System Level Security System security should be addressed on the users' desktops and printers, as well as any and all servers utilized by the application. Target servers and operating systems must be selected from the approved list included in the document entitled Approved Server Systems . Once selected, servers should be configured and run according to ITSS standards. Because of the nature of server break-ins, all servers should be considered of moderate or high risk, depending on the nature of the data. For applications or data considered to be very high risk, a firewall may be an appropriate measure on the server side.
Physical security is an issue for both servers and end-user client computers.
Generally speaking, servers should be located in a locked, environmentally controlled machine room such as Forsythe or Sweet Hall. Desktops located in locked offices should require authenticated login for access to applications or file servers at a minimum. Desktops should also have virus protection installed and a mechanism for user controlled screen lock. Each network interface and each communications path is potentially vulnerable. Data transmitted over a network is subject to capture and modification.