# Presentation: 730220

## Information Security and Privacy Training for[the Agency] Information System Security Officers

- June 12 & 13, 2000

## Agenda

**1.  Introduction to Information Systems Security**
**2. ***[the Agency’s]*** AIS Security Program (AISSP)**
**3.  Sensitivity and Criticality**
**4.  Risk management**
**5.  Management Controls**
**6.  Workstation Security**
**7.  Malicious Software**
**8.  Security in the System Development Life Cycle**
**9.  Technical Controls**
**10. Operational Controls**
**11. Network Security**
**12. Information Sharing**
**Conclusion**

## Course Objectives

**Understand the importance of IS security**
**Understand the importance of protecting the privacy and confidentiality of [the Agency] data**
**Know/understand the security- and privacy-related Federal government-wide and organization-specific laws, regulations, policies, guidelines, and standards, and how  to apply them**
**Know/understand your role and responsibilities**
**Assist in the risk management program within your components**
**Be able to identify management, technical, personnel, operational, and physical security controls**
**Know the security requirements for protecting workstations and the information processed on them**

## Course Objectives, Cont’d

**Identify/implement  preventative measures for computer viruses, identify signs of an infection, identify a virus hoax, and implement virus recovery procedures**
**Understand general physical/environmental  security requirements**
**Know key security activities in SDLC**
**Understand contingency planning process and your role**
**General understanding of network security**
**Identify and implement policies and best practices for secure Internet, remote access, FAX, and email use**

## Topic 1 – Introduction to Information Systems SecurityLearning Objectives

**Be able to identify the current trends affecting IS security**
**Know the definition of IS security**
**Understand the importance of IS security to [the Agency]**

## Current Trends

**Computing has become more decentralized and networked**
**Increase in use of computers to share and distribute sensitive information and data**
**Vast amounts of personal data are collected, stored, and processed electronically**
**Increase in the reliance on computers for daily operations**
**Reports of computer fraud and abuse continue to rise**
**Increase in the complexity of technology**
**Increase in use of the Internet for e-business**

## Information Systems Security

**Information systems security is the protection of information systems against unauthorized access to or modification of information whether in storage, processing, or transit, and against denial of service to authorized users, including those measures necessary to detect, document, and counter such threats.**
**Source: National Security Telecommunications and Information Systems Security Committee (NSTISSC) NSTISSI No. 4009  National Information Systems Security (INFOSEC) Glossary, January 1999**

## Confidentiality

**Confidentiality**

**Availability**

**Integrity**

## Topic 2 – [the Agency’s]  AIS Security ProgramLearning Objectives

**Know the government regulations regarding the security and privacy of Federal information systems, and the requirements with which [the Agency] must comply**
**Know the key personnel responsible for implementing the agency-wide information system security and privacy program and their responsibilities**
**Know what your responsibilities are under the [the Agency] security and privacy program**

## Federal Laws, Regulations, and Policies

**The Computer Security Act of 1987 (PL 100-235)**
**The Privacy Act of 1974 (PL 93-579)**
**The Freedom of Information Act (PL 90-23)**
**The Computer Fraud and Abuse Act of 1986 (PL 99-474)**
**The Copyright Act of 1976 (PL 94-553)**
**OMB Circular A-130, Appendix III, Revised**
**Health Insurance Portability and Accountability Act of 1996 (PL 104-191)**
**Presidential Decision Directive 63 – Critical Infrastructure Protection **

## Computer Security Act of 1987(PL 100-235)

- Identify each computer system that contains or processes sensitive information
- Develop and maintain system security plans for sensitive systems
- Conduct mandatory periodic computer security awareness training

## Privacy Act of 1974(PL 93-579)

**Allows individuals to find out what information about them is being maintained and to request the correction of inaccurate information**
**Mandates identification of protection requirements prior to matching individuals in multiple Federal systems**
**Mandates physical security procedures and information management practices to protect personal information**
**Requires protection of all personal information about an individual**

