ISS_approval.pdf

From: Reddy, Priscilla To: Villalona, Ana I; Sterchele, Cynthia Subject: RE: Y23-182-AV Red Light Enforcement Camera system Date: Tuesday, March 7, 2023 11:21:01 AM Attachments: ISS - Enterprise Security Standards - External Data Hosting Rev3.pdf

EnterpriseSecurityStandards-InternalApplicationsRev4.pdf Orange County IT Standards.pdf image001.png image002.png

Good Morning Ana. Attached are the 3 (three) ISS Standards documents mentioned below.

Thanks, Priscilla Reddy ISS - Orange County Government, FL P: 407.836.8504

From: Villalona, Ana I <Ana.Villalona@ocfl.net> Sent: Tuesday, March 7, 2023 10:52 AM To: Sterchele, Cynthia <Cynthia.Sterchele@ocfl.net>; Reddy, Priscilla <Priscilla.Reddy@ocfl.net> Subject: RE: Y23-182-AV Red Light Enforcement Camera system

Thank you for your quick response. Could you please attach the standards to this email?

Thank you, Ana Villalona | Contracting Agent Orange County BCC | Procurement Division 400 East South Street, 2nd floor, Orlando, Florida 32801 | Office: 407-836-5640 | Fax: 407-836-5899 | Ana.Villalona@ocfl.net Please go to the following link to see currently advertised solicitations: https://procurement.opengov.com/portal/orangecountyfl

From: Sterchele, Cynthia <Cynthia.Sterchele@ocfl.net> Sent: Tuesday, March 7, 2023 10:39 AM To: Reddy, Priscilla <Priscilla.Reddy@ocfl.net>; Villalona, Ana I <Ana.Villalona@ocfl.net> Subject: RE: Y23-182-AV Red Light Enforcement Camera system

Good morning Ana, Our (3) ISS Standards must be included in this RFP because it is a computer system. You may use this (below) as an example from another RFP (#Y22-1045-RM). If you have any questions, please let us know.

2. Technical Specifications:

The Proposer shall describe the operating environment and proposed infrastructure. The County’s evaluation criteria for this section are related to performance, scalability, flexibility and price. In advance of installation, the contractor shall provide a detailed inventory of all hardware and software components intended for use with the JMS.

a) System Compliance

i) The system must be compliant with Federal and State Criminal Justice Information System standards.

ii) The proposed solution must support HL7 standards for the exchange, integration, sharing, and retrieval of electronic health information.

iii) Proposed hardware and software must adhere to ISS security and IT standards for software and hardware. (Attachment XX).

iv) The system shall comply with ADA, WCAG and Section 508 standards.

v) The proposed solution shall conform to National Information Exchange Model

d) System Security All vendor staff supporting the implementation must comply with CJIS background checks and training. Onsite work will occur within secure facilities and will require adherence to facility security standards and access protocols.

mailto:/O=EXCHANGELABS/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=F8D8F0C41A8D4FD1AA29526A9DA087F4-REDDY, PRIS mailto:Ana.Villalona@ocfl.net mailto:Cynthia.Sterchele@ocfl.net mailto:Ana.Villalona@ocfl.net https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fprocurement.opengov.com%2Fportal%2Forangecountyfl&data=05%7C01%7CAna.Villalona%40ocfl.net%7Cb3a201ef6ff14d5f05b408db1f27de2d%7Cd054bfee60a64f9f8d90a10bc4585279%7C0%7C0%7C638138028604456209%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=O%2Fhv0K7GY%2BMJ2a2MuZv09IM%2FZMy6DWioeBeqDzuLuJg%3D&reserved=0 mailto:Cynthia.Sterchele@ocfl.net mailto:Priscilla.Reddy@ocfl.net mailto:Ana.Villalona@ocfl.net

ENTERPRISE SECURITY STANDARDS, POLICIES, AND GUIDELINES

EXTERNAL DATA HOSTING STANDARD

1.0 Purpose

2.0 Scope

3.0 Audience

4.0 Policies

4.1 Data Input and Processing

5.0 Definitions

6.0 Revision History

August 2012 Added “Bank Information” to list of definitions in 5.0

Enterprise Security — Critical Standards Summary

The following is a summary of key points in the Orange County Government Board of County Commissioners (OCGBCC) security standards. It is necessary for vendors to completely understand and follow these requirements in order for products or services to be considered for placement within the OCGBCC environment.

