Exhibit_H_-_County_Computing_Security_Procedures.pdf

Information Technology Division

Computing Security Procedures

Last Revised Date: December 16, 2024

25-P-131TF Exhibit H

Last Revised Date: 12/16/2024

TABLE OF CONTENTS

Contacts Objectives, Scope, and Compliance Training Avoiding Malware, Viruses and Hoaxes Disposal of Computing Equipment and Media Employee Remote Access Equipment, Data, and Media Internet Network Equipment Passwords Reporting Incidents Spam Email Third Party Online Storage Providers Transferred, Separated, and Terminated Employees Vendor Access to Computing Resources Appendix A: Definition of Terms

Contacts

Main Contact

This document will make references to the contacts found below. Contact information may also be found on ENN. If you are unable to locate someone or have a question, always feel free to contact the IT Support Desk for assistance.

IT Support Desk phone number 740-5222 or x 15222 IT Support Desk email IT_SupportDesk@volusia.org

Information Technology Security Officer phone number

740-5222 or x 15222

Information Technology Security Officer email

IT_SupportDesk@volusia.org

Other Contacts

Employees of the Sheriff’s Office, Elections, Tax Collector, and Property Appraiser should contact their local IT support instead of the Information Technology Support Desk.

Sheriff’s Office IT phone number x 13501 Sheriff’s Office IT email infosys@vcso.us

Elections IT contact Kendrick Thomas Elections IT phone number x 12529 Elections IT email kthomas@volusia.org

Tax Collector contact Kat Northey Tax Collector IT phone number x 21172 Tax Collector IT email knorthey@vctaxcollector.org

Property Appraiser IT contact Skylar Thornberry Property Appraiser IT phone number x 15511 Property Appraiser IT email sthornberry@volusia.org

Objectives, Scope, and Compliance

Objectives of Procedures

The primary objective of the Computing Security Procedures is to protect Volusia County (County) Computing Resources from being intentionally or unintentionally compromised. The secondary objective is to establish responsibility and accountability for the security of County Computing Resources.

Scope of Procedures

These procedures apply to all Users of County Computing Resources.

Compliance

Information security is critical to Volusia County’s ability to protect its systems, data, and resources, ensuring secure and efficient operations. Compliance with Volusia County's Information Security Program is mandatory and considered a condition of continued employment. Failure to comply may result in disciplinary action, up to and including termination of employment. Vendors, contractors, interns, volunteers, and consultants are also required to adhere to these standards when accessing County Computing Resources. Non-compliance may be treated as a breach of contract and subject to penalties as outlined in contractual agreements.

Volusia County’s Information Security Program is built upon the foundational principles of Confidentiality, Integrity, and Availability (CIA), which establish essential safeguards for protecting the County's information assets. These principles ensure:

• Confidentiality: Information is accessible only to authorized individuals, following the "need-to-know" principle.

• Integrity: Information remains accurate, complete, and protected from unauthorized modification.

• Availability: Information, systems, and resources are accessible and usable when required by authorized users.

All users of Volusia County Computing Resources, including employees, contractors, vendors, and other authorized third parties, are expected to uphold these principles in their daily activities.

Compliance with these principles is not optional. Department and division management is responsible for ensuring adherence to these standards, enforcing compliance, and promptly notifying IT of any suspected violations or incidents. For contracted work, the prime contractor is responsible for ensuring that their employees and subcontractors comply with Volusia County's Computing Security Procedures.

Volusia County aligns its security program with recognized best practices, incorporating guidance from the National Institute of Standards and Technology (NIST) and the Center for Internet Security (CIS). This approach ensures compliance with applicable federal and state laws, regulations, and security requirements.

Volusia County recognizes that its information assets are critical to serving the public. Accordingly, all employees, contractors, vendors, and other authorized users must adhere to these standards to prevent unauthorized access, compromise, misuse, destruction, or modification of County information. Non-compliance may result in disciplinary action (including termination of employment or engagement), contractual penalties, and/or other legal action. Such legal action may include pursuing civil remedies and, where applicable, criminal prosecution under state and federal laws, including the Florida Computer Crimes Act (Chapter 815, Florida Statutes).

Pursuant to Chapter 934, Florida Statutes (as amended) and any other applicable law, all usage of county computing resources will be monitored, recorded, and subject to audit by Volusia County and any person or entity authorized by Volusia County. Unauthorized use of county computing resources is prohibited and may be subject to criminal and/or civil penalties. Use of county resources constitutes acknowledgement and agreement that usage may be monitored and recorded at any time for any purpose, and that there is no reasonable expectation of privacy regarding use of these computing resources. These acknowledgments and consents apply to all county resource usage, including both work-related and personal use, without exception.