## Freedom of Information Act(PL 90-23)

**Ensures public access to agency records and information**
**There are nine exemptions to this act:**
**National security information**
**Internal personnel rules and practices of an agency**
**Statute requirements**
**Trade secrets**
**Inter-agency or intra-agency memorandums**
**Personnel and medical files**
**Information compiled for law enforcement purposes**
**Commercial and financial information**
**Geological information data, i.e., maps.**** **

## Whoever knowingly and intentionally:
accesses a protected computer without authorization, to obtain protected information, commit fraud, cause damage, or obtain something of value;
transmits malicious code that causes damage to a protected computer;
obtains passwords or similar information through which a computer may be accessed without authorization; or
extorts any money, or other thing of value, transmits in interstate or foreign commerce any communication containing a threat to cause damage to a protected computer;
Shall be punished by fine and/or imprisonment.

**accesses a protected computer without authorization, to obtain protected information, commit fraud, cause damage, or obtain something of value;**
**transmits malicious code that causes damage to a protected computer;**
**obtains passwords or similar information through which a computer may be accessed without authorization; or**
**extorts any money, or other thing of value, transmits in interstate or foreign commerce any communication containing a threat to cause damage to a protected computer;**
**Shall be punished by fine and/or imprisonment.**

- Computer Fraud and Abuse Act(PL 99-474)

## Copyright Act of 1976PL 94-553

**The Copyright Act gives the owner of the copyright “the exclusive rights” to “reproduce the copyrighted work” and “to distribute copies of the copyrighted work.”  **
**It also states, that “anyone who violates any of the exclusive rights of the copyright owner...is an infringer of the copyright.”**

## Urban Legends

**24-hour rule**
**Abandonware**

## OMB Circular A-130, Appendix III, Revised“Security of Federal Automated Information Systems”

**Establishes minimum set of controls to be included in Federal Automated Information Systems**
**Assigns Federal agency responsibilities for security**

## OMB Circular A-130, Appendix III, Revised

**General Support Systems**
**An interconnected set of information resources under the same direct management control which shares a common functionality.**
**Major Applications**
**An application which uses information and information technology to satisfy a specific set of user requirements, where special management attention to security is required.**

## Major Application and General Support System Controls

**Assign responsibility**
**Develop a system security plan**
**Review security controls**
**Management authorization**

## HIPAA

**Ensure the integrity and confidentiality of medical information for both public and private health care industries**** **
**Protect against any reasonably anticipated threats or hazards to the security or integrity of the information and unauthorized use or disclosure of health information**
**Industry-wide and applies to all health care industry and medical information, public and private**

## HIPAA Requirements

**Agreed standard content format**
**Development and use of standard identifiers**
**All electronically maintained or transmitted health information must be secure**
**An electronic signature standard will be established**

## Presidential Decision Directive 63

**National center to warn of and respond to attacks**
**Capability to protect critical infrastructures**
**Cyber and physical infrastructure vulnerabilities**
**Federal government to serve as a model**
**Voluntary participation from industry**
**Protect privacy rights**

## CIO, and Director, Office of Information Services
Director, Security and Standards Group
Senior Security Advisor
Senior Information Systems Security Officer

**Director, Security and Standards Group**
**Senior Security Advisor**
**Senior Information Systems Security Officer**

*[the Agency’s]* IS Security Organization

## Security Program Elements

**Personnel security**
**Awareness & Training**
**Risk Management **
**Security in the SDLC**
**Security designations**
**SSP and Certification**
**Systems Access**
**Acquisitions/Contracts**
**Privacy & confidentiality**

**Remote Access **
**Audit systems**
**Contingency Planning**
**Network & computer workstation**
**System security Incident reporting**
**E-Mail/FAX**
**Malicious software**

## Roles/Responsibilities

**[the Agency] Administrator**
**Director, OIS**
**Sr. Systems Security Advisor**
**Senior ISSO**
**[the Agency] Office/Center Directors/ Regional Administrators **
**Group Directors/Division Directors**
**Beneficiary Confidentiality Board**

**RACF Administrators**
**RACF Group Administrators**
**System Owners**
**System Developers**
**Physical Security Officer**
**Supervisors**
**Users**
**Component ISSOs**

