mail system should be configured to prevent mail
relaying.

Anti-virus software may be incorporated into the mail server to catch
and quarantine infected mail before it is allowed inside the network.

The following diagram illustrates placement of the mail server.

![](media/image11.wmf){width="3.591666666666667in" height="2.39375in"}

[]{#__RefHeading___Toc501500825 .anchor}Exhibit 4 Mail Server Placement

The email server should not run other software or be placed into service
to perform other functions (such as serving as a Domain Name System
(DNS) server). This opens the mail server up to other kinds of attacks.

You are not authorized to peruse users email accounts. This is
considered a very serious breach of ethics and a violation of privacy
rights and is unacceptable behavior. Only under controlled circumstances
will such an action be undertaken. The ISSM will be the approving
authority for viewing the content of email and will also serve as the
control.

[]{#__RefHeading___Toc501251417 .anchor} Backups

**Requirement:** Recommended Industry Best Practices

**Description:**

In today's computing environment, information is the key to driving
production forward. It is your responsibility to ensure that
hierarchical backups are performed on a daily basis.

**How to:**

The most common hierarchical backup scheme involves three redundant
copies of backups over a given period of time. This is often referred to
as the grandfather-father-son scheme. The idea is that a tape is not
returned to the reuse stack until it is the fourth tape in a given
series. A series consists of daily backups, weekly backups, and monthly
backups. A level 0 backup is a complete copy of the entire file system.
This may be performed monthly, in which it is part of the scheme, or on
both a periodic and an as-needed basis. For example, a good time to
perform a level 0 backup of the operating system is when changes are
made to the OS files.

Periodic checks of the backup tapes should be made to ensure that they
contain valid data. This will prevent an unrecoverable emergency when a
restore must be performed and the tape contains bad or no data.

PBS regional offices back up all of their systems Monday through Friday
(daily). At mini­mum, a 5-week cycle is used in which tapes are set aside
every day for that cycle along with a set of tapes for each system for
Week 1, Week 2, Week 3, Week 4, and Week 5. Friday's tapes will be sent
to storage by Tuesday of the following week after getting a good backup
on Monday.

Monthly backups will be performed on all the systems on the last day of
the month; these backups will be sent off site as soon as possible.
After retaining the monthly backups for 1 year, they may then be reused
for the same month the next year; in this way, they are recycled.

A copy of the backups should be stored at an off-site location; ideally,
this would be the alternate site identified in the Contingency Plan. In
some instances, regional offices have contracts with companies that pick
up and store the tapes, which is also acceptable.

Backup procedures may vary among the regions. Minimum standards are
designed to ensure that some level of confidence is attained. Regions
are encouraged to document their specific procedures, so they may be
included in this handbook.

[]{#__RefHeading___Toc501251418 .anchor}Physical Security

**Requirement:** CIO 2100.1

**Description:**

Physical security of the system relies on adequately controlled access
to the systems.

**How to:**

You will set up servers in an area that has been designated for this
purpose. They should be in an environment that will protect them from
environmental damage and casual access by personnel. Examples of
environmental damage include:

-   Water damage

-   Fire damage

-   Dust, dirt, and smoke

-   Temperature extremes

-   Humidity.

It has been noted that at some regions, the fire sprinklers in the
computer room are water-based. The location of the emergency shut-off
valves for only the computer room should be noted by all personnel.
Waterproof covers for the computer equipment should be on hand or
readily accessible, in the event they are needed for protection from
water damage from the sprinklers.

[]{#__RefHeading___Toc501251419 .anchor} Anti Virus

**Requirement:** CIO 2100.1

**Description:**

You should set up and administer an active anti-virus (AV) defense for
your site.

**How to:**

You should install AV software on all systems and maintain the updates
on a regularly scheduled basis.

A recommended approach is to install a two-tier architecture for AV
support. The first tier (or level) should be network-based and provide
protection at the mail server. This allows the AV software installed on
the mail server to catch viruses before they can get to a user's
work­station. This also provides the System Administrator with control
during the times when a new virus is spreading, because it allows "bulk"
cleaning of the mail system. The second, workstation-based tier provides
protection at the individual workstation level, so AV soft­ware should be
installed on all the workstations. This provides a redundant AV
mechanism and protects the individual system from contamination by files
that a user may introduce via diskette or Internet downloads.