Definition of Terms

Definitions are included in Appendix A: Definition of Terms http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0800-0899/0815/0815.html http://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Display_Statute&URL=0900-0999/0934/0934ContentsIndex.html&StatuteYear=2024&Title=%2D%3E2024%2D%3EChapter%20934

Training

Background

The County requires all employees, contractors, and other users of County Computing Resources to participate in mandatory training designed to protect the confidentiality, integrity, and availability of County data and systems. Security awareness training is required by Section 282.3185(3) of the Florida Statutes (2022) and County Council Resolution 2023-195. Compliance with these training requirements is a prerequisite for access to County Computing Resources.

Ongoing education is critical to ensure that Users are aware of current threats, recognize phishing attempts, and follow best practices for cybersecurity. The County uses phishing simulations to assess User awareness and requires remedial training for Users who fail these tests.

Procedure

All employees, contractors, and users of County Computing Resources are required to complete Annual Security Awareness Training as a condition for access to County systems. This training must be completed within the timeframe specified in the User’s training notification. Failure to complete the training by the deadline will result in suspension of access to County systems. Notifications of pending deadlines and training requirements are sent to Users, and Division Directors. If the User fails to complete training by the final deadline, a request will be submitted to IT staff to suspend the User’s access to County systems until the training is completed.

The County also conducts phishing simulations to test User awareness of phishing attacks. Users who fail phishing tests are required to complete remedial training, which must be completed within a set timeframe. If remedial training is not completed on time, the User will receive an email reminder indicating the number of days remaining and warning that failure to complete the training will result in access suspension. Division Directors are also notified of the User's non-compliance. If training is not completed, a request is submitted to IT staff to suspend the User’s access to County systems.

Access will be restored once the User successfully completes the required training.

Standard

Training is delivered through the County's Learning Management System (LMS), which provides access to online training modules and phishing simulation tests. Training assignments are automatically generated and managed by the LMS platform. Users are notified of assignments and deadlines via email notifications.

All Users must comply with Section 282.3185(3) of the Florida Statutes (2022) and County Council Resolution 2023-195, which mandate that training is a prerequisite for system access. Failure to complete required training will result in suspension of access as outlined in the Procedure section. The County tracks training completion and compliance using the LMS. Training compliance reports are emailed to Division Directors. Division Directors are responsible for reviewing these reports and ensuring that employees, vendors, contractors, and other authorized users complete all required training on time.

http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&Search_String=&URL=0200-0299/0282/Sections/0282.3185.html http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&Search_String=&URL=0200-0299/0282/Sections/0282.3185.html

Guidelines

User Responsibilities

• Complete all assigned training by the deadlines specified in email notifications. This includes

Annual Security Awareness Training, Phishing Remedial Training, and Onboarding Training for new hires.

• Monitor training notifications and reminders sent to County email addresses. Notifications specify the remaining days to complete training and provide instructions on accessing the training platform.

• Remain in compliance with training requirements under Section 282.3185(3) of the Florida Statutes and County Council Resolution 2023-195. Non-compliance will result in suspension of access to County systems.

• Apply knowledge from phishing awareness training to avoid repeated failures in phishing simulations. Repeated failures may result in additional training assignments.

• Contact the Information Technology Support Desk for assistance if issues are encountered while accessing training materials or completing assignments.

Information Technology Responsibilities

• Assign and manage the distribution of training assignments, including Annual Training and Phishing Awareness Training.

• Send automated training notifications and reminders to employees, and Division Directors, with details on deadlines and consequences for non-compliance.

• Submit a request to suspend access to County Computing Resources if an individual fails to complete training by the assigned deadline.

• Restore access after successful completion of training assignments. Management will be notified when access has been restored.

http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&Search_String=&URL=0200-0299/0282/Sections/0282.3185.html

Avoiding Malware, Viruses and Hoaxes

Computer malware (e.g., viruses, worms, spyware, ransomware, Trojan horses, rootkits, etc.) are programs designed to do damage or other unwanted actions to a computer including making unauthorized changes to applications, files, email, networks, and data. Malware can cause the destruction and/or corruption of County Computing Resources, compromise information, and can prevent Users from completing work. Intentionally introducing a virus, worm, Trojan horse, or other malicious program to a network is a criminal offense. For more information on criminal offenses, see the Florida Computer Crimes Act (Chapter 815, Florida Statutes).

Similar in nature, hoaxes warning of malware outbreaks are sent via email or other similar communication methods. Along with the warning are instructions to prevent infection. These instructions typically involve deleting files and forwarding the warning to friends and relatives. If you delete these files your system will no longer function correctly.

Ransomware is a type of malware that prevents or limits Users from accessing their system, either by locking the system's screen or by locking the Users' files unless a ransom is paid. More modern ransomware families, collectively categorized as crypto-ransomware, encrypt certain file types on infected systems and force users to pay the ransom through certain online payment methods to get a decrypt key. Users may encounter this threat through a variety of means. Ransomware can be downloaded onto systems when unwitting users visit malicious or compromised websites. It can also be delivered as attachments to email, through malicious web pages in advertisements, or be downloaded by other malware.