## [the Agency’s] Beneficiary Confidentiality Board

- Use of beneficiary information
- Disclosing beneficiary information
- Release least amount of information
- Collecting least amount of information

## ISSO Responsibilities

**Primary point of contact for security**
**Disseminate security awareness information**
**Assist with security plans, risk assessments, and contingency plans**
**Develop security guidelines and procedures**
**Ensure compliance with copyright laws/site licenses**
**Ensure malicious software safeguards are implemented**
**Ensure all suspected system security intrusion incidents are reported**
**Assist in the System Development Life Cycle process**
**Ensure compliance with Program requirements**
**Ensure adherence to national security policies**

## Topic 3 - Sensitivity and Criticality Learning Objectives

**Know what sensitive information and operational criticality are**
**Understand that there are different levels of sensitivity and operational criticality**
**Be able to identify the minimum security requirements for each level**

## Sensitive Information

- “I**nformation, the loss, misuse, or unauthorized access to or modification of, which could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled to by law.”**
*NSTISSI No. 4009*

## Sensitivity Levels

**Level 1: Low**
**Level 2: Moderate**
**Level 3: High**

## Critical Information Resources

**Information resources essential to the minimum operations of the agency.**

## Criticality Levels

**Level 1: Low**
**Level 2: Moderate**
**Level 3: High**

## Security Level Requirements Level 1

**AIS security awareness and training**
**Sensitivity designations **
**Physical access controls**
**Complete set of AIS documentation for each system**

## Security Level RequirementsLevel 2

**All requirements for Level 1**
**Detailed risk management plan**
**System security plan**
**Record retention procedures**
**List of authorized users**
**Security review and certification procedures**
**Background investigations for employees and contractors**

**Fire emergency plan**
**Formal, written contingency plan**
**Risk assessment**
**Automated audit trail**
**Authorized access and control procedures**
**Secure physical transportation procedures**
**Secure telecommunications**
**Emergency power program**

## All requirements for Levels 1 and 2
Inventory of hardware and software

**Inventory of hardware and software**

- Security Level RequirementsLevel 3

## Topic 4 – Risk ManagementLearning Objectives

**Understand the concepts of risk and risk management**
**Be able to assist in the risk management programs within your component, by identifying threats and vulnerabilities, and identifying appropriate safeguards in order to mitigate risk**

## Risk

**Potential for harm or loss**

## Risk Management

**Process of assessing risk, taking steps to reduce risk to an acceptable level, and maintaining that level of risk**

## ISSO Responsibilities

**Assist in risk management program**
**Maintain copies of all completed risk assessment reports**
**Provide Sr. ISSO with copies of all completed risk management reports**

## Risk Assessment

**Risk assessment is the process of identifying threats to and vulnerabilities of an information system and the potential impact the loss of information or capabilities of a system would have on the agency’s mission**

## Assist in the identification of threats and vulnerabilities
Assist in the identification of safeguards
Provide information to risk team, as necessary

**Assist in the identification of safeguards**
**Provide information to risk team, as necessary**

- ISSO Responsibilities

## A vulnerability is a weakness in an information system, system security procedures, internal controls, or implementation that could be exploited. 

A threat is any circumstance or event with the potential to harm an information system through unauthorized access, destruction, disclosure, modification of data, and/or denial of service.

- A _**threat**__ _is any circumstance or event with the potential to harm an information system through unauthorized access, destruction, disclosure, modification of data, and/or denial of service.

