CSM_RFP_Common_Security_Requirements.pdf

RFP Common Security Requirements

Release and Version: 1st Release, Version 1.0

Release Date: October 2020

Document Classification: Confidential

CSM RFP Common Security Requirements

Revision History

Ver Date Change Summary

1.0 10/15/20 Initial publication

CONFIDENTIAL INFORMATION

This document is the property of the City of Santa Monica. It contains information that is proprietary, confidential, or otherwise restricted from disclosure. If you are not an authorized recipient, please return this document to the above-named owner. Dissemination, distribution, copying or use of this document in whole or in part by anyone other than the intended recipient is strictly prohibited without prior written permission of City of Santa Monica.

Contents

Introduction 4

Purpose/Scope 4

System Hardening Configuration Standard Ownership and Responsibility 4

System Component Management 5

Security Requirements 5

Introduction

Any system that is used for the storage, processing, or transmission of sensitive data (e.g., credit card data) must be “hardened” or configured in a manner that meets industry-accepted hardening standards for the purposes of complying with the Payment Card Industry Data Security Standards (PCI-DSS), Health Insurance Portability and Accountability Act (HIPAA) requirements and Criminal Justice Information Services (CJIS). A system component is any type of device that stores, processes, or transmits data inside the City of Santa Monica digital ecosystem.

Per the City of Santa Monica information security policy, a secure system must be designed and implemented to protect sensitive data. Server, workstations and other system components play an integral part in the security of this information.

Purpose/Scope

The primary purpose of the Common Security Requirements document is to ensure thar prospective vendors the City socialite to provide services using digital technology have at least maintain or able to implement the minimum security controls detailed below.

The standards will especially apply to all system components (hardware or software) used in the card data, medical record and criminal history and analysis environments that store, process or transmit sensitive data and serve as a baseline for other City of Santa Monica environments and/or cloud solutions as a security best practice. This includes employees who administer any system components used to process City of Santa Monica ’s sensitive data, along with any entities working for City of Santa Monica as contractors to provide server and/or system management functions.

These security requirements have been developed to specifically address the security controls required by the PCI-DSS, HIPAA and CJIS regulations.

System Hardening Configuration Standard Ownership and Responsibility

It is the responsibility of the custodians to ensure security requirements are disseminated to all relevant City of Santa Monica employees (including vendors, contractors, and business partners). Also, the custodians must ensure systems are configured with the security requirements and comply with application regulations such as PCI-DSS, HIPAA, CJIS. This will be reviewed at least annually to reflect changes to business objectives or the risk environment.

Direct questions or comments about these security requirements should be directed to the custodians of this document as detailed in the table below.

Name Title Phone Email

Veronica Mitchell Information Security Officer (310) 458-2201 ext.4611 Veronica.mitchell@smgov.net

System Component Management

The following employees at the City of Santa Monica are authorized to manage the corporate system components:

Name Title Role

Sarkis Metspakyan Infrastructure & Cloud Services Manager Infrastructure & Cloud Services Manager

Cazi Brasga Systems Engineer Server Administration

Brian Quach Systems Engineer Server Administration

Stace Graham Systems Engineer Server Administration

Jerel Guinto Client Services Supervisor Desktop Management

Hector Ramirez Computer Support Technician II Desktop Administration

Sandye Amshen Customer Experience and Support Manager Service Desk and Application Support Manager

Security Requirements

The following sections detail the system configuration standards for technology systems purchases and/or cloud solutions. These configuration standards apply to all applicable system components. They also address known security vulnerabilities and are consistent with industry-accepted system hardening standards (PCI-DSS 2.2, HIPAA and CJIS).

Information Security Policy

1. Vendor shall maintain an Information Security Policy that addresses information security for all personnel

2. This policy must be reviewed annually and include all aspects of requirements noted below

Encryption

3. Encryption or equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks.

4. Ensure that 1.2 Transport Layer Security (TLS) protocol or greater are only enabled

5. Ensure that websites have and maintain a valid certificate

6. Enable software defined security (security automated with APIs and code)

7. Where possible Cloud Service Providers shall utilize REST APIs or some time of secure APIs

8. Vendor shall ensure the use of secure measures when transferring, storing and processing data

Antivirus Protections

9. Install antivirus software on all systems commonly affected by malicious software (particularly personal computers and servers).

10. Ensure that antivirus programs are enabled so that they are capable of detecting, removing, and protecting against all known types of malicious software

11. Ensure that all antivirus mechanisms are maintained as follows:

• Are kept current

• Perform periodic scans

12. Ensure antivirus mechanisms are actively running and cannot be disabled or altered by users, unless specifically authorized by management on a case-by-case basis for a limited time period.