Phishing is another form of hoax that utilizes emails, texts, or phones to solicit personal information or cause a person to visit fraudulent web sites. In Phishing, the end goals are theft of your identity and money through the acquisition of information such as account passwords and other confidential data, or the ability to gain unauthorized access to computer systems based on information disclosed during the phishing expedition.

Cyber criminals are writing viruses that specifically use or target removable media (USB drives, portable hard drives, smartphone memory). If you plug in an infected USB drive into a work or home computer, a virus could be uploaded and potentially cripple the machine and others on the network.

Removable media can already be infected at the time of purchase if quality control measures are not adequate during the manufacturing or supply chain process. Only use removable media from trusted sources.

Procedure

All County Computing Equipment, including but not limited to workstations, laptops, tablets, and servers, will be provided with anti-virus protection. The anti-virus program will be running at all times and set to automatically apply updated virus protections released by the anti-virus vendor. The operating systems on these devices will be updated using either Information Technology’s Windows update server or using the operating system’s vendor site.

All non-County Computing Equipment with authorized access to the County’s network is required to be equipped with an approved anti-virus program. The anti-virus program will be running at all times and set to automatically apply updated virus protections released by the anti-virus vendor.

https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-what-it-is-and-how-you-can-protect-yourself

Standard

Information Technology uses multiple anti-virus servers running enterprise class anti-virus software.

The anti-virus servers are authorized by the anti-virus software vendor to download anti-virus updates over a secured Internet connection. When the vendor posts an update, the anti-virus servers automatically download the update. All County Computing Equipment is initially set up to automatically download anti-virus updates from the anti-virus servers when they are posted.

All non-County Computing Equipment used to perform county job functions will be configured with continuously running anti-virus software as considered necessary by Information Technology and department management.

Regardless of who owns or provides Computing Equipment used to perform county job functions, Users shall not install any applications, change any configurations, tamper with, disable or take any other action that interferes with anti-malware software and operating system updates.

• Be aware for potential phishing attempts by recognizing red flags like unusual grammar, unexpected requests for sensitive information, or unfamiliar sender addresses. Phishing scams may also use valid-looking logos or reference transactions related to deliveries, bank accounts, or the IRS to appear legitimate. Always review emails carefully before clicking on links or following questionable instructions.

• Report all suspicious emails by using the Phish Alert Button in Microsoft Outlook or forwarding it to phishalert@volusia.org

• Be aware and do not ignore the symptoms of a virus or other malware. These symptoms include slow workstation response, system failure, system prompts, anti-virus software messages, or automatic reboots.

• Promptly report any unusual system behavior, anti-virus warnings, or suspected malware to the Information Technology Support Desk. Do not forward the virus. Employees of the Sheriff’s Office, Elections, Tax Collector, and Property Appraiser should contact their local IT support instead of the Information Technology Support Desk. Timely reporting helps prevent potential security threats.

• Download files, attach devices, and use media from trusted sources only.

• Run anti-virus scans on all files and media downloaded to workstations, laptops, tablets, servers, or other County Computing Resources, even those from a trusted source. This includes files stored on a USB drive, CD, DVD, diskette, other storage media, and the Internet. How-to instructions are available on Information Technology’s ENN home page under the training section.

• Ensure anti-virus software is running on your Computing Equipment. How-to instructions are available on Information Technology’s ENN home page under Resources, Reference Library, How To, Verifying Workstation Anti-Virus.

mailto:phishalert@volusia.org

• Follow instructions for avoiding or fixing a virus infection only if provided by the Information

Technology Support Desk, department/division support staff, ENN Hot News, or a workstation analyst. Forward any instructions you receive from other sources to the Information Technology Support Desk or local department/division support staff for review and validation.

• Ensure an approved anti-virus program is installed, enabled and up to date on non-County equipment prior to connecting equipment to County equipment or utilizing County data.

Approved Anti-Virus Guidelines for Home PCs.

http://ennprod/informationtechnology/cabinet/standards/Anti_Virus_Guidelines.pdf

• Purchase USB drives and other removable storage from reputable vendors only. An unusually low price could indicate that a USB drive may be counterfeit or infected with malware.

• Do not connect removable drives from unknown sources (e.g. found on floor, received in the mail unsolicited, promotional giveaways) to County equipment.

• Do not purchase USB drives unless they are on the County’s approved list. For a list of approved USB drives:

Approved USB drives http://ennprod/informationtechnology/cabinet/standards/Jump_Drive_Procurement_Guidelines.PDF

• For more information on phishing, visit the Federal Trade Commission website. The Federal

Trade Commission is responsible for policing the Internet with respect to fraud.