- Threats and Vulnerabilities

## Threats

**Natural or Human**
**Deliberate or Accidental**

## Safeguards

**Safeguards are actions, devices, procedures, techniques, or other measures that reduce the vulnerability of a information system or the threats to that information system.**

## Topic 5 - Management Controls Learning Objectives

**Be able to distinguish between policies, standards, procedures, and guidelines**
**Understand the personnel security concepts of separation of duties and least privilege**
**Be able to identify the security activities that need to be performed when an employee leaves [the Agency]**
**Understand your responsibilities for security awareness and training**

## Policies

Standards

Procedures

Guidelines

**Standards**
**Procedures**
**Guidelines**

## Personnel Security

**Separation of duties**
**Least privilege**
**Employee exit procedures**

## Separation of Duties

**Dividing roles and responsibilities so that a single individual cannot subvert a critical process**

## Least Privilege

**The security objective of granting users only those accesses they need to perform their official duties**

## Exit Procedures for Termination

**Surrender of keys and badges**
**Return of agency materials and equipment**
**Removal of system access and authorities**
**Change passwords, locks, access, and authority codes**

## Unfriendly TerminationSecurity Considerations

**Immediate removal of system access**
**Limit user’s access and activities**
**Log on-line activities**
**Physical removal from the building**

## Security Awareness

**The purpose of awareness presentations is simply to focus attention on security.  **
**They are intended to ensure individuals can recognize IT security and privacy concerns and respond accordingly.**

## Training

**Training focuses on providing the knowledge, skills, and abilities specific to an individual’s role and responsibilities relative to IT systems.**

## 
Education focuses on developing the ability and vision to perform complex multi-disciplinary activities and the skills needed to further the IT security profession.

**Education focuses on developing the ability and vision to perform complex multi-disciplinary activities and the skills needed to further the IT security profession.**

- Education

## Topic 6 – Workstation SecurityLearning Objectives

**Know the general security requirements for protecting workstations and the information processed on them**
**Be able to identify the additional security requirements for workstations that process sensitive information and critical applications**
**Know your responsibilities in this area**

## Questions Concerning Your Workstation

**Is valuable information stored on your workstation?**
**Are you sure that it will be there in the morning and that it won’t be changed?**
**Are you sure that it will not appear in the next edition of the Washington Post or Baltimore Sun?**
**What will you do if your hard disk crashes right now or the office is gutted by fire overnight?**

## ISSO Responsibilities

**Ensure policies are implemented**
**Ensure all users are following these policies**
**Develop local guidelines as necessary**

## General Workstation Security Requirements

**Protect from theft**
**Do not remove from [the Agency] premises**
**Do not bring in personally-owned equipment**
**Use only authorized software and comply with copyright laws**
**Secure all software when not is use**
**Use your installed anti-virus software regularly**
**Observe same practices when working at home**

## Physical Safeguards

**Position computer screen to preclude unauthorized viewing**
**Use anchor pads and lockable cables, where necessary and in public areas**
**Use CPU keylocks to prevent access during non-business hours**

## Storage Safeguards

**Use removable media**
**Properly store and label removable media**
**Ensure access to media is on a need-to-know basis**
**Do not store both sensitive and non-sensitive data on the same media**
**Encrypt sensitive data stored on hard disks**
**Properly remove data from media**
**Do not leave workstations unattended when processing sensitive data or a critical application is resident in memory**

## Requirements for Critical Applications

**Audit Trails**
**Contingency Plans**

## Questions Concerning Your Workstation

**Is valuable information stored on your workstation?**
**Are you sure that it will be there in the morning and that it won’t be changed?**
**Are you sure that it will not appear in the next edition of the Washington Post or Baltimore Sun?**
**What will you do if your hard disk crashes right now or the office is gutted by fire overnight?**

## Topic 7 – Malicious SoftwareLearning Objectives

**Know what malicious software is**
**Identify and implement preventive measures**
**Detect a virus infection**
**Identify a possible virus hoax**
**Identify and implement virus recovery techniques**

## Computer Virus

**A computer virus is unauthorized software that replicates itself and a set of instructions, sometimes called a payload.  **
**The payload causes unauthorized actions such as displaying odd messages or corrupting or destroying data or programs.**

## Malicious Code Types

**File virus**
**Boot sector virus**
**Time or logic bomb**
**Macro virus**
**Trojan Horse**
**Worms**

## Computer Virus Detection

**Slower response time**
**Blinking drive lights (when they are empty)**
**Unusual program messages**
**Abnormal workstation behavior**
**Warning message from anti-virus software**
**Unexplained system crashes**
**Files missing or corrupted**
**Unexpected sound effects**
**Unknown new files or directories**
**Sudden decrease in free space**