Web Servers Web and Database Placement A database server shall not reside on the same hardware platform as a web server.

Anonymous Accounts Web server anonymous accounts shall only have read and execute permissions to folders/files within the web server directories. Change and delete permissions to folders/files that are directly accessible via a web browser shall not be granted to web server anonymous accounts.

Process/Application Accounts All web server processes and applications shall run only under a low privilege local account. Web server processes shall not run under an account with domain, power user or a local administrator privileges.

DMZ

Web Server Platforms Microsoft Internet Information Server (IIS) version 5.0 or higher shall be the only platform within the OCGBCC DMZ to run as a Web or FTP server.

Services and Protocols Traffic using the following protocols from the OCGBCC DMZ to the internal network shall not be allowed:

Kerberos, NetBIOS, Microsoft-DS, Microsoft's Well Known Ports, LDAP, RPC, SMB, RDP, HTTP, HTTPS, DNS, JOLT.

Encrypted Data Any data accessible within the DMZ or directly accessible from it meeting the following criteria shall be encrypted at rest with field-level encryption and in transit: names, addresses, phone numbers, email addresses, birthdates, federal/state/local document numbers, account numbers, race or religious information, usernames, passwords, employee identification numbers and all HIPAA and PCI information. The DMZ shall not have access to data containing bank information. The DMZ shall not have access to social security information.

Data Access The DMZ shall have read-only access to live data, if such data is also used by applications residing in the internal OCGBCC network.

Antivirus Virus scanning Antivirus software shall be running at all times on the computers on which it is installed. Real-time scanning of incoming and outgoing files shall be enabled at all times.

Microsoft Security Patches Patch installation MS Security patches may be applied immediately upon release by Microsoft. All vendors must support their applications in this environment.

Encryption Laptops and Removal Devices All laptop hard drives and removable devices shall be encrypted to protect any sensitive data.

ENTERPRISE SECURITY STANDARDS, POLICIES, AND GUIDELINES

WEB SECURITY STANDARD

1.0 Purpose

The purpose of this document is to establish requirements that will better manage and secure all web server platforms within the Orange County Government Board of County Commissioners (OCGBCC).

2.0 Scope

The scope of this document applies to all web server platforms located within the OCGBCC.

3.0 Policies

3.1 Activity

Any and all web server installations, removals or modifications shall require the direct involvement and documented approval by the Information Systems and Service Enterprise Security unit (ISS-ESU).

3.2 Hardware

3.2.1 All hardware platforms operating as a web server shall abide by all standards, policies and guidelines of the OCGBCC Enterprise Systems unit.

3.2.2 All hardware platforms operating as a web server shall reside on server hardware. Any exception shall require a documented wavier by the Information Systems and Services Enterprise Security unit (ISS-ESU).

3.3 Software

3.3.1 Web Server Platforms

3.3.1.1 Microsoft

Microsoft’s Internet Information Server (IIS) is the approved, supported web server platform for OCGBCC.

3.3.1.2 Apache Software Foundation

Apache Software Foundation’s HTTP Server (Apache) is approved but is unsupported. Any production use of (Apache) shall include an appropriate support model that is approved by the ISS-ESU.

3.3.1.3 Other

Other web server platforms may qualify for use, but shall require an evaluation, approval and a documented wavier by the ISS-ESU.

3.3.2 Databases

3.3.2.1 Location

A database server shall not reside on the same hardware platform as a web server.

3.4 Security

3.4.1 General

All web servers shall comply with all other documented ISS-ESU standards to include, but not limited to: virus, patch and account management.

3.4.2 Account Management

3.4.2.1 Local Account Access

Only accounts with local administrator privileges shall be allowed to log on locally to a web server.

3.4.2.2 Process/Application Accounts

All web server processes and applications shall run only under a low privilege local account. Web server processes shall not run under an account with domain, power user or a local administrator privileges.