[]{#__RefHeading___Toc501251420 .anchor}System Configuration

**Requirement:** Recommended Industry Best Practices

**Description:**

All systems introduced on your network should be made secure before
placing them online. This is known as "hardening" the systems.

**How to:**

Harden all systems before placing them on the network. All systems will
have the latest patches for their OS installed. This is the single, most
important action an administrator can take to secure a site.
Additionally, hotfixes or updates for operating systems and applications
will be installed.

A review of the services offered by each networked computer will help
you determine which protocols and services are active on the system. All
unnecessary services will be disabled. Most intrusions on the network
occur by exploiting the unnecessary services running on a system. (For
example, if a mail server does not need to allow File Transfer Protocol
(FTP), then FTP should be disabled.)

You may conduct a review of the protocols with a scanning tool or
various other methods.

While hardening the individual systems, their logbook entries should be
updated to indicate the activities performed. Some of the recommended
procedures include:

-   Install patches and warning banners.

-   Disable unnecessary services.

-   Modify registry access permissions to allow only SAs to access
    certain entries. (See Microsoft guidelines.)

-   Set up administrator accounts for individual administrators.

-   Update anti-virus software.

-   Enable auditing.

-   Verify the need for modems; remove them if they are unnecessary.

-   Locate systems according to the security required (i.e., behind a
    firewall or in the DMZ).

Network Architecture

**Requirement:** Recommended Industry Best Practices

**Description:**

GSA has the responsibility of establishing the network in a secure
manner; this section is provided as technical background information.
The way this security is achieved is through the use of network
architectures suited to protecting information systems and setting in
place an appropriate infrastructure to guard the network.

**How to:**

Your network should be protected by a suitable firewall. It is important
to know that a firewall does little to protect certain systems, like
your Web server. By its nature, your Web server is vulnerable. Use the
information in the Web Server section to secure your Web server
separately. Due to its special circumstances, such as the need to allow
public access, you should set up a service network or DMZ where you can
place these special servers.

![](media/image12.wmf){width="3.6645833333333333in"
height="2.4770833333333333in"}

Exhibit 5 Firewall and Web Server Placement

There are many different configurations, and each has its own advantages
and disadvantages. There are many different ways to build a DMZ. The use
of routers can help form a screen or buffer between the internal and
external network. You may consider the setup illustrated on the next
page when you do not have a firewall available.

![](media/image13.wmf){width="4.532638888888889in"
height="5.314583333333333in"}

Exhibit 6 Web and Mail Servers Without a Firewall

[]{#__RefHeading___Toc501251422
.anchor}Users![](media/image14.jpeg){width="5.468055555555556in"
height="5.354166666666667in"}

[]{#__RefHeading___Toc501251423 .anchor} Training

**Requirement:** CIO 2100.1

**Description:**

The attendance of training and awareness programs is very useful in
helping you stay abreast of the latest rules, practices, and other
issues surrounding Internet security.

**How to:**

Users will attend periodic training as sponsored by the National Office
or their regional office. Inquiries about schedules for training should
be made at the local offices. Some computer-based training systems are
available, and other stand-alone training may exist.

Computer-based training is available on the GSA Intranet at
[http://insite.gsa.private/cio/
secframe.htm](http://insite.gsa.private/_cio/secframe.htm).

[]{#__RefHeading___Toc501251424 .anchor}Email

**Requirement:** CIO 2160.2

**Description:**

The discussions surrounding email are about two general subjects. The
first is privacy and your email, and the second deals with the ethical
use of your email account.

**How to:**

Privacy issues are well founded, and there is much confusion over this.
It is PBS' policy that no user accounts will be monitored without
authorization. However, PBS reserves the right to read and peruse email
accounts when necessary to protect PBS assets; there is no expec­ta­tion
of privacy. Additionally, in general, email that is of an official
nature is subject to the rules of archiving as set forth by the National
Archives and Records Administration (NARA) and certain Freedom of
Information Act (FOIA) requests.