## If Your Suspect You Have A Computer Virus:

**1. Stop!!!**
**2. Take Notes**
**3. Call the [the Agency] Action Desk**
***410-786-2580***

## Computer Virus Hoax Characteristics

**It is a warning message about a virus**
**It is usually from an individual, occasionally from a company, but rarely from the cited source**
**It warns you not to read or download the supposed virus**
**It describes the virus as having horrific destructive powers**
**It has lots of words in all CAPs and loads of exclamation points**

## It is a hoax, if

**It urges you to alert everyone you know, and usually tells you more than once**
**It seeks credibility by citing some authoritative source as the issuer of the warning**
**It seeks creditability by describing the virus in misleading technical jargon**
**Joseph Wells, How to Spot a Virus Hoax, antivirus online (January 1997)**

## Computer Virus Recovery Planning

**Maintain virus-free backup copies of all software installed on your computer**
**Make regular and systematic back-ups of all important data stored on your computer**
**Keep hard copies of critical data**

**Back-up!   Back-up!  Back-up!**

## ISSO Responsibilities

**Prepare suspected system security incident report**
**Coordinate suspected security incident reports within component or region**
**Identify trends or spreading viruses**

## Topic 8 – Security in the SDLCLearning Objectives

**Identify the security activities that are or should be included at each phase of the systems development life cycle**
**Understand the System Security Plan Certification/Accreditation Program**
**Know your responsibilities in these processes**

## ISSO Responsibilities

**Assisting Application System Managers in:**
**Selecting and implementing appropriate administrative, physical, and technical safeguards**
**Determining the sensitivity level of the application system**
**Defining and approving security specifications**
**Conducting design reviews of security features**
**Testing security features**

## Life Cycle Phases

**Predevelopment**
**Definition of the need to acquire a system, software product, or software service**
**2. Development**
**Activities and tasks of the developer**
**3. Post Development**
**System is accepted and operations and maintenance processes begin**

## Phase 1: Predevelopment Key Security Activities

- Sensitivity assessment
- Initial risk assessment
- Define security requirements

## Phase 2: Development

**Requirements**
**Design**
**Programming, Coding, and Testing**
**Software Acceptance Support**

## Requirements Security Activities

- Initiation of system security plan
- Identify responsibilities
- Define detailed functional and security requirements
- Identify job functions and interfaces
- Identify sensitive data objects and operations
- Identify requirements for the operating environment
- Identify administrative controls
- Validate security requirements

## DesignSecurity Activities

**Design security controls**
**Perform design review**
**Develop test plan**
**Test security features**

## Programming, Coding, and Testing Security Activities

**Develop security-related code/databases**
**Include information on security features in documentation**
**Perform peer review**
**Perform unit and integration testing**

## Software Acceptance Support Security Activities

**Include security features in user manual**
**Include security awareness in training**
**Develop security test data**
**Evaluate access and security controls**
**Test backup, contingency and disaster recovery plans**
**Conduct certification and accreditation**

## Phase 3: Post Development Installation and Operations Security Activities

**Provide complete documentation**
**Conduct post-implementation review and recertification/reaccreditation**
**Conduct periodic risk assessments**
**Conduct periodic security training **
**Enforce strict change-control procedures**
**Regularly test contingency plans**
**Maintain security documentation**
**Monitor application/system security **
**Review audit reports/logs**

## Disposal Security Activities

- Move, archive, discard, or destroy information
- Sanitize storage media
- Determine disposition of hardware and software

## System Security Plan Certification/Accreditation Program

**Sensitivity Level Designations**
**System Security Plans**
**Reviews and Tests**
**Certification/Accreditation and             Recertifications/Reaccreditations**

## ISSO Responsibilities

**Provide technical security support**
**Ensure systems have adequate security documentation**
**Identifying and nominating systems for inclusion in the [the Agency] SSP Certification/Accreditation Program**

## System Security Plan

**Provides an overview of the security requirements of the system**
**Describes the controls in place for meeting those requirements **
**Delineates responsibilities and expected behavior of all individuals who access the system**

## Reviews and Tests

- Internal Procedural and Technical Reviews or IV&V’s
- Systems Security Life Cycle Process

## Certification and Recertification

**Prior to implementation**
**At least every 3 years for major applications, or annually for general support systems**
**When there are significant changes to the system**

## Accreditation

- Accreditation is the formal process by which the [the Agency] CIO verifies that a system has achieved a satisfactory level of operational security and signs a formal accreditation statement authorizing the system to process.