3.4.2.3 Web Server Anonymous Accounts

Web server anonymous accounts shall only have read and execute permissions to folders/files within the web server directories. Change and delete permissions to folders/files that are directly accessible via a web browser shall not be granted to web server anonymous accounts.

3.4.3 Permissions

3.4.3.1 Operating System Permissions

ISS-ESU shall secure the operating system’s file/folder permissions and security policies of all web servers. These permissions are to be modified solely by ISS-

ESU.

3.4.3.2 Vendor/Third Party Access

Local administrator privileges on web servers are for authorized personnel only.

Access to vendors and any other third party shall be provided solely on a temporarily, case-by-case basis through ISS-ESU.

3.4.3.3 Developer Access

Developer access to web server content directories shall be available by WebDav, SFTP, FTPS or FrontPage server extensions only. Developers shall be granted “Author Pages” rights with the FrontPage Server Extensions

3.4.4 Java Server Engines

Java server engines are approved but are not supported. Any production use of a Java server engine shall include an appropriate support model that is approved by (ISS-ESU).

3.4.5 FTP

Web servers that also run an FTP server shall not map FTP directories to directories accessible via a web browser.

3.4.6 IIS Virtual Directories, Application Pools, Settings

Any and all creations, removals or modifications to IIS Settings, Virtual Directories, Application Directories, and Application Pools shall require the direct involvement and documented approval by the Information Systems and Service Enterprise Security unit (ISS-ESU).

3.4.7 Other

- Shares are not allowed on any directory accessible via web browser.

- Microsoft Windows web servers and any web application shall not be installed on the same drive as the host operating system.

- Executable files (.exe, .com, .bat, .dll, etc) shall not be placed into directories accessible via a web browser without the direct involvement and documented approval by the Information Systems and Service Enterprise Security unit (ISS-ESU).

4.0 Guidelines

• It is recommended that all web applications use the enterprise FTP and SMTP servers for all FTP/SMTP traffic.

5.0 Enforcement

Any web server not meeting the above criteria may be immediately disconnected from the OCGBCC network. Any employee found to have violated these policies may be subject to disciplinary action, up to and including termination of employment.

6.0 Definitions

Term Definition FTP File Transfer Protocol – The protocol for exchanging files over the Internet.

FTP works in the same way as HTTP for transferring Web pages from a server to a user's browser and SMTP for transferring electronic mail across the Internet in that, like these technologies, FTP uses the Internet's TCP/IP protocols to enable data transfer. FTP is most commonly used to download a file from a server using the Internet or to upload a file to a server.

SFTP/FTPS SFTP – FTP tunneled in an SSH connection also known as Secure FTP. FTPS – FTP tunneled in an SSL connection

WebDav Web-based Distributed Authoring and Versioning – Extensions to HTTP that allows users to collaboratively edit and manage files on remote Web servers.

Front Page Extensions A series of scripts that can be employed using Microsoft FrontPage, a visual HTML editor.

SMTP Simple Mail Transfer Protocol – A protocol for sending e-mail messages between servers. In addition, SMTP is generally used to send messages from a mail client to a mail server.

SENSITIVE DATA AND ENCRYPTION STANDARD

7.0 Purpose

The purpose of this document is to ensure that all Orange County Government Board of County Commissioner’s (OCGBCC) sensitive data is secured by using strong encryption algorithms that have received substantial public review and have been proven to work effectively. Orange County Information Systems and Services Enterprise Security unit (ISS-ESU) provides access to a variety of Encryption Services and Enterprise Certification Authorities

(CA).

8.0 Scope

This document applies to all data transmitted and stored within the OCGBCC information systems. It applies to all OCGBCC employees, consultants, and all other affiliated third parties operating within the OCGBCC information systems and networks.

9.0 Policies

9.1 Activity

9.1.1 Any and all activity within and through the OCGBCC information systems involving encryption shall require direct involvement and documented approval by the Information Systems and Service Enterprise Security unit (ISS-ESU).

9.1.2 The ISS-ESU shall approve the storage and transfer of any data containing personal information and/or residing in the DMZ.