Federal Trade Commission phishing article How To Recognize and Avoid Phishing Scams | Consumer Advice

• Install and maintain appropriate anti-malware/anti-virus protection software as considered necessary by Information Technology on all County Computing Equipment. Local IT support within the Sheriff’s Office, Elections, Tax Collector, and Property Appraiser will install and maintain appropriate anti-malware/anti-virus protection software on all equipment under their control.

• Review anti-malware logs daily.

• Immediately contain and eradicate any malware infections.

• Maintain anti-malware protection for the County email system that automatically identifies and deletes or quarantines infected email or attachments. Local IT support within the Sheriff’s Office is responsible for the Sheriff’s email anti-virus protection.

• Notify Users about widespread malware threats and known hoaxes that may impact the

County.

http://ennprod/informationtechnology/cabinet/standards/Jump_Drive_Procurement_Guidelines.PDF https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams

• Install operating system software security updates on County Computing Equipment. Local IT support within the Sheriff’s Office, Elections, and Tax Collector, will install and maintain appropriate updates on all equipment under their control.

• Respond in a timely manner to any type of malware alert and take corrective action. Local IT support within the Sheriff’s Office, Elections, Tax Collector, and Property Appraiser will respond in a timely manner to any type of malware alert and take corrective action on all equipment under their control.

Disposal of Computing Equipment and Media

County Computing Equipment and physical and electronic media may contain software, applications, and data used to provide County services. If not properly removed upon disposal, sensitive information such as Criminal Justice Information (CJI), health information, Personally Identifiable Information (PII), or passwords may pose a security risk. Physical media includes, but is not limited to, printouts, printed imagery and other paper documents containing sensitive information. Electronic media includes but is not limited to hard-drives, tape cartridges, CDs, DVDs, printer ribbons, USB drives, printer and copier hard-drives, SIM cards and smartphones. Federal regulations detail the proper handling and disposal of physical and electronic media. These regulations ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA) and CJI mandates and are consistent with the intent of Section 501.171, Florida Statute to protect people’s personal information.

HIPAA laws and regulations https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/

CJIS Security Policy Resource Center https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center

Additionally, Florida Statutes protecting personal and health information may also be relevant when County activities are governed by the State, such as oversight and control of the elections process, critical infrastructure and healthcare. Adherence to this procedure also should enable compliance with Federal and State requirements.

Procedure

When no longer needed, physical and electronic media used to process, store and/or transmit County data shall be properly disposed of or repurposed in accordance with measures established by the County of Volusia.

a. Physical media (printouts, printed documents, printed imagery, printed facsimile) containing CJI, HIPAA or sensitive data shall be disposed of by one of the following methods:

i. Shredding using County of Volusia cross-cut shredders.

ii. Placing CJI in locked shredding bins for the County’s authorized contractor to come onsite and shred, witnessed by County personnel throughout the entire process.

iii. Placing HIPAA and non-CJI sensitive data in locked shredding bins for the County’s authorized contractor to pick up and shred.

iv. Incineration of sensitive data at a contractor incineration site.

b. Electronic media (hard disk drives, tape cartridges, CDs, printer ribbons, flash drives, printer and copier hard-drives, etc.) shall be prepared for disposal or reuse by one of the following methods:

i. Overwriting (at least 3 times): This effective method clears data from magnetic media. As the name implies, overwriting uses a program to write binary digits (1 and 0) onto the location of the media where the file to be sanitized is located. Electronic media may now be sent to auction or reused.

ii. Degaussing: This method magnetically erases data from magnetic media. Degaussing using strong magnets designed for degaussing purposes or electric degaussing methods

25-P-131TF Exhibit H https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/ are acceptable. Common magnets, such as those used to hang a picture on a wall are weak and cannot effectively degauss magnetic media.

iii. Destruction: Electronic media can be physically dismantled by methods of crushing, disassembling, mutilation, incineration, etc., ensuring that the platters have been physically destroyed so that no data can be pulled. This method may be performed by CJI Authorized Personnel.

CJI Authorized Personnel must witness and log both physical and electronic media disposal when CJI is involved.

Standards

Shredding is only to be used for disposal of paper-based physical media. Electronic media being disposed of will be rendered non-usable by physical means. CDs, DVDs, floppy disks, and like type of electronic media will destroyed by incineration, mutilation (e.g., crushed, impaled, etc.), or chemical decomposition. Hard disk drives, USB drives, memory cards, and like media will be erased using a degausser approved by the Federal Government or physically destroyed through mutilation or incineration.

Electronic media being repurposed will be overwritten at least three times before being repurposed.