## Topic 9 – Technical ControlsLearning Objectives

**Know what identification and authentication controls are**
**Know good password management practices**
**Understand what access controls are**
**Know what audit trails are and their appropriate use at [the Agency]**

## Identification

**Must be unique**
**Must correlate actions to users**
**Must be maintained**

## Authentication

**Something known by the individual**
**Something possessed by the individual**
**Something about the individual**

## A Strong Password

**Has non-alphabetic characters**
**Is at least 6 characters long**
**Is changed every 60 days**
**Is not a dictionary word**
**Is NEVER shared**

## Password Management

**Allowable character set**
**Minimum/maximum length**
**Password aging**
**Number of generations of expired passwords**
**Procedures for password changes, handling lost passwords, and password compromise**

## Access Controls

**The means whereby it is determined ****who**** will have ****what**** access to ****which**** objects and resources**

## ISSO Responsibilities

- Use audit trails in accordance with [the Agency] policies
- Request audit trail access for members of your staff who need to use this data
- Recommending changes to audit trails based on your knowledge of system vulnerabilities, instances of system abuse, and audit records within your area of responsibility

## Audit Trails

**Individual accountability**
**Reconstruction of events**
**Intrusion detection**
**Problem identification**

## Audit Trails

**Type of event**
**When the event occurred**
**User-Id associated with the event**
**Program or command used to initiate the event**
**Where the event occurred**

## Proper Uses

**Obtain information on a suspect claim, applicant, or action**
**To support a regional office integrity review function**
**Track a profile for suspicious types of actions**

## Other Things to Consider

**Ensure audit trails are protected**
**Ensure audit trails are reviewed**
**Ensure separation of duties between security personnel who administer the access control function and those who administer the audit trail**

## Topic 10 – Operational ControlsLearning Objectives

**Be able to identify physical and environmental controls**
**Know ***[the Agency’s]*** security incident handling and reporting procedures**
**Understand the contingency planning process and your involvement**

## Physical Security

**Those measures or tangible defenses that you can take to protect your facility, equipment, and information from theft, tampering, careless misuse, and natural disasters.**

## Audit and Variance Detection

**Reviewing and monitoring to ensure that system controls are adequate, and to detect anomalies.**

## Categories of Security Incidents

**Physical crimes**
**Illegal access/disclosure**
**Misuse of Government property**
**Systems security incident**
**Security violation**

## Incident Handling and Notification

**Determine if an incident has occurred**
**Contain the incident and avoid any further incidents or damage**
**Call the Action Desk to notify the Sr. ISSO**
**Maintain and restore data and service**
**Determine what happened and how**
**Identify the perpetrators and take appropriate action**

## ISSO Responsibilities

**Identify the incident**
**Receive or complete a Systems Security Incident Report**
**Report the incident to the Sr. ISSO**
**Ensure incident is investigated**
**Assist in the investigation as necessary**

## Contingency planning
The process for assuring, in advance, that any reasonable and foreseeable disruptions will have a minimal effect

Contingency Plans
Current documented guidance for actions to be taken after a disruption occurs

**The process for assuring, in advance, that any reasonable and foreseeable disruptions will have a minimal effect**
**Contingency Plans**
**Current documented guidance for actions to be taken after a disruption occurs**

## Back-Ups

**Criticality and sensitivity**
**Frequency of updates**
**Frequency of access**
**Degree of reliance of other functions**
**Time-sensitivity**
**Difficulty in re-creating the information**