9.2 Encryption Algorithms

9.2.1 One of the following standard encryption ciphers shall be used to encrypt data. The key length for these algorithms shall be no less than 128bits:

• Triple-DES (3DES)

• Rijndael (AES)

• RSA

• Blowfish

• Twofish

• CAST

9.2.2 PGP is an approved encryption standard provided that the PGP private key used to encrypt and /or sign data has been generated using a cipher meeting the requirements in section 9.2.1.

9.3 Data Hashing

The following standard data hashing algorithms shall be used to hash data. The key length for the algorithms shall be no less than 128bits.

• MD5

• SHA-2

9.4 SSL Certificates

Web Server, SSH, IMAPS, SMTPS SSL certificates should have key lengths of no less than 128bits.

9.5 Sensitive Data Stored on the Internal Network

9.5.1 Any data containing sensitive information, including, but not limited to: names, addresses, phone numbers, email addresses, birthdates, federal/state/local document numbers, account numbers, race or religious information, username and employee identification numbers should be encrypted at rest with field-level encryption and in transit.

9.5.2 Any data containing social security numbers, passwords, HIPAA or bank information shall be encrypted at rest with field-level encryption and during network transfers.

9.5.3 Any data classified as EPHI by HIPAA, or classified as secure information by PCI DSS requirements shall not be released to unauthorized parties.

9.5.4 Any information stored or transmitted on the OCGBCC network that can identify and/or compromise security systems shall be considered privileged information and shall not be released to unauthorized parties.

9.6 Sensitive Data Stored on the External DMZ Network

9.6.1 Any and all activity within and through the OCGBCC DMZ shall require direct involvement and documented approval by the Information Systems and Service Enterprise Security unit (ISS-

ESU).

9.6.2 Any data accessible within the OCGBCC DMZ or directly accessible from it should be encrypted.

9.6.3 Any data accessible within the OCGBCC DMZ or directly accessible from it meeting the following criteria shall be encrypted at rest with field-level encryption and in transit: names, addresses, phone numbers, email addresses, birthdates, federal/state/local document numbers, account numbers, race or religious information, usernames, passwords, employee identification numbers and all HIPAA and PCI information.

9.7 Data Backups

9.7.1 Any backup of OCGBCC should be encrypted. Sensitive data as listed in 9.5 of this document shall be backed up using encryption algorithm standards found in 9.2.

9.8 Laptops and Removal Devices

9.8.1 All laptop hard drives should be encrypted.

9.8.2 Any sensitive data (see section 9.5 of this document) stored on laptops and removable devices shall be encrypted.

9.8.3 All individuals who work with sensitive data (see section 9.5 of this document) shall have their laptop hard drives encrypted.

10.0 Guidelines

• SSL certificates issued to servers and applications used by internet users should be provided by commercial

CA authorities (i.e. Verisign, Thawte) to avoid security warnings from being presented to the end users.

• SSL certificates issued to servers and applications used by internal OCGBCC resources should be issued by

OCGBCC’s Certification Authority.

11.0 Enforcement

Any employee found to have violated these policies may be subject to disciplinary action, up to and including termination of employment.

12.0 Definitions

Encryption Transforming understandable data into a form that is incomprehensible and that looks like random noise.

Hashing An algorithm that takes an entire message and, through process of shuffling, manipulating, and processing the bytes using logical operations, generates a small message digest of the data.

Field-level encryption Values are stored in an encrypted format in the database and/or text files, so that attempting to read the data with a SELECT statement on a database or viewing the text files will only display encrypted data.

DMZ De-Militarized Zone – A computer term used for a protected network that sits between the Internet and the corporate network.

Certification Authority (CA) In cryptography, a certificate authority or certification authority (CA) is an entity which issues digital certificates for use by other parties.

Bank Information Checking account numbers, credit card numbers, or any unique number from a bank institution.

HIPAA The federal Health Insurance Portability and Accountability Act of 1996 EPHI Electronic Protected Health Information is a set of identifiers defined by

HIPAA § 164.514.

PCI DSS The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that all companies that process, store or transmit credit card information maintain a secure environment.

DMZ SECURITY STANDARD

13.0 Purpose

The purpose of this document is to establish requirements that will better manage and secure all platforms within the Orange County Government Board of County Commissioners (OCGBCC). The De-Militarized Zone (DMZ) is a secure environment with limited access to the OCGBCC internal network.

