# Presentation: 950017

## Protecting the 

**Child Support Enforcment Program**

**Notes:**
In the second module we will be talking about the three major components of security and the safeguarding methods, procedures, internal controls and restrictions in place to protect the data against unauthorized use or disclosure. 

## Learning Objectives

- Discuss measures to address:
- Physical Security
- Technical Security
- Administrative Security

## Three Major Areas of Security

**PHYSICAL**

**TECHNICAL**

**ADMINISTRATIVE**

**Notes:**
A security program can be broken down into three major areas:

Physical Security:  Involves access to your building/office, ID badges, office equipment and storage containers.

Technical Security:  Involves computers, software and access issues such as passwords and audit trails. 

Administrative:  Involves personnel as well as policies and procedures.

We will spend the remaining time on module two breaking the three areas out and talking about these in more detail.   

## What Physical Security Procedures

**What Physical Security Procedures**
**are in Place in Your Office?**

**Notes:**
Ask class for the physical security procedures in place at their offices.  Discuss the procedures.

Examples of physical security procedures:
- Display your ID Badge at all times
- Sign-in Visitors
- Access Controls: problems should be reported to the Administrative Officer 
  ASAP
- Security Gaurds
- Cameras

It is important to wear your ID badge while at work. This helps staff such as front desk and security personnel to identify employees.

It is also equally important to make sure all visitors entering the office sign in on the visitors log. The log is a required procedure and is reviewed by the security team and is subject to inspection by IRS auditors.  

Access problems with the glass doors to the office or restricted areas should be reported to Harold Staten for resolution.  You should also notify the security unit as well.  

## Physical Security - Precautions

- Security Drills
- Evacuation Techniques
- Bomb Threats

**Notes:**
Staff should be familiar with emergency exits and evacuation procedures in case of fire or other incidents.  ** Please instruct the class to turn to the appendices  section of the training manual and locate the Occupant Emergency Evacuation Plan for the Aerospace Center.  It is important to cover the last page of the evacuation information with participants highlighting the Means of Evacuation and the Relocation Site so that all staff are familiar with the procedures. **

## Physical Security – Sensitive Data

- Proper Handling of Sensitive Information
- Fax Machines
- Copy Machines
- Locked file cabinets
- Do NOT leave sensitive information out in the open

**Notes:**
Sensitive documents such as those containing IRS information should never be left unattended especially when using a fax or copier.

Documents containing sensitive information such as SSN’s, and IRS information should be locked up if you are away from your desk for meetings, breaks, or lunch.  Sensitive information should never be left out in plain view for other staff to see.  

The security team is required to periodically audit the restricted area and write a report on the findings as part of IRS requirements for the annual Safeguard Activity Report.  Documents containing sensitive information should be destroyed immediately if no longer being used for research or follow up.      

## Fax Requirements for IRS Data

- Staff member at both sending and receiving of fax
- Maintain broadcast lists
- Include a cover sheet that provides guidance to the recipient
- Notification of the sensitivity/need for protection
- Notice to unintended recipient to phone sender

- 2-5

**Notes:**
Generally, the telecommunications lines used to send fax transmissions are not secure.  Great care should be taken if you absolutely must fax FTI data.
To reduce the threat of intrusion, you should follow these IRS guidelines:

Have a trusted staff member at both the sending and receiving fax machines, or have a locked room for the fax machine with custodial coverage over outgoing and incoming transmissions.

Accurately maintain broadcast lists and other preset numbers of frequent recipients of FTI. Always place fax machines in a secured area.

Include a cover sheet on fax transmissions that explicitly provides guidance to the recipient, which includes:

A notification of the sensitivity of the data ad the need for protection and
a notice to the unintended recipients to telephone the sender- collect if necessary- to report the disclosure and confirm destruction of the FTI.      

## Physical Security- Restricted Areas

- Security/Restricted Areas
- Authorized personnel only
- Access logs
- These logs are subject to audit by IRS

**Notes:**
Only a limited number of staff with a legitimate need are allowed authorized access to the FPLS/Federal Offset  restricted area.