Guidelines User Responsibilities

a. Ensure all data have been appropriately preserved (e.g., backed up, copied, printed out, etc.)

consistent with County records management retention requirements to comply with Florida’s Sunshine law.

b. Shred paper-based physical media containing CJI, HIPAA or other sensitive information.

c. Format using software that meets Department of Defense standards for all portable electronic storage media prior to repurposing. Destroy by physical means all non-usable portable electronic media including, but not limited to, disk drives, USB drives, diskettes, CDs, DVDs, and tape prior to disposal.

d. Contact the Information Technology Support Desk to arrange for a workstation analyst to destroy data on Computing Equipment prior to repurposing or disposal.

e. For county owned smartphones, the following at a minimum needs to be done. For a comprehensive list and detailed instructions, see the below link.

1. Backup all data and connections, including text/instant messages to comply with

Florida’s Sunshine law,

2. Unpair any connected devices,

3. Turn off and sign out of any message applications,

4. Sign out of all social media applications,

5. Erase all contents and settings,

6. Encrypt the data. Encrypting the data prior to performing the factory reset will protect residual data residing in storage,

7. Perform a factory reset,

8. Verify all settings are cleared,

9. Provide your supervisor with the device lock codes and any associated business user-ids and passwords that may be needed for re-provisioning of the device if you will no longer be utilizing the device or associated accounts for county business.

10. Remove the SIM card and any micro SD cards prior to disposing of or trading in the phone.

Smart Phone Reset Guide http://ennprod/informationtechnology/cabinet/howtoguides/Smartphone_Reset_Guide.pdf

f. Contact the Information Technology Support Desk if further assistance is needed. Employees of the Sheriff’s Office, Elections, Tax Collector, and Property Appraiser should contact their local IT support instead of the Information Technology Support Desk.

a. Prepare drives for disposal using one of the following methods:

Method of Drive Disposal Approved Drive Handling PC replacement end-of-life (spinning drive and SSD)

Wipe using Department of Defense Sanitation Standards

Internal retention and repurpose (spinning drive and

SSD)

Wipe using Department of Defense Sanitation Standards

Device disposal (spinning drive)

Wipe using Department of Defense Sanitation Standards, degauss or physically destroy

Device disposal (SSD) Wipe using Department of Defense Sanitation Standards or physically destroy

b. Destroy by physical means all inoperable portable electronic media including but not limited to disk drives, USB drives, diskettes, CDs, DVDs and tape prior to disposal.

c. Disposal of any electronic media that previously contained CJI and HIPAA information shall be witnessed or carried out by CJI Authorized Personnel. Destruction records are required for CJI information and shall be maintained for two (2) years within the IT Division folder structure called ITD:\IT_Operational\Inventory\CJI_Hard_Drive_Destruction. The records shall indicate the date of the destruction, identify the material destroyed, destruction method, and be signed by the individuals designated to destroy and witness the destruction. CJI Authorized Personnel serving as destruction witnesses shall be required to know, through their personal knowledge, that such material was destroyed.

Regulations and requirements regarding handling of electronic media are expected to change over time. IT personnel are responsible for ensuring continued compliance with governing regulations when handling any electronic media that contains HIPAA, CJI or any other sensitive data.

Information Technology (IT) systems that have been used to process, store or transmit CJI and/or sensitive information shall not be released from the County’s control until the equipment has been sanitized and all stored information has been cleared using one of the above methods.

Employee Remote Access

While offering potential benefits, remote access to County resources introduces risks to the security of applications and data.

County Information Technology professionals cannot control the operating system, security settings, installation of security patches, specialized security software, or physical access to an employee-owned PC, laptop, tablet, or smartphone. Employee-owned computing equipment is considered unmanaged and unsecure.

Each remote access account and access point to the County network increases the security risk.

Management is asked to grant remote access requests only where use will significantly benefit County operations.

• Remote access will be provided in a secure manner and at the discretion of an employee’s Division Manager and with Information Technology concurrence. Under no circumstance is it permissible to remotely access any Computing Equipment which can access Criminal Justice Information (CJI) unless acceptable encryption methods are in place. The Florida Department of Law Enforcement (FDLE) and Federal Bureau of Investigation (FBI) have strict policies in place regarding this type of access.

• All users must be enrolled in Volusia County’s approved Multi-Factor Authentication (MFA) as a requirement for remote access to County resources. MFA is required for all remote access to the County’s network, systems, and applications where user authentication is required.

Users who fail to enroll in the County’s MFA solution will not be granted access.

• Management will ensure that remote access is a significant benefit to County operations.

• Remote access will be gained only through access points under the management of County Information Technology or approved by County Information Technology.

• Employee workstations directly attached to the County network and configured to permit remote access without management approval are a violation of this Procedure.

• Remote access to computer resources accessing CJI requires advanced authentication.

• The County is not responsible for the configuration, repair, or diagnosis of non-County Computing Equipment.