14.0 Scope

This document applies to all platforms located within the OCGBCC DMZ.

15.0 Goal

The goal of this document is to establish a solid foundation for which DMZ Security is built upon. DMZ Security is the basis for secure, remote resource and information access to OCGBCC information systems and networks. As such, attention to detail in the DMZ Security process is of utmost importance.

16.0 Audience

This document is intended for distribution to those that have any interaction with any system in the DMZ.

17.0 Roles

The Information Systems and Services Enterprise Security Unit (ISS-ESU) is solely responsible for the DMZ.

18.0 Policies

18.1 ISS-ESU Discretion

Any server found within the OCGBCC DMZ that does not meet the following criteria shall, at the discretion of the ISS-ESU, be immediately disconnected from the OCGBCC DMZ.

18.2 Activity

Any and all activity within and through the OCGBCC DMZ shall require direct involvement and documented approval by the ISS-ESU.

18.3 Web Servers

All internal ISS-ESU policies apply to the OCGBCC DMZ and are augmented by the DMZ Security Standard. The following differences are noted:

18.3.1 Microsoft Internet Information Server (IIS) version 5 or 6 shall be the only platforms within the OCGBCC DMZ to run as a Web or FTP server.

18.3.2 All platforms within the OCGBCC DMZ shall be patched immediately upon the release and testing by the ISS-ESU.

18.4 Administrative Rights

ISS-ESU shall be the only group with administrative rights to servers in the DMZ.

18.5 Production Servers

The OCGBCC DMZ shall host production servers only.

18.6 Remote Access

Remote Access to the OCGBCC DMZ shall be allowed only using Microsoft Terminal Services or Microsoft Remote Desktop protocols.

18.7 Traffic

18.7.1 Internet Activity

HTTP/HTTPS/FTP/SMTP/IMAPS are the only protocols allowed from the Internet into the

DMZ.

18.7.2 Internal Activity

Traffic using the following protocols and ports from the DMZ to the internal network shall not be allowed: Kerberos, NetBIOS, Microsoft-DS, Microsoft SQL Server, Microsoft’s Well Known Ports (88, 135, 137, 138, 139, 389, 445, 464, 530, 543, 544, 636, 749, 3389), LDAP, RPC, SMB, RDP, HTTP, HTTPS, DNS, JOLT.

18.7.2.1 All traffic shall first be approved by ISS-ESU before it can be considered for inclusion in the DMZ.

18.7.3 Routing

18.7.3.1 All approved access from the DMZ to the internal network shall be routed through a proxy server residing in the DMZ.

18.7.3.2 The Enterprise DMZ proxy server shall only use firewall conduits to access approved resources within the OCGBCC network.

18.7.4 External Equipment

Any device that needs to be accessible from the internet must be placed in the OCGBCC DMZ.

Only devices directly managed by either the ISS-ESU or the ISS Network Team can be connected directly to the internet bypassing the OCGBCC firewalls, requiring documented approval from both the ISS-ESU and the ISS Network Team.

18.8 Data

18.8.1 Any data accessible within the OCGBCC DMZ or directly accessible from it should be encrypted.

18.8.2 Any data accessible within the OCGBCC DMZ or directly accessible from it meeting the following criteria shall be encrypted at rest with field-level encryption and in transit: names, addresses, phone numbers, email addresses, birthdates, federal/state/local document numbers, account numbers, race or religion information, usernames, passwords, employee identification numbers and all HIPAA and PCI information.

18.8.3 The OCGBCC DMZ shall not have access to data containing bank information.

18.8.4 The OCGBCC DMZ shall not have access to social security information.

18.8.5 The OCGBCC DMZ shall have read-only access to live data, if such data is also used by applications residing in the internal OCGBCC network.

19.0 Guidelines

• Should databases in policy 18.8.5 need to receive updates by the OCGBCC DMZ, the write operations should be made to a physically separate “staging” data repository. This separate data repository should contain only updates for the specific records being changed. An application server within the internal network should be used to apply the changes in the staging data repository to the live database.

