Attachment_B_-_EnterpriseSecurityStandards-InternalApplicationsRev4.pdf

Enterprise Security — Critical Standards Summary

The following is a summary of key points in the Orange County Government Board of County Commissioners (OCGBCC) security standards. It is necessary for vendors to completely understand and follow these requirements in order for products or services to be considered for placement within the OCGBCC environment.

Web Servers Web and Database Placement A database server shall not reside on the same hardware platform as a web server.

Anonymous Accounts Web server anonymous accounts shall only have read and execute permissions to folders/files within the web server directories. Change and delete permissions to folders/files that are directly accessible via a web browser shall not be granted to web server anonymous accounts.

Process/Application Accounts All web server processes and applications shall run only under a low privilege local account. Web server processes shall not run under an account with domain, power user or a local administrator privileges.

DMZ

Web Server Platforms Microsoft Internet Information Server (IIS) version 5.0 or higher shall be the only platform within the OCGBCC DMZ to run as a Web or FTP server.

Services and Protocols Traffic using the following protocols from the OCGBCC DMZ to the internal network shall not be allowed:

Kerberos, NetBIOS, Microsoft-DS, Microsoft's Well Known Ports, LDAP, RPC, SMB, RDP, HTTP, HTTPS, DNS, JOLT.

Encrypted Data Any data accessible within the DMZ or directly accessible from it meeting the following criteria shall be encrypted at rest with field-level encryption and in transit: names, addresses, phone numbers, email addresses, birthdates, federal/state/local document numbers, account numbers, race or religious information, usernames, passwords, employee identification numbers and all HIPAA and PCI information. The DMZ shall not have access to data containing bank information. The DMZ shall not have access to social security information.

Data Access The DMZ shall have read-only access to live data, if such data is also used by applications residing in the internal OCGBCC network.

Antivirus Virus scanning Antivirus software shall be running at all times on the computers on which it is installed. Real-time scanning of incoming and outgoing files shall be enabled at all times.

Microsoft Security Patches Patch installation MS Security patches may be applied immediately upon release by Microsoft. All vendors must support their applications in this environment.

Encryption Laptops and Removal Devices All laptop hard drives and removable devices shall be encrypted to protect any sensitive data.

ENTERPRISE SECURITY STANDARDS, POLICIES, AND GUIDELINES

WEB SECURITY STANDARD

1.0 Purpose

The purpose of this document is to establish requirements that will better manage and secure all web server platforms within the Orange County Government Board of County Commissioners (OCGBCC).

2.0 Scope

The scope of this document applies to all web server platforms located within the OCGBCC.

3.0 Policies

3.1 Activity

Any and all web server installations, removals or modifications shall require the direct involvement and documented approval by the Information Systems and Service Enterprise Security unit (ISS-ESU).

3.2 Hardware

3.2.1 All hardware platforms operating as a web server shall abide by all standards, policies and guidelines of the OCGBCC Enterprise Systems unit.

3.2.2 All hardware platforms operating as a web server shall reside on server hardware. Any exception shall require a documented wavier by the Information Systems and Services Enterprise Security unit (ISS-ESU).

3.3 Software

3.3.1 Web Server Platforms

3.3.1.1 Microsoft

Microsoft’s Internet Information Server (IIS) is the approved, supported web server platform for OCGBCC.

3.3.1.2 Apache Software Foundation

Apache Software Foundation’s HTTP Server (Apache) is approved but is unsupported. Any production use of (Apache) shall include an appropriate support model that is approved by the ISS-ESU.

3.3.1.3 Other

Other web server platforms may qualify for use, but shall require an evaluation, approval and a documented wavier by the ISS-ESU.

3.3.2 Databases

3.3.2.1 Location

A database server shall not reside on the same hardware platform as a web server.

3.4 Security

3.4.1 General

All web servers shall comply with all other documented ISS-ESU standards to include, but not limited to: virus, patch and account management.

3.4.2 Account Management

3.4.2.1 Local Account Access

Only accounts with local administrator privileges shall be allowed to log on locally to a web server.

3.4.2.2 Process/Application Accounts

All web server processes and applications shall run only under a low privilege local account. Web server processes shall not run under an account with domain, power user or a local administrator privileges.

3.4.2.3 Web Server Anonymous Accounts

Web server anonymous accounts shall only have read and execute permissions to folders/files within the web server directories. Change and delete permissions to folders/files that are directly accessible via a web browser shall not be granted to web server anonymous accounts.