13. Generate audit logs which are retained. Audit trail history is retained and in line with business requirements

Access Controls

14. Provide logical access security measures to restrict access to information resources not deemed to be public

15. Procedures and safeguards exist to restrict physical and logical access to the defined system including, but not limited to, facilities, backup, and other system components such as firewalls, routers, media and servers

16. Procedures and safeguards exist to protect against unauthorized access to systems resources

17. Maintain procedures to protect against unauthorized access to system resources

18. Enable/enforce multi-factor authentication (MFA) on every account under the control of the organization, and—to the maximum extent possible—enable and enforce MFA for customer-facing services.

19. Immediately disable user accounts for those who no longer have a business need to access system(s)

20. Remove/disable inactive user accounts within 90 days

21. Limit repeated access attempts by locking out the user ID after three failed logon attempts and require an administrator reenables the user ID.

22. If a session has been idle for more than 15 minutes, require the user to re-authenticate to re-activate the terminal or session.

23. Ensure local admin or any admin accounts are onboarded into City Privilege Access Management solution

24. Provide flexible and secure Single Sign-On integration to AD/LDAP

25. User access will be administered based on job description and need-to-know

Password Management

26. Change any vendor-supplied default passwords and remove or disable unnecessary default accounts before installing a system on the City network.

a. This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, payment applications, Simple Network Management Protocol (SNMP) community strings, etc.).

27. Where feasible multifactor authentication must be enabled

28. Passwords/passphrases must meet the following requirements:

Minimum length of at least ten characters Contain both numeric and alphabetic characters Change user passwords/passphrases at least once every 90 days.

Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used.

Set passwords/passphrases for first-time use and upon reset to a unique value for each user and change immediately after the first use.

Ensure City issued multifactor authentication is used when remotely accessing network

File Integrity Monitoring

29. Ensure systems are configured to store logs in readable format only

30. Use file-integrity monitoring or change-detection software on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert).

31. Deploy a change-detection mechanism (for example, file-integrity monitoring tools) to alert personnel to unauthorized modification (including changes, additions, and deletions) of critical system files, configuration files, or content files; and configure the software to perform critical file comparisons at least weekly.

b. Note: For change-detection purposes, critical files are usually those that do not regularly change, but the modification of which could indicate a system compromise or risk of compromise. Change-detection mechanisms such as file-integrity monitoring products usually come pre-configured with critical files for the related operating system. Other critical files, such as those for custom applications, must be evaluated and defined by the entity (that is, the merchant or service provider).

Continuous Monitoring

32. System is designed with audit logs enabled to include audit and security logs

33. System can be configured to receive the GPO policy that will allow ingestion of the logs into the

City’s Security Information and Event Management (SIEM) managed by the information security team, where feasible

Data Management

34. Provide redundancy and backup solution for cloud service ecosystems

Third-Party Hosted Solutions

35. Cloud service provider shall complete the City Vendor Information Security Assessment (VISA) Form and provide to the City’s Information Security Officer

36. Cloud service provider shall provide the City’s Information Security Officer with their latest independent review and assessment (i.e. SAS SOC Type 2 report)

Third-Party Annual Review

37. Cloud service provider system security is periodically reviewed and compared with defined system security policies and best practices and there is a process to address deficiencies

38. Cloud service provider ensures there are independent reviews and assessments performed at least annually (i.e. SAS SOC Type 2 report)

39. Where applicable the vendor shall annually produce evidence of compliance with PCI-DSS, HIPAA and/or CJIS.

40. Where applicable, vendor shall ensure an assume cost for California Law Enforcement

Telecommunications (CLETS) Certification for augmented staff performing work on CLETS systems that reside in Public Safety and/or City Attorney Office

Physical Security

41. Data center utilities services and environment conditions (e.g., water, power, temperature and humidity controls, telecommunications and internet connectivity) are secure, monitored, maintained and tested for continued effectiveness

42. Maintain control of physical access to sensitive areas

43. Catalogue and track all relevant physical and logical assets located at all of the vendor’s sites within a secured system.

44. Implement physical security perimeters to safeguard personnel, data, and information systems.

Establish physical security perimeters between the administrative and business areas and the data storage and processing facilities areas.

45. Use equipment identification as a method for connection authentication.

46. Allow only authorized personnel access to secure areas, with all ingress and egress points restricted, documented, and monitored by physical access control mechanisms. Retain access control records on a periodic basis as deemed appropriate by the organization.

47. Implement, maintain, and operate datacenter surveillance systems at the external perimeter and at all the ingress and egress points to detect unauthorized ingress and egress attempts.