• The DMZ should access data repositories in the internal OCGBCC network using SQL database calls.

20.0 Definitions

Bank Information Checking account numbers, credit card numbers, or any unique number from a bank institution.

De-Militarized Zone (DMZ) A computer term used for a protected network that sits between the Internet and the corporate network.

Field-level encryption Values are stored in an encrypted format in the database and/or text files, so that attempting to read the data with a SELECT statement on a database or viewing the text files will only display encrypted data.

DNS Domain Name System (or Service or Server) – An Internet service that translates domain names into IP addresses. Because domain names are alphabetic, they're easier to remember. The Internet however, is really based on numeric IP addresses. Every time you use a domain name, therefore, a DNS service must translate the name into the corresponding IP address.

FTP File Transfer Protocol – The protocol for exchanging files over the Internet.

FTP works in the same way as HTTP for transferring web pages from a server to a user's browser and SMTP for transferring electronic mail across the Internet in that, like these technologies, FTP uses the Internet's TCP/IP protocols to enable data transfer. FTP is most commonly used to download a file from a server using the Internet or to upload a file to a server.

Health Insurance Portability and Accountability Act (HIPAA)

HIPAA establishes regulations for the use and disclosure of any information about health status, provision of health care, or payment for health care that can be linked to an individual.

HTTP HyperText Transfer Protocol – The underlying protocol used by the World Wide Web. HTTP defines how messages are formatted and transmitted, and what actions web servers and browsers should take in response to various commands.

HTTPS HyperText Transfer Protocol over Secure Socket Layer (SSL) – By convention, URLs that require an SSL connection start with https: instead of just http:.

IMAPS Internet Message Access Protocol – A protocol for retrieving e-mail messages.

With IMAP4, you can search through your e-mail messages for keywords while the messages are still on mail server and, then, choose which messages to download to your machine.

LDAP Lightweight Directory Access Protocol – A set of protocols for accessing information directories.

SSL Secure Sockets Layer – A protocol for transmitting private documents via the Internet. SSL uses a cryptographic system that uses two keys to encrypt data − a public key known to everyone and a private or secret key known only to the recipient of the message.

SQL Structured query language – SQL is a standardized query language for requesting information from a database.

ANTIVIRUS STANDARD

21.0 Purpose

The purpose of this document is to establish requirements that must be met by all computers connected to the Orange County Government Board of County Commissioners (OCGBCC) network to ensure effective virus detection and prevention.

22.0 Scope

This document applies to all OCGBCC computers running any version of the Microsoft Windows Operating Systems.

This includes, but is not limited to, all servers, desktop computers, laptop computers, PC-based printers and appliances.

23.0 Policies

23.1 Virus Software – Servers

Sophos Anti-Virus shall be installed and enabled on all OCGBCC computers running any server version of the Microsoft Windows Operating Systems.

23.2 Virus Software – Workstations

Sophos Anti-Virus shall be installed and enabled on all OCGBCC computers running any non-server version of the Microsoft Windows Operating Systems.

23.3 Virus Software – Exchange Servers

Sophos Anti-Virus shall be installed and enabled on all OCGBCC computers running Microsoft Exchange Server.

23.4 Virus Software – Internet Mail

All incoming and outgoing internet email shall be scanned by a Barracuda Appliance in the DMZ before being delivered.

23.5 Virus scanning

Antivirus software shall be running at all times on the computers on which it is installed. Real-time scanning of all incoming and outgoing files shall be enabled at all times. Full antivirus scans of all files and folders on servers shall be executed on a weekly basis in accordance with the schedules set in the Sophos Enterprise Console for servers. Full antivirus scans of all files and folders on workstations shall be executed on a weekly basis in accordance with the schedules set in the Sophos Enterprise Console for workstations.

24.0 Guidelines

• When employees receive unwanted and unsolicited emails, they should be deleted and should avoid replying to the sender. These messages should not be forwarded.

• Employees should never open any files or macros attached to an email from an unknown, suspicious or untrustworthy source. These attachments should be deleted immediately. These messages should not be forwarded.

• Employees should never download files from unknown or suspicious sources.