The use of email should be limited to official business, although PBS
may allow certain informal uses. This type of email use is limited and
must meet the following conditions:

-   Is in accordance with policy and the guidelines set by the Regional
    Systems Chief (RSC) or the National Office.

-   Does not interfere with work productivity.

-   Does not interfere with other users or the network.

Inappropriate use of email is not authorized. Inappropriate use
includes, but is not limited to, such things as engaging in spam or
emailing sites that are considered lewd and not suited for the
workplace.

More specific guidance is excerpted from the GSA Security Guide, as
follows:

> Email is to be used primarily for official Government business.
> Persons using GSA systems for sending electronic mail should make the
> same provisions to ensure confidentiality as would be taken for
> sending hard copy corre­spon­dence. All activity on GSA information
> systems is subject to monitoring; there is no expectation of privacy
> for users. In using GSA's email system, users agree to be governed by
> GSA acceptable use policy regarding electronic mail. Detailed guidance
> is found in GSA Order CIO 2160.2, September 24, 1998, GSA Electronic
> Messaging Policy.

Violations of these email usage guidelines will be reported using the
same mechanisms as those used for reporting a computer security
incident.

[]{#__RefHeading___Toc501251425 .anchor}Internet Usage

**Requirement:** GSA Order ADM 7800.11, CIO 2100.1

**Description:**

Authorized users are governed by the conditions stipulated in GSA Order
ADM 7800.11, "Personal Use of Agency Office Equipment." The Remote
Access Service (RAS) capability is not to be used as a substitute for an
on-line local area network (LAN) connection, but rather as a dial-up
connection for a limited period of time. Users are responsible for
ensuring that this connection is secure. Upon completion of duties,
users should terminate the dial-up connection.

**How to:**

Internet use is limited to official duties. At no time will an Internet
site be visited that con­tains lewd, obscene, or otherwise unacceptable
material. The following guidelines apply:

-   Internet use may be monitored.

-   Excess use for non-official purposes is not authorized, although
    some incidental use may be acceptable, provided it does not
    interfere with work or place a burden on the network.

-   Use for illegal activities will be reported to law enforcement
    authorities.

-   

-   

[]{#__RefHeading___Toc501251426 .anchor} Passwords

**Requirement:** OMB A-130, CIO 2100.1

**Description:**

It is very easy for you to compromise a system by not following proper
password procedures. The guidelines below have been established for you
to follow.

**Passwords shall:**

-   Be at least 8 characters in length.

-   Contain a combination of alphabetic, numeric, and special
    characters.

-   Contain a non-numeric character in the first and last positions.

-   Contain no more than three identical consecutive characters in any
    position from the previous password.

-   Not contain any dictionary word in any language.

-   Not contain any proper noun or the name of any person, pet, child,
    or fictional character. Passwords shall not contain any employee
    serial number, Social Security number, birth date, telephone number,
    or any information that could be readily guessed about the creator
    of the password.

-   Not contain any simple pattern of letters or numbers, such as
    "qwerty" or "xyz123."

-   Not be any word, noun, or name spelled backwards or appended with a
    single digit or with a two-digit year string, such as 98xyz123. The
    host's manager or owner shall revalidate all userIDs at least
    annually.

**General Rules of Behavior**

**As a general rule,** **PBS system administrators will not ask you for
your password. Should you be asked for your password over the phone or
via e-mail, you will need to verify the request with a third party such
as the Administrators Supervisor or the help desk, whom you should call
yourself.**

A legitimate Systems Administrator will have sufficient access to make
changes without ever needing to know your password.

You should not share your password with other users. Your password is
also accountability for when you logged on and what resources you used.

Do not make a note of your password and then store it on a post-it note
somewhere on the computer or in your cubicle. Snoopers will look under
your keyboard, desk drawers, and desk. Do not attempt to hide your
password somewhere in your workspace.

Try to select pass phrases, which are easy to remember but difficult to
crack. Form a pass phrase by taking the first or last letter of each
word in the phrase as your password. For example, "One small step for
man, one giant leap for mankind" becomes the password "ossfmoglfm." By
adding special characters, you can make it more secure and conform to
the PBS standards; for example, "ossfm!oglfm" is such a password.

