# Presentation: 630922

## September 17-19, 2002
Las Vegas, Nevada

         CCE Security Team
           Presenters:  Stuart Keil and Sue Krieg

- Las Vegas, Nevada
-          CCE Security Team
-            Presenters:  Stuart Keil and Sue Krieg

- CCESecurity

## CCE SECURITY

- Who we are.
- Where we have been.
- Where we are now.
- Where we plan to be.

## Who We Are    

- Team established at the beginning of FY01.
- First Meeting in Beltsville, MD - Nov. 2000.
- Members:
- Sue Krieg, NRCS		Marilyn Wolfe, RD
- Nancy Myler, FSA		Stu Keil, NRCS
- Mary Wilson, RD, IOL	Don Michelli, IOL
- Barry Wasser, Dept 	Kevin Reynolds, NRCS

**CCE SECURITY**
**September 2002**

## Who We Are    

- Former Team Members:
- Tom Hartzler, RD		Patricia Gray, FSA
- Gail Phillips, FSA
- Weekly Teleconferences.
- Special Teleconferences as needed.
- Sue participates in weekly CCE Team Leader Teleconferences.

**CCE SECURITY**
**September 2002**

## Who We Are    

- Charged with securing the CCE server.
- No server is an island.
- Therefore, involved with
- Network Security.
- Workstation Security.
- Major Application Security (Exchange, SMS, etc).

**CCE SECURITY**
**September 2002**

## Where We Have Been

- Started with National Security Agency Recommendations for NT.
- Soon after we began, NSA issued security  recommendations for Windows 2000 Server.
- Incorporated these guidelines along with Microsoft Guidelines into CCE Server Security Policy.

**CCE SECURITY**
**September 2002**

## Where We Have Been

- Physical Security  - Trip to California in February 2001.
- Developed CCE Security General Support System Plan for the Department for 2001 and 2002 Submissions.
- 2001 – directly to Department.
- 2002 – through the ITWG Security Team.
- 2002 – OMB  Government Information System Risk Assessment (GISRA) – Special request.
- Used Departmental Guides for Security Assessment.

**CCE SECURITY**
**September 2002**

## Where We Have Been

-  Local Policy Member Server.
- Settings
- Test Plan
- Test Results
- Initial Group Policy  for Domains & Domain Controllers.
- Settings
- Test Plan
- Test Results

**CCE SECURITY**
**September 2002**

## Where We Have Been

**CCE SECURITY**
**September 2002**

## Where We Have Been

- Cooperation with other CCE teams on document review.
- Participated in the All-Team Meetings.
- Beltsville – November 2000
- Reno – July 2001
- Beltsville – December 2001
- Beltsville – May 2002

**CCE SECURITY**
**September 2002**

## Where We Are Now

- Have two positions we need to fill on the team.
- Weekly reviews of other team’s documents.
- Have one team member working closely with Xp team. Attended Xp training.
- Two members working in the Interoperability Laboratory (IOL).

**CCE SECURITY**
**September 2002**

## Where We Are Now

- CCE Policy Development.
-  	Hardware Security Policy
- Result of site reviews
- Deployment Team experience
- In the process of completing three major CCE policy documents.

**CCE SECURITY**
**September 2002**

## Where We Are Now

**CCE SECURITY**
**September 2002**

## Where We Are Now

- These documents will be reviewed by the ITWG Security Team.
- Completed policy will be issued in the same manner as ITWG policy.

**CCE SECURITY**
**September 2002**

## Where We Are Now

- Security Best Practice Guides for major software applications.
- Microsoft Exchange
- SMS
- CIM
- MOM
- SQL
- Powershoot
- Xp

**CCE SECURITY**
**September 2002**

## Where We Plan To Be

- Complete Security Items on CCE Master Project Plan.
- Final Group Policy for Domains and Domain Controllers.
- Settings, Test Plans, Test Results
- Group Policy User Rights.

**CCE SECURITY**
**September 2002**

## Where We Plan To Be

- Access Control Lists (ACLs).
- (Using Microsoft Consulting Services)
- File Systems ACLs
- Registry ACLs
- System Services ACLs
- Network Shares ACLs
- Active Directory ACLs

**CCE SECURITY**
**September 2002**

## Where We Plan To Be

- Developing a paper on operational security.
- Will apply whether we maintain status quo or form converged IT agency.
- Log Use/Retention.
- Auditing.
- Testing of new applications.

**CCE SECURITY**
**September 2002**

## Where We Plan To Be

- Need to fill several positions on team.
- Interest in technical security.

**CCE SECURITY**
**September 2002**