3.4.3 Permissions

3.4.3.1 Operating System Permissions

ISS-ESU shall secure the operating system’s file/folder permissions and security policies of all web servers. These permissions are to be modified solely by ISS-

ESU.

3.4.3.2 Vendor/Third Party Access

Local administrator privileges on web servers are for authorized personnel only.

Access to vendors and any other third party shall be provided solely on a temporarily, case-by-case basis through ISS-ESU.

3.4.3.3 Developer Access

Developer access to web server content directories shall be available by WebDav, SFTP, FTPS or FrontPage server extensions only. Developers shall be granted “Author Pages” rights with the FrontPage Server Extensions

3.4.4 Java Server Engines

Java server engines are approved but are not supported. Any production use of a Java server engine shall include an appropriate support model that is approved by (ISS-ESU).

3.4.5 FTP

Web servers that also run an FTP server shall not map FTP directories to directories accessible via a web browser.

3.4.6 IIS Virtual Directories, Application Pools, Settings

Any and all creations, removals or modifications to IIS Settings, Virtual Directories, Application Directories, and Application Pools shall require the direct involvement and documented approval by the Information Systems and Service Enterprise Security unit (ISS-ESU).

3.4.7 Other

- Shares are not allowed on any directory accessible via web browser.

- Microsoft Windows web servers and any web application shall not be installed on the same drive as the host operating system.

- Executable files (.exe, .com, .bat, .dll, etc) shall not be placed into directories accessible via a web browser without the direct involvement and documented approval by the Information Systems and Service Enterprise Security unit (ISS-ESU).

4.0 Guidelines

• It is recommended that all web applications use the enterprise FTP and SMTP servers for all FTP/SMTP traffic.

5.0 Enforcement

Any web server not meeting the above criteria may be immediately disconnected from the OCGBCC network. Any employee found to have violated these policies may be subject to disciplinary action, up to and including termination of employment.

6.0 Definitions

Term Definition FTP File Transfer Protocol – The protocol for exchanging files over the Internet.

FTP works in the same way as HTTP for transferring Web pages from a server to a user's browser and SMTP for transferring electronic mail across the Internet in that, like these technologies, FTP uses the Internet's TCP/IP protocols to enable data transfer. FTP is most commonly used to download a file from a server using the Internet or to upload a file to a server.

SFTP/FTPS SFTP – FTP tunneled in an SSH connection also known as Secure FTP. FTPS – FTP tunneled in an SSL connection

WebDav Web-based Distributed Authoring and Versioning – Extensions to HTTP that allows users to collaboratively edit and manage files on remote Web servers.

Front Page Extensions A series of scripts that can be employed using Microsoft FrontPage, a visual HTML editor.

SMTP Simple Mail Transfer Protocol – A protocol for sending e-mail messages between servers. In addition, SMTP is generally used to send messages from a mail client to a mail server.

SENSITIVE DATA AND ENCRYPTION STANDARD

7.0 Purpose

The purpose of this document is to ensure that all Orange County Government Board of County Commissioner’s (OCGBCC) sensitive data is secured by using strong encryption algorithms that have received substantial public review and have been proven to work effectively. Orange County Information Systems and Services Enterprise Security unit (ISS-ESU) provides access to a variety of Encryption Services and Enterprise Certification Authorities

(CA).

8.0 Scope

This document applies to all data transmitted and stored within the OCGBCC information systems. It applies to all OCGBCC employees, consultants, and all other affiliated third parties operating within the OCGBCC information systems and networks.

9.0 Policies

9.1 Activity

9.1.1 Any and all activity within and through the OCGBCC information systems involving encryption shall require direct involvement and documented approval by the Information Systems and Service Enterprise Security unit (ISS-ESU).

9.1.2 The ISS-ESU shall approve the storage and transfer of any data containing personal information and/or residing in the DMZ.

9.2 Encryption Algorithms

9.2.1 One of the following standard encryption ciphers shall be used to encrypt data. The key length for these algorithms shall be no less than 128bits:

• Triple-DES (3DES)

• Rijndael (AES)

• RSA

• Blowfish

• Twofish

• CAST

9.2.2 PGP is an approved encryption standard provided that the PGP private key used to encrypt and /or sign data has been generated using a cipher meeting the requirements in section 9.2.1.

9.3 Data Hashing

The following standard data hashing algorithms shall be used to hash data. The key length for the algorithms shall be no less than 128bits.

