3. Describe the application or system’s system integrity requirements. The system ensures system and data integrity from a number of perspectives: Authentication – all users must provide valid credentials to enter the LegalFiles application All communication and data transmission is encrypted at the transport level using SSL (HTTPS) Each user is assigned specific roles or privileges in LegalFiles LegalFiles has built in data validation to ensure proper integrity of data from a format, and context perspective. For example, ensuring that dates are formatted properly and related information makes sense in context such as end dates always coming after associated start dates. 4. For electronic commerce systems involving financial transactions, describe how you are ensuring that the parties in a transaction cannot deny that the transaction took place. Not Applicable 5. Describe the application or system access controls and their rules for all levels of the system and/or application. LegalFiles application roles are defined within the system. Group roles are used. Security in LegalFiles is managed through system security configuration. Roles can be customized to allow or deny access at the module/screen level, as well as to allow or deny specific functionality within a module. 6. Describe the audit trails that will be captured and the details included in the audit trail for tracking administrative actions that impact access or change to critical data. Within LegalFiles there are logs that record field/data, user change and date of change which can be accessed by administrators only.
16. Describe procedures for requesting, establishing, issuing, and closing user accounts in the system or application. These procedures must include the process for reviewing and confirming access rights on a specified schedule. Computer access request forms are submitted via email to the OAC Security Administrator who grants or revokes user access and security template assignments. In addition, the LegalFiles Security Administrator will also review existing access rights periodically for security changes necessary due to staff turnover or role assignment changes. Monthly reports will be run and access will be denied for any user who has not logged into the system for 6 months. 17. Describe the procedures for identifying and reporting security violations. OAC system administrators are responsible for reviewing failed authentication reports. Additionally, system usage reports are reviewed for identifying unusual system activity. In the event that a security violation is detected, the Security Administrator is informed, who then initiates DPA security violation incident handling procedure through notification to the OIT Service Desk. Develop a plan to monitor authentication reports and unusual system activity and report to OAC and OIT in the event a security violation is detected. 18. Vulnerability/Penetration testing documents available? Vulnerability/penetration test results documents will only be available to state personnel as provisioned by the DPA Information Security Officer. 19. Interface Security (transmission security, access control) The LegalFiles interface uses 2048 bit SSL. All sessions require credential validation. 20. Vendor Access LegalFiles support staff may be granted application and data access to the extent required to carry out end user application support according to the annual maintenance contract. 21. User Access Login tracking and application activity logging is achieved through the application, and is stored in the back-end supporting database. Application configurations must be enhanced to enforce strong password settings including length, complexity, and expiration