VPN Access and Geolocation Restrictions

• The County maintains a Virtual Private Network (VPN) to provide secure remote access for employees, vendors, and authorized third parties. To protect County systems from unauthorized access and comply with security best practices, access to the VPN is restricted by geographic location.

• VPN connections are only permitted from within the United States. Attempts to connect to the VPN from outside the United States will be automatically blocked by the County’s security systems.

• Exceptions to the United States-only access policy must be pre-approved by the Information Technology Division. Requests for exceptions must be submitted through the IT Support Desk and authorized by the Information Technology Security Officer.

• Geographic restrictions are enforced using geolocation technology that identifies the originating country of the VPN connection attempt. If a connection attempt is detected from outside the United States and an exception has not been granted, the connection will be automatically blocked.

Standard

Remote access to County email does not require a User to have access to the County network. All employees with County Microsoft Outlook email accounts must enroll in the County’s Cisco DUO Multi-Factor Authentication (MFA) to securely access email via the Internet.

Outlook Webmail https://outlook.office.com

With management approval, County and employee-owned computing equipment may be provided access to the County's email system. Management shall determine the need, and work with Information Technology to approve these requests.

Workstations, by default, will be deployed with remote access disabled.

The County maintains a virtual private network (VPN) solution to provide secure remote access by vendors and employees. The VPN solution provides for the authentication of Users, encryption of communication, and authorization of selected Computing Resources by logon.

• All users must be enrolled in Volusia County’s approved Multi-Factor Authentication (MFA) solution to access the VPN. Users without active MFA enrollment will be denied VPN access.

For assistance with MFA enrollment, contact the Information Technology Support Desk.

• Each time a User logs in to the County VPN, they are required to authenticate using the County’s approved Multi-Factor Authentication (MFA) solution to verify their identity.

• Upon establishing a VPN connection on a private device, connect to a County Computing Resource first, such as your County desktop PC, instead of connecting directly to the file system.

• Safeguard hardware or software provided by the County.

• Provide personal Internet accounts, phone lines, cable connections, remote wiring, etc., required at home or other areas outside of County premises.

https://outlook.office.com/

• Install and maintain appropriate security software including, but not limited to anti-virus software, security patches, and automatic software updates.

Approved Anti-Virus Guidelines for Home PCs.

• Provide for the maintenance, diagnosis, and repair of non-County owned hardware and software.

• Use discretion as laws regarding public records may apply to remotely attached workstations and devices including your employee-owned Computing Equipment.

• Ensure all County data, including public records, are properly safeguarded and not stored on a personal device.

• Ensure that remote access accounts, user accounts, and equipment are not available to unauthorized individuals. Prevent access to these accounts by spouse, children, or others that may have physical access to the equipment.

• Lock the screen with a password if the Computing Equipment is left unattended.

• Contact the Information Technology Support Desk if further assistance is needed. Employees of the Sheriff’s Office, Elections, Tax Collector, and Property Appraiser should contact their local IT support instead of the Information Technology Support Desk.

Department/Division Liaison Responsibilities

• Contact the Information Technology Support Desk upon receiving division director authorization to request remote access for an employee.

• Maintain the necessary remote access points, firewalls, and security measures to aid in keeping the networks secure.

• Implement and maintain remote access accounts limiting external Users to only those resources required to perform their duties.

• Provide Users guidance in configuration, access, and use of remote access.

• Provide for the maintenance, diagnosis, and repair of County owned hardware and software.

• Provide quarterly reports to department/division liaisons or their designees listing remote access accounts for verification that information is accurate. Disable accounts where appropriate.

• Provide encryption software that uses FIPS 140-3 validated cryptographic modules to all remote users that require County data be encrypted to meet regulatory compliance.

Equipment, Data, and Media

Computer hardware, software, and networks are the property of Volusia County and are provided for the purpose of conducting County business. Incidental and occasional personal use may be permitted by management as outlined in the Volusia County Communications Policy.

Volusia County Communications Policy http://ennprod.covdnssrv.co.volusia.fl.us/communityinfo/Communications-Policy.pdf

News agencies frequently highlight events where a laptop or other electronic media carrying personal information on hundreds of thousands of employees, retirees, applicants, or other files are stolen or lost. The information lost or stolen is frequently more than enough to pose a potential threat of identity theft and discredits the organization.

• Access to Computing Resources shall be restricted to authorized Users. Authorization to use Computing Resources will be limited to the User’s need to fulfill job requirements.

Management within the department responsible for the application, data, and/or equipment is responsible for authorizing all User access. Security will be configured to adhere to the standards and conventional practices of internal and external auditors in accordance with the principle of least privilege.