• MD5

• SHA-2

9.4 SSL Certificates

Web Server, SSH, IMAPS, SMTPS SSL certificates should have key lengths of no less than 128bits.

9.5 Sensitive Data Stored on the Internal Network

9.5.1 Any data containing sensitive information, including, but not limited to: names, addresses, phone numbers, email addresses, birthdates, federal/state/local document numbers, account numbers, race or religious information, username and employee identification numbers should be encrypted at rest with field-level encryption and in transit.

9.5.2 Any data containing social security numbers, passwords, HIPAA or bank information shall be encrypted at rest with field-level encryption and during network transfers.

9.5.3 Any data classified as EPHI by HIPAA, or classified as secure information by PCI DSS requirements shall not be released to unauthorized parties.

9.5.4 Any information stored or transmitted on the OCGBCC network that can identify and/or compromise security systems shall be considered privileged information and shall not be released to unauthorized parties.

9.6 Sensitive Data Stored on the External DMZ Network

9.6.1 Any and all activity within and through the OCGBCC DMZ shall require direct involvement and documented approval by the Information Systems and Service Enterprise Security unit (ISS-

ESU).

9.6.2 Any data accessible within the OCGBCC DMZ or directly accessible from it should be encrypted.

9.6.3 Any data accessible within the OCGBCC DMZ or directly accessible from it meeting the following criteria shall be encrypted at rest with field-level encryption and in transit: names, addresses, phone numbers, email addresses, birthdates, federal/state/local document numbers, account numbers, race or religious information, usernames, passwords, employee identification numbers and all HIPAA and PCI information.

9.7 Data Backups

9.7.1 Any backup of OCGBCC should be encrypted. Sensitive data as listed in 9.5 of this document shall be backed up using encryption algorithm standards found in 9.2.

9.8 Laptops and Removal Devices

9.8.1 All laptop hard drives should be encrypted.

9.8.2 Any sensitive data (see section 9.5 of this document) stored on laptops and removable devices shall be encrypted.

9.8.3 All individuals who work with sensitive data (see section 9.5 of this document) shall have their laptop hard drives encrypted.

10.0 Guidelines

• SSL certificates issued to servers and applications used by internet users should be provided by commercial

CA authorities (i.e. Verisign, Thawte) to avoid security warnings from being presented to the end users.

• SSL certificates issued to servers and applications used by internal OCGBCC resources should be issued by

OCGBCC’s Certification Authority.

11.0 Enforcement

Any employee found to have violated these policies may be subject to disciplinary action, up to and including termination of employment.

12.0 Definitions

Encryption Transforming understandable data into a form that is incomprehensible and that looks like random noise.

Hashing An algorithm that takes an entire message and, through process of shuffling, manipulating, and processing the bytes using logical operations, generates a small message digest of the data.

Field-level encryption Values are stored in an encrypted format in the database and/or text files, so that attempting to read the data with a SELECT statement on a database or viewing the text files will only display encrypted data.

DMZ De-Militarized Zone – A computer term used for a protected network that sits between the Internet and the corporate network.

Certification Authority (CA) In cryptography, a certificate authority or certification authority (CA) is an entity which issues digital certificates for use by other parties.

Bank Information Checking account numbers, credit card numbers, or any unique number from a bank institution.

HIPAA The federal Health Insurance Portability and Accountability Act of 1996 EPHI Electronic Protected Health Information is a set of identifiers defined by

HIPAA § 164.514.

PCI DSS The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that all companies that process, store or transmit credit card information maintain a secure environment.

DMZ SECURITY STANDARD

13.0 Purpose

The purpose of this document is to establish requirements that will better manage and secure all platforms within the Orange County Government Board of County Commissioners (OCGBCC). The De-Militarized Zone (DMZ) is a secure environment with limited access to the OCGBCC internal network.

14.0 Scope

This document applies to all platforms located within the OCGBCC DMZ.

15.0 Goal

The goal of this document is to establish a solid foundation for which DMZ Security is built upon. DMZ Security is the basis for secure, remote resource and information access to OCGBCC information systems and networks. As such, attention to detail in the DMZ Security process is of utmost importance.

16.0 Audience

This document is intended for distribution to those that have any interaction with any system in the DMZ.

17.0 Roles

The Information Systems and Services Enterprise Security Unit (ISS-ESU) is solely responsible for the DMZ.