Any staff who are not on the authorized access list and who have a legitimate business need to enter the restricted area must fill out the the required information on the restricted register and be escorted by an authorized staff member at all times.  The restricted area register is reviewed daily by the security unit and is subject to review by IRS staff as well.

The first person to enter the restricted area each morning and the last person to leave at the close of business each day should do a walk through of the area.  Any unusual packages, unlocked doors, or missing equipment should be reported to the security office immediately.

## Technical Security – Warning Banners

- Warning Banner
- Read and understand; you are liable for civil and criminal penalties

**Notes:**
Access to the computer resources housed within the expanded FPLS is controlled by the SSA Top Secret Control System.  This program automatically denies and logs any unauthorized access attempts to computer resources.

The Top Secret Security Administrator for OCSE is Jim Fox.  All forms for access and passwords need to be routed to Jim.  Instructions for completing the forms are in the process of being updated and will be sent to you shortly.

A warning banner will appear on the ACF network when you log in to access sensitive areas  of data.  The banner indicates to the user that any unauthorized use of data can lead to criminal penalties, civil sanctions or dismissal from employment.  A copy of the banner is included in the appendices section of the training manual. 

## Technical Security-Passwords

- Passwords
- Audit trails
- Log-off computer when away from desk for an extended period of time
- Password protected screensavers

**Notes:**
You should never share your password or user ID with anyone....All System access and user activity is tracked by your password and user ID.  Each person is accountable for their actions. 

SSA and the Top Secret Security Administrator receive daily, weekly and monthly user activity reports that identify all user activity.  

It is important to protect your access by logging off the computer when you leave your work area, especially during lunch, breaks or meetings. 

Password Protected Screensavers provide great security benefits and are highly recommended for staff who have access to sensitive systems and data. 

## Technical Security – Safe Computing

- E-mail attachments
- Do not open attachments that you are not expecting

**Notes:**
The old rule regarding e-mail attachments was: NEVER OPEN E-MAIL ATTACHMENTS FROM SOMEONE YOU DON’T KNOW...
The new rule is: NEVER OPEN ATTACHMENTS UNLESS YOU KNOW WHY YOU RECEIVED THEM..  New viruses can copy address books of friends, coworkers, etc. and generate a message to you containing an infected file.
It is also important to avoid downloadable newsgroup files since hackers sometimes anonymously place infected files in newsgroups.

Transmission of sensitive data should only be accomplished from remote locations utilizing the ACF Banyan Intranet connection.

Now we would like to go over some safe computing tips for your PC at home.

## Technical Security – Home Computing

- DSL Lines
- Firewalls
- Virus Protection Software

**Notes:**
Digital Subscriber Lines (DSL) can offer some real advantages to high speed internet access but they can also offer some real disadvantages from a security perspective.

With a DSL line your PC is in a constant connection to the world wide web  unless you physically unplug your line from the wall or shut down your PC when not in use.  What this means is even if you are not connected to WWW but your PC is powered on you still have a constant connection to the web, allowing your system to be hacked into.  In order to protect yourself from hackers, you can purchase a firewall which will configure your PCs settings to protect the data housed on your PC to include passwords, checking accounts, etc. from hackers.

A good firewall should protect your system from attack, track all potential and actual threats, immediately alert you to serious attacks, and ensure nothing unauthorized enters or leaves your PC.    A firewall can be purchased for as little as $30.

Anti-virus software manufacturers are quick to upload the latest virus cures, but unless you periodically check for updates, they won’t be able to help you against new viruses. You should check for updates at least once per week as new viruses come out daily.    

## Administrative Security -  Sensitive Data

- Logging of Sensitive Information
- Record all incoming and outgoing tapes and hard copy
- All sensitive information must be accounted for
- All sensitive information must be tracked
- Manual log with transition to automated database

**Notes:**
IRS regulations require that OCSE record all incoming and outgoing tapes and hard copies of sensitive data.  By keeping a log, we are able to determine the location of the data and track it down if it is lost.

The logs are subject to IRS review during audits at OCSE. 