[]{#__RefHeading___Toc501251427 .anchor} Physical Security

**Requirement:** CIO 2100.1

**Description:**

You are required to ensure adequate protection of your user account and
workstation. It is your responsibility to takes steps to safeguard your
account while you are logged in.

**How to:**

When you leave your terminal area, either log off or secure your
terminal by means of screen or keyboard locking (whichever is
available). Screen savers can be password-protected, and other measures
may be available to you. Consult with your System Administrator for
detailed information for your region.

[]{#__RefHeading___Toc501251428 .anchor}Anti-Virus

**Requirement:** CIO 2100.1

**Description:**

The creation and spread of computer viruses has made it imperative that
certain protocols are followed. This both affords the requisite
protection to the network and safeguards your data.

**How to:**

Anti-virus software will be installed and functioning on your
workstation. You are not allowed to disable this software.

All diskettes and downloaded software must be scanned before its use or
storage is permitted on PBS networks.

[]{#__RefHeading___Toc501251429 .anchor} Sensitive Information

**Requirement:** CIO 2160.2

**Description:**

If you have access to or work with sensitive information, it is your
responsibility to ensure the safeguarding of this information. Some
steps to take are listed below.

**How to:**

-   Do not permit unauthorized access to your account.

-   Do not share your account login userID and password with others.

-   Limit printing of material to printers that you can access.

-   Use proper handling procedures for printed material.

[]{#__RefHeading___Toc501251430 .anchor}Incident Reporting

**Requirement:** CIO 2100.1

**Description:**

Incident reporting refers to the steps you take when you have identified
a potential computer security problem. You are the first line of defense
in the PBS security plan. Without your responsible cooperation, we
cannot continue to protect and defend our networks. Everyone is
responsible---regardless of the job function or role---for reporting
security problems to their supervisors or to the network administrator.

**How to:**

Specific guidance from CIO 2100.1 is described in the following
paragraphs.

All authorized IT users shall report security incidents and suspected
violations promptly. You will contact the ISSO or your System
Administrator. They will ask you to fill out the GSA Cyber Incident
Reporting Form (shown at the end of this section). This will provide
them with the information they require to pursue the investigation. If
you cannot reach either the ISSO or your System Adminis­trator, contact
your supervisor who will attempt to contact the regional manager.

It is the responsibility of all personnel to report **significant**
computer or cyber security incidents.

> *A security incident is defined to be any adverse event that threatens
> the security of information resources. Adverse events include
> compromises of inte­grity, denial of service, compromises of
> confidentiality, loss of account­a­bility, or damage to any part of the
> system. Examples of incidents include: the insertion of malicious code
> (e.g., viruses, Trojan horses, or back doors); unauthorized scans or
> probes; successful and unsuccessful intrusions; and insider attacks.*

Specifically, you should report the following items or events:

-   **Malicious Code:** This includes viruses, Trojan horses, or worms
    that cause or have the potential to cause significant or widespread
    damage; are unknown; are known but have never before observed; or
    are known and are newly recurring.

-   **Probes and Reconnaissance Scans:** Those scanning major portions
    of a site's network for critical services, such as DNS, or repeated
    or nuisance scans.

-   **Unauthorized Access and Unsuccessful Attempts:** Report all
    successful, unauthorized accesses and unsuccessful attempts. In
    addition, report how access was attempted. These include malicious
    scans where the scan tool also attempts to exploit discovered
    vulnerabilities.

-   **Denial-of-Service Event:** Any denial of service that affects a
    critical service including, but not limited to, an email server, a
    primary Web server, or Internet Web access.

-   **Adverse Publicity Event:** Any incident that can or did cause
    adverse publicity for the site involved for GSA PBS.

-   **Site Significant Event:** Those defined in the IT Security Plan
    that have a significant impact on the site's mission or operations.

Use the GSA Cyber Incident Reporting Form (shown on the next page) when
reporting an incident. This form assists you in reporting the incident,
gathering data, and creating a cyber attack profile. These types of data
are useful in characterizing, grouping, analyzing, and reporting
incidents. It is not always possible to determine the root cause of an
intrusion or even the actions of an intruder because of the lack of
"fingerprints." Also, you may want to report other characteristics of an
incident that do not fit any of the identified categories. Each site
should also determine which incidents would warrant a detailed
investigation, and then document the appropriate criteria for this
determination in their site's IT Security Plan.