25.0 Enforcement

Sophos antivirus products are installed on all servers and workstations during the initial installation of the operating systems, and are continuously monitored to ensure they are running. Any employee or temporary found to have willfully stopped and/or paused these programs will be considered to be violating these policies and may be subject to disciplinary action, up to and including termination of employment.

26.0 Definitions

Virus A program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Viruses can also replicate themselves. All computer viruses are manmade. A simple virus that can make a copy of its self over and over again is relatively easy to produce. Even such a simple virus is dangerous because it will quickly use all available memory and bring the system to a halt. An even more dangerous type of virus is one capable of transmitting itself across networks and bypassing security systems.

27.0 Revision History

October 2017 Specified “field-level encryption” for sensitive data at rest in the summary, 9.5.1, 9.5.2, 9.6.3, 18.8.2 Added definition for field-level encryption in 12.0 and 20.0 Removed deprecated SHA-1 from allowed hashes in 9.3 Added SFTP and FTPS as allowed in 3.4.3.3 Added definitions for SFTP and FTPS in 6.0

March 2020 Replaced Kaspersky anti-virus with Sophos October 2020 Corrected grammatical error on 23.5

Added 18.7.4 for requirements on externally accessible devices

Orange County, Florida, Information Technology Standards

2/15/2023

Orange County, Florida, Information Technology Standards

Table of Contents

1.0 Introduction to Orange County IT Standards

2.0 Authorized Products for New Purchases

2.1 Authorized Hardware

2.2 Authorized Software for Desktops and Laptops

2.3 Authorized Network Connectivity

2.4 Authorized Client Based Databases

2.5 Authorized Mobile Devices

2.6 Authorized Peripherals and Accessories

3.0 Unsupported Products

3.1 Unsupported Hardware

3.2 Unsupported Software

3.3 Unsupported Client Databases

3.4 Unsupported Peripherals and Accessories

4.0 Prohibited Products

4.1 Prohibited Hardware

4.2 Prohibited Software

4.3 Prohibited Network Protocols

4.4 Prohibited Peripherals and Accessories

5.0 Standards for In-House Servers and Server Operating Systems

5.1 Microsoft Windows-Based Server Requirements

5.2 Linux-Based Server Requirements

5.3 Oracle-Based Server Requirements

5.4 Microsoft SQL-Based Server Requirements

6.0 Network Systems Requirements

6.1 Protocol Node Names and Addresses

6.2 Bridges, Routers, and Gateways

6.3 Network Security

6.4 Network Components

6.5 Network Circuits

6.6 Network Installation

6.7 Network Trouble Reporting

6.8 Network Performance Management

6.9 Network Documentation

7.0 IP Telephony Standards

7.1 Telecom Connectivity and Applications

7.2 Unwanted Calls

8.0 Externally-Hosted System Standards

8.1 Data Input and Processing

8.2 Data Storage and Handling

8.3 Transmission of Data

8.4 Disposal of Data

8.5 External Audits

9.0 Data Center Standards

10.0 Acronyms

ii

P a g e | 1

1.0 Introduction to Orange County IT Standards

This guide provides a framework for documenting policies, business processes, and internal controls used to effectively support the information technology (IT) resources of the government of Orange County, Florida, Board of County Commissioners (County). It explains the role of the County’s Information Systems and Services (ISS) personnel in approving, ordering, delivering, and maintaining IT services and products (hardware, software, networks, security, and other IT components) for employees throughout the County. It identifies County-approved products and procedures for acquiring IT systems and services. This guide also establishes County IT standards for use by third-party vendors providing externally hosted systems to various County departments.

The goal of ISS is to build an efficient, effective, and cost-efficient operation with an excellent return on investment by delivering new technologies and a state-of-the-art network server infrastructure. ISS provides prompt problem resolution through the customer service of its Help Desk. ISS seeks to maintain a diverse computing environment designed to meet the requirements of all County departments, while minimizing the risk of data loss or downtime. All computer hardware and software must be approved by ISS prior to purchase.

The ISS Department is comprised of 160+ employees, who are committed to its customer relationship-building attitude. ISS provides a business approach to serving all County agencies, which together form a partnership with ISS personnel to enhance productivity and service to the community.