State Child Support Offices  are also expected to follow the same practices and procedures as OCSE to ensure compliance with this requirement.  

## Administrative Security  - Retention Requirements

- Federal Tax Information (FTI)
- Governed by IRC 6103
- National Directory of New Hires (NDNH)
- Governed by Section 453

**Notes:**
As per the Internal Revenue Code 6103, the IRS does not impose retention limitations on data but does specify  destruction requirements upon the completion of its use. 

## Administrative Security- Transporting Sensitive Data

- Authorized personnel only
- Label all tapes or hard copy containing IRS data as **“Federal Tax Data”**

**Notes:**
Any time sensitive information is transported from one location to another, care must be taken to provide safeguards.

For example, when not in use, the information must be out of plain view, preferably in a locked briefcase or suitcase.

All FTI transported thru the mail or courier/messenger service must be double sealed using two envelopes.  The inner envelope should be marked confidential with some indication that only the designated official is authorized to open it.    

## Administrative Security - Disposal

- Burning
- All sensitive data should be destroyed using an incinerator to ensure all pages are consumed
- Shredding
- Documents must be shred perpendicular to the cutting line and be in 5/16 inch wide strips or smaller

**Notes:**
Sensitive information furnished to users and any material generated therefrom, such as extra copies, photo impressions, computer printouts, carbon paper, notes, work papers, etc. must be destroyed to ensure the information is “undisclosable”  

## Administrative Security – Incident Handling/Reporting

- Policies for:
- Viruses, malicious software, hoaxes, vandalism, automated attacks and intrusions
- Defines roles and responsibilities for:
- Managers, Supervisors, Users

**Notes:**
DHHS recently established an Information Resource Management (IRM) policy for an Incident Response Capability due to increased threats to critical cyber-based infrastructure systems.

Incidents such as the ones mentioned in this slide, require a skilled and rapid response before they cause significant damage to computer resources, loss or destruction of data, loss of productivity or damage to the agency’s reputation.    

The policy is important for all staff working on the FPLS team because it defines what types of incidents should be reported, to whom the incidents should be reported, and what are the responsibilities of managers, supervisors and users when an incident occurs.

** The instructor should ask participants to find the copy of the Incident Handling and Reporting Policy provided in the appendices section of the training manual and briefly walk through this with the class so they are familiar with the document in case they need to use it.  **

## Administrative Security- Employee Departures

- Employee Departure Checklist
- Notifies Security Unit upon an employee’s departure
- Must be submitted to the Security Unit within designated timeframe
- Ensure system access, and building access are terminated promptly

**Notes:**
The employee departure checklist was developed to enhance internal controls and to provide better communication among those responsible for terminating access to computer systems, programs, buildings, offices, etc. 

The departure checklist  must be completed and sent to the security unit within 24 hours to ensure proper notification and appropriate action can be taken by the various individuals involved in the process.  Failure to do so could place the program or personnel at risk.   

The departure checklist should be completed by a manager, supervisor, task lead or appointed designee.

A copy of the checklist is in the appendices.  This checklist should be implemented immediately.

## Administrative Security- Workplace Violence

- Workplace Violence
- Policies and procedures

**Notes:**
During the beginning of the training we spoke briefly about workplace violence being on the rise and that incidents can happen anywhere at any time.

DHHS is aware of the concerns with Violence in the Workplace and has established a hotline as well as a web site for employees to use.

A copy of this information is also being provided in the appendices section of the training manual.

A copy of the website home page is in the appendices.

Transition to Module 3:

Now that we have talked about why and how to safeguard the data in Modules 1 and 2, in Module 3 we’ll talk about the disclosure limits from the statues...

## Summary

**PHYSICAL**

**TECHNICAL**

**ADMINISTRATIVE**

**Notes:**
A security program can be broken down into three major areas:

Physical Security:  Involves access to your building/office, ID badges, office equipment and storage containers.

Technical Security:  Involves computers, software and access issues such as passwords and audit trails. 

Administrative:  Involves personnel as well as policies and procedures.

We will spend the remaining time on module two breaking the three areas out and talking about these in more detail.