![](media/image15.wmf){width="6.606944444444444in"
height="7.883333333333334in"}

[]{#__RefHeading___Toc501500828 .anchor}Exhibit 7 GSA Cyber Incident
Reporting Form

### Rules of Behavior

(S A M P L E)

GSA \"\_\_\_\_\_\_\" users must

-   Understand the nature of their specific roles and responsibilities
    within the application.

-   Attend Notes training before obtaining Notes access and user
    privileges.

-   Attend GSA \"\_\_\_\_\_\_\" training before using the application in
    a production mode.

```{=html}
<!-- -->
```
-   Not attempt to perform any actions that are outside the scope of
    their responsibilities, as defined by their user classification.

```{=html}
<!-- -->
```
-   Not enter false or inaccurate data into the application.

-   Not attempt to circumvent existing application security controls.

-   Not use the application for other than official agency business.

-   Use only the information they are authorized to access and in the
    manner they are authorized to use it.

-   Not use their application privileges to obtain data or files for
    unauthorized individuals.

-   Always use the Notes log-out feature (press the F5 key) when leaving
    their PCs unattended while Notes is running.

    ***Application-Specific Rules of Behavior:***

    The following GSA \"\_\_\_\_\_\_\"-specific rules of behavior are
    enforced using specific technical controls.

    GSA \"\_\_\_\_\_\_\" users must:

```{=html}
<!-- -->
```
-   Not alter any information on the electronic form once the writer has
    signed it electronically. (An exception is made for the funding
    official, as noted below.)

-   Take action only on the sections of the form that are currently
    active (i.e., "editable").

-   Not delete records from the tracking database.

-   Report any potential security infraction (e.g., an error message
    indicating that a document's electronic signature is no longer
    secure) to their unit's GSA \"\_\_\_\_\_\_\" system administrator or
    a member of the GSA \"\_\_\_\_\_\_\" team.

    ***Role-Specific Rules of Behavior:***

```{=html}
<!-- -->
```
-   Funding officials may modify any preliminary funding information
    entered by a previous form user (e.g., preparer, requester, or
    approver).

-   System administrators may not add the name of any unauthorized
    person to any ACL or group that would give him or her inappropriate
    access to the application.

Exhibit 8 Rules of Behavior

-   System administrators must ensure that all database Access Control
    Logs (ACLs) are set correctly and are modified only as appropriate.

-   System administrators must follow the procedures outlined in the
    system administrator documentation, which is available online in the
    system administrator's database.

-   System administrators must report all suspected security infractions
    to a GSA \"\_\_\_\_\_\_\" team member.

### Rules of Behavior Governing Remote Use

Lotus Notes allows remote users to dial into application file servers to
gain access to applications and the information stored therein. The
process for verifying the identity and access rights of the user
(accepting the Notes ID and password, using the ACL) is the same for
remote and local users. Therefore, using the application remotely would,
in theory, involve no additional rules of behavior for the user. The
same rules of behavior that apply to all system users would apply.

### Consequences of Inappropriate Behavior

All users of GSA \"\_\_\_\_\_\_\" computer systems are subject to
certain rules and conditions concerning the system's official and
appropriate use. These rules appear under the title "Warning Notice" on
each user's computer screen each time that the system is turned on. The
warning notice incorporates the following language: "Unauthorized access
or use of this computer system may subject violators to criminal, civil,
and/or administrative action." The user's access or use of the computer
system implies consent to this policy.

The rules governing the behavior of individuals who use GSA
\"\_\_\_\_\_\_\" are to be followed at all times. The consequences of
inappropriate behavior may vary depending on the severity of the
violation. Violating the rules designed to protect GSA \"\_\_\_\_\_\_\"
can subject the violator to suspension of access privileges or result in
a formal reprimand. Note that violations involving certain types of
confidential information, such as that protected by the Privacy Act of
1974 and other federal statutes, may have additional legal consequences.

Exhibit 8. Rules of Behavior

[^1]: CERT® is a registered service mark of Carnegie Mellon University.
    For more information, see their Web site at http://www.cert.org.