• Access to all computer resources requires secure authentication provided by Information

Technology. Where advanced authentication is required, such as accessing CJI data, computer users shall use advanced authentication security measures as deployed by Information Technology. The advanced authentication system will be compliant with the FBI Computing Security Policy. Examples include hardware tokens, software tokens, certificates, and other approved measures.

• County management retains the right to inspect any and all files, equipment, and logs created and/or stored on County Computing Equipment.

• Users must not install any software on County Computing Resources without prior approval.

All requests for software installation must be submitted to the IT Support Desk for review and authorization. The County reserves the right to remove any unauthorized software without prior notice.

• It is the employee’s or vendor’s responsibility to protect from loss or theft any data in their possession. Data encryption is required when removing laptops or electronic media from County facilities if the data files contain sensitive or confidential information such as social security numbers or protected health information.

• Installation of all computer software on County Computing Equipment shall be authorized by

Information Technology.

25-P-131TF Exhibit H

• Software installation on County Computing Equipment will be performed by qualified and authorized staff. Staff will follow industry-accepted installation and verification practices to ensure that software is installed and configured to provide maximum security and reliability.

• Windows operating system password protected screen savers will be configured to activate after fifteen minutes of inactivity on workstations and laptop computers. On a case-by-case basis management can approve extending the time of inactivity in accordance with the CJIS Security Policy Section 5.5.5 Session Lock and/or disabling the screen saver timeout.

Examples of where this would be valid are a kiosk, a secure front counter device, and a surveillance monitor.

• Be alert to the presence of unauthorized persons in the work area. Contact a supervisor, building security, and/or law enforcement if a person entering the work area does not provide credentials, seems suspicious, or poses a possible threat.

• Store and secure USB drives, CDs, DVDs, diskettes, or other media out of sight when not in use. Media containing highly sensitive or confidential data shall be appropriately secured, and when warranted, the data encrypted. When in doubt, request Information Technology or department/division assistance on encryption and proper protection.

• Use County Approved Encryption Methods when accessing or storing County data that must be protected to meet regulatory requirements. It is the User’s responsibility to identify and know which data are required to be encrypted.

• Protect Computing Resources including desktops, laptops, tablets, smartphones, USB drives, CDs, DVDs, diskettes, and media from environmental hazards such as direct sunlight, magnetic fields, food, smoke, liquids, humidity, dirt, dust, sand, drops/bangs, power surges/cuts, and extreme heat or cold. Users who neglect this may be accountable for any resulting loss or damage.

• Contact Information Technology Support Desk for equipment recommendations and approval

(e.g. laptops, printers, GPS units, plotters).

• Contact Information Technology Support Desk for equipment installations, disconnections, modifications, relocations, and software installations. This includes printers and other peripherals.

• Follow this Procedure and any additional departmental procedures regarding the use of

Computing Resources including data outside of County offices.

• Follow this Procedure and any additional departmental procedures regarding the downloading of data. Download data from trusted sources only.

• Before downloading files or using files or data from even a trusted source, check that the anti-virus software on your computing equipment is current and operational. Scan all downloaded material using anti-virus software prior to use. How-to instructions are available on Information Technology’s ENN home page under the training section.

• Do not take any actions to disable or prevent screen saver from activating on a workstation.

Contact Information Technology Support Desk if screen saver does not activate on a workstation after fifteen minutes of inactivity. On a case by case basis management can approve extending the time of inactivity in accordance with the CJIS Security Policy Section

5.5.5 Session Lock and/or disabling the screen saver timeout.

• Lock the password protected screen saver whenever County Computing Equipment is left unattended.

• Shut down and power off your workstation properly at end of each workday.

• Lock the password protected screen saver at end of each workday on workstations that have been approved to remain powered on continuously.

• Secure, monitor, and protect portable Computing Resources, which are more susceptible to loss, theft, and damage.

• Report any lost or stolen equipment and/or media immediately to Information Technology Support Desk and direct supervisor. Employees of the Sheriff’s Office, Elections, Tax Collector, and Property Appraiser should contact their local IT support instead of the Information Technology Support Desk.

• Set up a password protected screen saver included with the operating system on all County-owned workstations, tablets and laptops. The screen saver will be set to come on after a maximum period of inactivity. On a case-by-case basis management can approve extending the time of inactivity in accordance with the CJIS Security Policy Section 5.5.5 Session Lock and/or disabling the screen saver timeout. Mobile devices should be set to power down the screen quickly when not in use and have a lock code.

Maximum period of inactivity until screensaver activated 15 minutes

• Configure County Computing Equipment to require a password on devices at system startup and when unlocking the screen saver.

• Provide equipment and software consultations, recommendations, and approvals.

• Install County Computing Equipment with appropriate software security measures including, but not limited to antivirus software, patches, automatic software updates, passwords, and/or remote management software.

• Install, disconnect, and modify hardware and software as requested by departments/divisions through the Information Technology Support Desk.