18.0 Policies

18.1 ISS-ESU Discretion

Any server found within the OCGBCC DMZ that does not meet the following criteria shall, at the discretion of the ISS-ESU, be immediately disconnected from the OCGBCC DMZ.

18.2 Activity

Any and all activity within and through the OCGBCC DMZ shall require direct involvement and documented approval by the ISS-ESU.

18.3 Web Servers

All internal ISS-ESU policies apply to the OCGBCC DMZ and are augmented by the DMZ Security Standard. The following differences are noted:

18.3.1 Microsoft Internet Information Server (IIS) version 5 or 6 shall be the only platforms within the OCGBCC DMZ to run as a Web or FTP server.

18.3.2 All platforms within the OCGBCC DMZ shall be patched immediately upon the release and testing by the ISS-ESU.

18.4 Administrative Rights

ISS-ESU shall be the only group with administrative rights to servers in the DMZ.

18.5 Production Servers

The OCGBCC DMZ shall host production servers only.

18.6 Remote Access

Remote Access to the OCGBCC DMZ shall be allowed only using Microsoft Terminal Services or Microsoft Remote Desktop protocols.

18.7 Traffic

18.7.1 Internet Activity

HTTP/HTTPS/FTP/SMTP/IMAPS are the only protocols allowed from the Internet into the

DMZ.

18.7.2 Internal Activity

Traffic using the following protocols and ports from the DMZ to the internal network shall not be allowed: Kerberos, NetBIOS, Microsoft-DS, Microsoft SQL Server, Microsoft’s Well Known Ports (88, 135, 137, 138, 139, 389, 445, 464, 530, 543, 544, 636, 749, 3389), LDAP, RPC, SMB, RDP, HTTP, HTTPS, DNS, JOLT.

18.7.2.1 All traffic shall first be approved by ISS-ESU before it can be considered for inclusion in the DMZ.

18.7.3 Routing

18.7.3.1 All approved access from the DMZ to the internal network shall be routed through a proxy server residing in the DMZ.

18.7.3.2 The Enterprise DMZ proxy server shall only use firewall conduits to access approved resources within the OCGBCC network.

18.7.4 External Equipment

Any device that needs to be accessible from the internet must be placed in the OCGBCC DMZ.

Only devices directly managed by either the ISS-ESU or the ISS Network Team can be connected directly to the internet bypassing the OCGBCC firewalls, requiring documented approval from both the ISS-ESU and the ISS Network Team.

18.8 Data

18.8.1 Any data accessible within the OCGBCC DMZ or directly accessible from it should be encrypted.

18.8.2 Any data accessible within the OCGBCC DMZ or directly accessible from it meeting the following criteria shall be encrypted at rest with field-level encryption and in transit: names, addresses, phone numbers, email addresses, birthdates, federal/state/local document numbers, account numbers, race or religion information, usernames, passwords, employee identification numbers and all HIPAA and PCI information.

18.8.3 The OCGBCC DMZ shall not have access to data containing bank information.

18.8.4 The OCGBCC DMZ shall not have access to social security information.

18.8.5 The OCGBCC DMZ shall have read-only access to live data, if such data is also used by applications residing in the internal OCGBCC network.

19.0 Guidelines

• Should databases in policy 18.8.5 need to receive updates by the OCGBCC DMZ, the write operations should be made to a physically separate “staging” data repository. This separate data repository should contain only updates for the specific records being changed. An application server within the internal network should be used to apply the changes in the staging data repository to the live database.

• The DMZ should access data repositories in the internal OCGBCC network using SQL database calls.

20.0 Definitions

Bank Information Checking account numbers, credit card numbers, or any unique number from a bank institution.

De-Militarized Zone (DMZ) A computer term used for a protected network that sits between the Internet and the corporate network.

Field-level encryption Values are stored in an encrypted format in the database and/or text files, so that attempting to read the data with a SELECT statement on a database or viewing the text files will only display encrypted data.

DNS Domain Name System (or Service or Server) – An Internet service that translates domain names into IP addresses. Because domain names are alphabetic, they're easier to remember. The Internet however, is really based on numeric IP addresses. Every time you use a domain name, therefore, a DNS service must translate the name into the corresponding IP address.

FTP File Transfer Protocol – The protocol for exchanging files over the Internet.