48. Train datacenter personnel to respond to unauthorized ingress or egress attempts.

49. Define, implement and evaluate processes, procedures and technical measures that ensure a risk-based protection of power and telecommunication cables from a threat of interception, interference or damage at all facilities, offices and rooms.

50. Implement and maintain data center environmental control systems that monitor, maintain and test for continual effectiveness the temperature and humidity conditions within accepted industry standards.

51. Secure, monitor, maintain, and test utilities services for continual effectiveness at planned intervals.

52. City data will be kept away from locations subject to high probability for environmental risk events.

Change Management

53. Procedures and safeguards exist to effectively apply required system changes

54. Vendor IT staff shall follow change control processes and procedures for all changes to system components

55. Vendor shall remove development, test and/or custom application accounts, user IDs and passwords before applications become active or are released to customers

56. Vendor IT staff shall review custom code prior to release to production or customers in order to identify any potential coding vulnerability (using either manual or automated processes) to include at least the following:

c. Code changes are reviewed by individuals other than the originating code author, and by individuals knowledgeable about code-review techniques and secure coding practices.

d. Code reviews ensure code is developed according to secure coding guidelines

e. Appropriate corrections are implemented prior to release.

f. Code-review results are reviewed and approved by management prior to release.

57. Vendors shall address common coding vulnerabilities in software-development processes by developing applications based on secure coding practices.

Human Firewall Protections

58. Vendor performs employee background checks

59. Vendors shall maintain User Acceptance Agreement with staff to adhere to data privacy, securely handling of data/system and leverage these assets and data for business purposes only

60. Vendor shall maintain procedures to ensure personnel responsible for the design development, implementation, and operation of systems maintaining sensitive data have the qualifications and resources to fulfill their responsibilities

61. Vendor shall maintain an information security awareness program that include annual training of staff

62. Train developers at least annually in up-to-date secure coding techniques, including how to avoid common coding vulnerabilities

Incident Response Plan

63. Cloud service provider maintains cybersecurity insurance

64. Company maintain and follow procedures to identify, report and act upon system security breaches and other incidents

65. Company maintain measures to prevent or mitigate threats

Knowledge Transfer & System Requirements

66. Vendor shall provide architecture and dataflow diagrams for proposed system(s)

67. Vendor shall provide documentation detailing any necessary firewall modifications needed to access application and/or external systems (i.e. opening of ports to external IP address)

68. Vendor shall provide sufficient documentation and training to City staff for usability and administration where appropriate

Patch & Vulnerability Management

69. Disable the use of unneeded ports that would allow USB port usage.

70. If/ when necessary secure (e.g. non-clear text and authenticated) standardized network protocols are used for the import and export of data to manage the service. Vendor shall provide a document to detail the relevant interoperability and portability standards utilized

71. Ensure that all system components and software are protected from known vulnerabilities by applying/maintaining applicable vendor-supplied security patches.

72. Ensure to maintain latest supported operating systems. All critical, high, and medium vulnerabilities detected on Cloud IaaS services are remediated prior to the go-live of the service.

Out-of-home digital Wayfinding Kiosks

73. Licensee will perform Operating systems and application security update and/or patches expediently

74. Built-in local administrator accounts will be disabled and renamed

75. Default and generic usernames and passwords should be changed or disabled

76. Products, including operating systems, that no longer receive security updates will not be considered

77. Must include malware protection software with up-to-date definitions

78. Must be free of malware

79. Must provide physical protection measures

80. The use of full disk encryption is required

81. Kiosk will include privacy screens to make it difficult for anyone else to see what appears on the screen

82. Systems should be configured to reset to a standard image after a reasonable amount of idle time

83. Kiosk should not store any Personal Identifiable information

84. Kiosk will include privacy screens to make it difficult for anyone else to see what appears on the screen after someone has concluded activity

85. Kiosk will provide session clearing features and automated session restarts

86. Kiosk systems software, network and backend device data are inaccessible to end users

87. Kiosk management solution is able to monitor kiosks, update kiosk content and configurations, view health and usage statistics remotely

88. Machines are deployed in well-lit areas to protect the user and the equipment form violent or malicious people

89. Kiosk will prevent unrestricted access to the underlying kiosk hardware by restricting external access to cabling or internal components, such as hard drives and USB and serial ports that would allow installation of malicious software or devices

90. Internal components, such as hardware are enclosed in secure manner to prevent theft of hardware

91. Kiosk will be equipped with a touch screen instead of a regular keyboard and mouse to prevent hackers from installing devices to capture user behavior

92. Kiosk will disable unneeded browser functionalities to prevent attackers from gaining access to the file systems