TCCC-RYSS Server Configuration Security Policy
Revised: 06/30/2009
TCCC-RYSS Server Configuration Security Policy
Revised: 06/30/2009
1. Purpose.
The purpose of this policy is to establish standards for the base configuration of server equipment that is owned or operated by the School. Effective implementation of this policy will minimize Unauthorized Use of the School Information Technology Network or other access to the School’s Proprietary Information and technology.
2. Scope.
This policy applies to server equipment owned or operated by the School, and to servers registered under any School-owned internal Network domain. This policy applies specifically to equipment connected to the internal School Information Technology Network. For secure configuration of equipment external to the School on the “De-Militarized Zone” (DMZ), refer to the School’s ”De-Militarized Zone” Equipment Policy documentation.
3. Policy.
Ownership and Responsibilities
All internal servers deployed at the School must be the responsibility of an Operational Group that is responsible for system administration. Approved server configuration standards must be established and maintained by each Operational Group, based on business needs. Operational Groups must monitor configuration compliance and request special approval for any noted exceptions. Each Operational Group must establish a process for changing the configuration standards, which includes review and approval by Information Security personnel.
1. Servers must be registered within the School Security Management System. At a minimum, the following information is required to positively identify the point of contact:
a. Server contact(s) and location, as well as a backup contact
b. Hardware and Operating System (OS) version numbers
c. Main functions and applications, if applicable
2. Information in the School Security Management System must be kept current.
3. Configuration changes made by Authorized Users for production servers must comply with the Change Management Policy documentation.
General Configuration Standards
1. OS configuration must be in accordance with approved Information Security Standards.
2. Services and applications that are unused must be disabled where practical. Exceptions must be noted and approved by Information Security personnel.
3. Access to Services must be logged or protected through appropriate Access Control methods (e.g. TCP wrappers), if possible.
4. The most recent Security Patches must be installed on the system as soon as practical, the only exception being when immediate application would interfere with business requirements.
5. Trust Relationships between systems are a Security risk, and their use should be avoided. Do not use a Trust Relationship when some other method of communication will do.
6. Authorized Users must always use the standard Security principle of Least Required Access to perform a function.
7. If a methodology for Secure Channel connection is available (i.e. technically feasible), privileged access must be performed over Secure Channels (e.g. encrypted Network connections using IPSec or Secure Shell).
8. All servers must be physically located in an access-controlled environment.
9. Authorized Users are specifically prohibited from operating servers in uncontrolled office areas.
Monitoring
1. All Security-related events on critical or sensitive systems must be logged by Information Security personnel and audit trails saved as follows:
a. All Security-related Logs must be kept online as required in the specific server standards document.
b. Daily incremental tape Backups must be retained as required in the specific server standards document.
c. Weekly full tape Backups of Logs must be retained as required in the specific server standards document.
d. Monthly full Backups must be retained as required in the specific server standards document.
2. Security-related events must be reported by Authorized Users to Information Security personnel, who review Logs and report incidents to management-level personnel in the Information Technology Services department. Corrective measures are prescribed as needed.
Security-related events include, but are not limited to:
a. Port scan attacks
b. Evidence of unauthorized access to privileged accounts or data
c. Anomalous occurrences that are not related to specific applications on the Host
Compliance
1. Audits must be performed on a regular basis by authorized parties within the School.
2. Audits must be managed by the internal audit group or Information Security personnel, in accordance with the Audit Policy documentation. Findings not related to a specific Operational Group are filtered by Information Security personnel, and then presented to the appropriate Information Technology Services staff for remediation or justification.
3. Every effort will be made to prevent audits from causing operational failures or disruptions.
4. Enforcement.
Any Authorized User found to be in violation of this policy will be considered an Unauthorized User, and as such are subject to disciplinary action pursuant with the Enforcement section of the Unauthorized Use Policy