## Good Back-Up Practices

**Ensure that back-up media are labeled properly**
**Ensure that back-up procedures are documented and followed**
**Keep back-ups off-site and on-site in a locked, fireproof, waterproof container**
**Ensure that back-ups are periodically verified**

## ISSO Responsibilities

**Assist in contingency planning process, as necessary**

## Typical Parts

**Preliminary planning**
**Preparatory actions**
**Action plan**
**Test and revise the plan**

## Topic 11 – Network SecurityLearning Objectives

**Be familiar with some common network terminology**
**Have a basic understanding of secure communications and remote access security**
**Know good e-mail and fax security practices**
**Understand securing ***[the Agency’s]*** network from the Internet**

## Common Terminology

- Network
- LAN, MAN, WAN
- Internet
- Extranet
- Intranet
- VPN

## Slide 113

## Slide 114

## Slide 115

## Slide 116

## Threats

**People**
**Eavesdropping**
**Spoofing**
**Vandalism or mischief**
**Hijacked connections**
**Theft of computing or communication services**
**Denial of service**

## Firewalls

**Prevent access to internal network from external sources**
**Control connections between internal and external hosts**
**Hide information about the internal network**
**Defend against attacks**
**Provide for centralized network security administration**
**Provide for centralized network logging and incident detection**

## Modem Use

**Dramatically increases the risk to ***[the Agency’s]*** systems**
**Circumvents security controls**
**Must be authorized**
**Network is audited / monitored for modem use**

## Remote Access Policies

**Protect [the Agency] information from unauthorized access**
**Clear workstation of sensitive information prior to use for non-[the Agency] purposes**
**Use anti-virus software**
**Disable all connections to non-[the Agency] networks when connected to the [the Agency] network**

## ISSO Responsibilities

**Ensure [the Agency] e-mail and FAX policies are implemented**
**Develop local guidelines, as necessary**

## E-Mail and Fax Policy

**For official and authorized use only**
**Messages are Government property**
**Information is subject to statutes, regulations, and policies**
**Protect copyright information**
**Privileged users are expressly prohibited from reading the electronic messages of others **
**Abuse and/or misuse can lead to disciplinary action**

## E-Mail and FaxSecurity Practices

**Immediately forward misdirected messages**
**Exit e-mail software when not in use. If e-mail is left open, have screensaver password active**
**Do not leave Fax machines unattended during transmission**
**Ensure that documents are transmitted to intended person(s)**
**Protect your e-mail password**
**Never send sensitive information via e-mail unless it is protected**
**Do not send executable files via e-mail**

## Encryption

**Transforms intelligible data, called plaintext, into an unintelligible form, called ciphertext.**
**This process is reversed through the process of decryption.**

## Types of Encryption Systems

**Private or Secret Key**
**Public Key**

## Encryption Features

**Data confidentiality**
**Data integrity**
**Authentication of message originator**
**Authentication of system user**
**Electronic certification and digital signature**
**Nonrepudiation**

## Topic 12 – Information SharingLearning Objectives

**Understand the security and privacy requirements when inter/intra-agency agreement is used**
**Understand the requirements for data use agreements**

## Inter/intra-agency Agreements

Data Use Agreements

**Data Use Agreements**

## Course Objectives

**Understand the importance of IS security**
**Understand the importance of protecting the privacy and confidentiality of [the Agency] data**
**Know/understand the security- and privacy-related Federal government-wide and organization-specific laws, regulations, policies, guidelines, and standards, and how  to apply them**
**Know/understand your role and responsibilities**
**Assist in the risk management program within your components**
**Be able to identify management, technical, personnel, operational, and physical security controls**
**Know the security requirements for protecting workstations and the information processed on them**

## Course Objectives, Cont’d

**Identify/implement  preventative measures for computer viruses, identify signs of an infection, identify a virus hoax, and implement virus recovery procedures**
**Understand general physical/environmental  security requirements**
**Know key security activities in SDLC**
**Understand contingency planning process and your role**
**General understanding of network security**
**Identify and implement policies and best practices for secure Internet, remote access, FAX, and email use**

## Thank You