FTP works in the same way as HTTP for transferring web pages from a server to a user's browser and SMTP for transferring electronic mail across the Internet in that, like these technologies, FTP uses the Internet's TCP/IP protocols to enable data transfer. FTP is most commonly used to download a file from a server using the Internet or to upload a file to a server.

Health Insurance Portability and Accountability Act (HIPAA)

HIPAA establishes regulations for the use and disclosure of any information about health status, provision of health care, or payment for health care that can be linked to an individual.

HTTP HyperText Transfer Protocol – The underlying protocol used by the World Wide Web. HTTP defines how messages are formatted and transmitted, and what actions web servers and browsers should take in response to various commands.

HTTPS HyperText Transfer Protocol over Secure Socket Layer (SSL) – By convention, URLs that require an SSL connection start with https: instead of just http:.

IMAPS Internet Message Access Protocol – A protocol for retrieving e-mail messages.

With IMAP4, you can search through your e-mail messages for keywords while the messages are still on mail server and, then, choose which messages to download to your machine.

LDAP Lightweight Directory Access Protocol – A set of protocols for accessing information directories.

SSL Secure Sockets Layer – A protocol for transmitting private documents via the Internet. SSL uses a cryptographic system that uses two keys to encrypt data − a public key known to everyone and a private or secret key known only to the recipient of the message.

SQL Structured query language – SQL is a standardized query language for requesting information from a database.

ANTIVIRUS STANDARD

21.0 Purpose

The purpose of this document is to establish requirements that must be met by all computers connected to the Orange County Government Board of County Commissioners (OCGBCC) network to ensure effective virus detection and prevention.

22.0 Scope

This document applies to all OCGBCC computers running any version of the Microsoft Windows Operating Systems.

This includes, but is not limited to, all servers, desktop computers, laptop computers, PC-based printers and appliances.

23.0 Policies

23.1 Virus Software – Servers

Sophos Anti-Virus shall be installed and enabled on all OCGBCC computers running any server version of the Microsoft Windows Operating Systems.

23.2 Virus Software – Workstations

Sophos Anti-Virus shall be installed and enabled on all OCGBCC computers running any non-server version of the Microsoft Windows Operating Systems.

23.3 Virus Software – Exchange Servers

Sophos Anti-Virus shall be installed and enabled on all OCGBCC computers running Microsoft Exchange Server.

23.4 Virus Software – Internet Mail

All incoming and outgoing internet email shall be scanned by a Barracuda Appliance in the DMZ before being delivered.

23.5 Virus scanning

Antivirus software shall be running at all times on the computers on which it is installed. Real-time scanning of all incoming and outgoing files shall be enabled at all times. Full antivirus scans of all files and folders on servers shall be executed on a weekly basis in accordance with the schedules set in the Sophos Enterprise Console for servers. Full antivirus scans of all files and folders on workstations shall be executed on a weekly basis in accordance with the schedules set in the Sophos Enterprise Console for workstations.

24.0 Guidelines

• When employees receive unwanted and unsolicited emails, they should be deleted and should avoid replying to the sender. These messages should not be forwarded.

• Employees should never open any files or macros attached to an email from an unknown, suspicious or untrustworthy source. These attachments should be deleted immediately. These messages should not be forwarded.

• Employees should never download files from unknown or suspicious sources.

25.0 Enforcement

Sophos antivirus products are installed on all servers and workstations during the initial installation of the operating systems, and are continuously monitored to ensure they are running. Any employee or temporary found to have willfully stopped and/or paused these programs will be considered to be violating these policies and may be subject to disciplinary action, up to and including termination of employment.

26.0 Definitions

Virus A program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Viruses can also replicate themselves. All computer viruses are manmade. A simple virus that can make a copy of its self over and over again is relatively easy to produce. Even such a simple virus is dangerous because it will quickly use all available memory and bring the system to a halt. An even more dangerous type of virus is one capable of transmitting itself across networks and bypassing security systems.

27.0 Revision History

October 2017 Specified “field-level encryption” for sensitive data at rest in the summary, 9.5.1, 9.5.2, 9.6.3, 18.8.2 Added definition for field-level encryption in 12.0 and 20.0 Removed deprecated SHA-1 from allowed hashes in 9.3 Added SFTP and FTPS as allowed in 3.4.3.3 Added definitions for SFTP and FTPS in 6.0

March 2020 Replaced Kaspersky anti-virus with Sophos October 2020 Corrected grammatical error on 23.5

Added 18.7.4 for requirements on externally accessible devices