• Provide consultation on appropriate use and data encryption.

• Provide an on-screen notification to users who access CJI data that usage of County Computing Equipment shall be by authorized individuals only and that any such usage may be monitored.

Purchasing Responsibilities

• Contact Information Technology for review and approval of Computing Resource purchase requests and to participate in solicitation projects that include Computing Resource acquisition or implementation.

Internet

The use of the Internet has become commonplace throughout the organization as a means of conducting business. While connecting to the Internet can be a tremendous asset to County government, it also heightens the exposure of County Computing Equipment to unauthorized access and tampering. Industry statistics show that computing devices connected to the Internet pose an increased likelihood of being infected with spyware programs, viruses, and other malware. Most recently, increasing numbers of ransomware attacks occur through users clicking on a compromised website.

The malicious programs can result in data corruption or damage to computer systems. For example, in 2018 Atlanta encountered a ransomware attack resulting in more than a third of Atlanta’s 424 applications becoming unavailable, close to 30% of which were “mission critical”. The City Attorney’s office lost the ability to use all but six of its 77 computers and 10 years’ worth of documents, while the police lost their dash cam recordings, compromising pending DUI cases. Some estimates put the cost at $17 million to recover.

Procedure

Management and staff will ensure the Internet is used in a manner that minimizes security risks to the County.

Standard

Internet access will be provided to employees as part of the County Standard for County Computing Equipment unless department/division management directs Information Technology otherwise.

• Abide by the Volusia County Communications Policy regarding Internet use.

• Ensure that any transactions involving sensitive information such as protected health information, passwords, and social security numbers are conducted with Trusted Sites via encrypted/secure connections. An Internet address that starts with HTTPS instead of HTTP indicates that the connection is encrypted. Use the lock icon on the browser to review the site validity and certificate authority.

• Use VeriSign, GoDaddy, and Symantec protected sites or a similar security offering for transactions involving sensitive information such as protected health information, passwords, and social security numbers.

Volusia County Communications Policy

• Do not click on web links and articles that are not related to County business. While occasional personal use may be approved by management, do not use County Computing Resource to access internet web pages that may be compromised such as those displaying eye catching articles such as “Did Mark Zuckerberg Buy a $150 Million Yacht?” or that advertise products at too good to be true prices.

• Instant messaging on Volusia County Computing Resources is prohibited unless expressly approved by the County Manager or designee.

• Check that the antivirus software on your County Computing Equipment is current and operational before downloading and using files or data from a trusted source. How-to instructions are available on Information Technology’s ENN home page under the training section.

• Scan all downloaded material using antivirus software prior to use. How-to instructions are available on Information Technology’s ENN home page under the training section.

• Deploy new County Computing Equipment with Internet access unless directed otherwise by department/division management.

• Maintain County-wide Internet access services.

• Install and maintain appropriate software security measures including, but not limited to antivirus software, security patches, and automatic software updates.

• Block access to restricted sites and services as identified.

Network Equipment

The advent of inexpensive and easy to install consumer networking equipment has introduced an increased potential for exposing County resources to security breaches.

Information Technology is responsible for all connections to the County Network.

Consumer wireless network hubs, wired hubs, and network diagnostic equipment are easily purchased at retail electronics stores for under a hundred dollars. These hubs and wireless local area network (WLAN) devices are intended for household use. Consumer products do not incorporate the security Standards necessary to protect the County network, Computing Resources, and data and should not be used.

Procedure

All access and access points to the County Network will be reviewed and approved by Information Technology.

All network access points (wired and wireless) and network equipment deployed or used within County facilities or connected to the County Network must be approved by Information Technology before installation.

Standards

Information Technology maintains Standards for equipment that is appropriate for use on the County Network and in County facilities.

Residential products are not appropriate for use on the County network.

• Contact the Information Technology Support Desk with all network requests and WLAN requirements prior to implementation.

• Install only authorized network or WLAN equipment on the County network.

• Contact Information Technology Support Desk before using any diagnostic equipment or software on the County Network.

• Report suspicious network equipment on the County Network to the Information Technology Support Desk. This would include simply seeing a consumer wireless or wired network hub in the general work area.

• Monitor the activities of vendors, contractors, employees, interns, and volunteers to ensure they comply with this Procedure.

• Use County provided wireless access points when available to connect County Computing

Resources. Under no circumstance is any CJI data to be transmitted via any wireless access point.

• Use caution when connecting County Computing Resources to wired or wireless networks outside of the County Network. For example, Internet services at airports, restaurants, and hotels are normally not as secure as the closed County Network.

• Provide a reliable, secure, and documented network.

• Approve all network requests and WLAN solutions before implementation.

• Install and configure County networking and WLAN solutions.

• Investigate and resolve any identified unauthorized access points on the network.

• Remove…