The following standards apply to any device approved for connection to the County IT network or in use by County employees:

ISS personnel are responsible for ordering all new computers, software, servers, telephones, and mobile devices for use by County employees. Hardware and software orders arrive at the ISS Warehouse at 3517 Parkway Center Court, Orlando, FL 32808.

2 Submit orders by opening a ticket to request the new equipment or software using the ISS Support Center’s SupportCenter@ocfl.net email address. All purchase requests require approval in two forms.

Initial request approval is by the customer’s manager as indicated in the Peoplesoft “Reports To” field. Updates and Changes should be submitted through an ECN to HR. The secondary approval must come from a divisional representative with purchasing limit approvals. The emails will include pertinent information about the requested item(s). If sufficient details are not included in the initial email request, ISS staff will reach out to gather necessary information for the order. A list of authorized new products for purchase begins on the following page.

ISS Warehouse personnel are responsible for coordinating with the Comptroller’s Office staff to apply County asset inventory tags on computer components, as necessary, prior to installation of the equipment. No one but the Comptrollers staff an add or remove asset tags.

ISS Support personnel will install all operating systems and software. At the time of installation, ISS Support personnel must receive a copy of all installation software, along with written installation instructions, and licensing documentation. ISS will not install software without proof of licensing.

All installed computers must, at a minimum, have the following:

o ISS-installed anti-virus software o Computer configuration policy control for group management of devices by Active Directory o Remote access only as designated by ISS (ISS prohibits the use of Virtual Network Computing

[VNC] and Remote Desktop computing.)

o ISS-approved remote monitoring and management tools o Only ISS personnel shall have administrative rights.

o Hardware must be a standard supported model

ISS Enterprise Security is responsible for ISS video service; however, deployment of video equipment on the local government network must be discussed with staff members of the Data Network Team prior to purchase to determine compatibility, bandwidth, network equipment requirements, and installation feasibility.

P a g e | 2

Generally, ISS does not support multicast on the County networks, except in specific special cases.

2.0 Authorized Products for New Purchases

This section includes detailed information about products authorized for use with the County’s IT Systems.

2.1 Authorized Hardware

Dell Desktop Computer Dell OptiPlex 7000 Small Form Factor (SFF) (does not include monitor or Microsoft Office Software)

Intel Core i5 Processor

Windows 10 Professional 64-bit 512 GB Solid State Drive (SSD) Hard Drive

16 GB Random Access Memory (RAM)

USB Keyboard and Mouse

Display Port 6’ Cable

3-Year Onsite Hardware warranty

Dell Precision CAD Workstation Dell Precision 3460 SFF (does not include monitor or Microsoft Office Software)

Intel Core i7 Processor

32GB RAM

512GB SSD Hard Drive

NVIDIA Quadro P1000 4GB, (4 mDP) Video

DVD RW Optical Drive

USB Keyboard and Mouse

3-year Onsite Hardware warranty

StarTech Mini DP to DP 1.2 4k 6’ Cable (Included separately)

Dell Latitude Laptop – Standard User Dell Latitude 5430 Laptop (does not include Docking Station, Case, or Microsoft Office Software)

Intel Core i5 Processor

14.0" FHD (1920 x 1080) Non-Touch Anti-Glare LCD i5-1235U Trans, Integrated Intel Iris Xe Graphics, Thunderbolt, 8GB

512 GB SSD Hard Drive

16 GB RAM (16GB Optional)

Internal Aircard (Optional)

NO DVD-ROM Drive

HD & IR Camera w/Microphone 3-Year Absolute Resilience Protection

3-Years Onsite Hardware warranty

Optional Accessories (must be explicitly requested) o Dell WD19TB Thunderbolt Docking Station o Dell KM7120W Premier Wireless Keyboard/Mouse Set o Pro Briefcase 15 Carrying Case

P a g e | 3

Dell Precision Laptop - Standard User CDW #6933086 Mfg., Part# : 3000116001030 Dell Mobile Precision 7770 Laptop (does not include Docking Station, Case, or Microsoft Office Software)

Intel Core i7

17.3" FHD LED (1920 x 1080) Non-Touch Anti-Glare LCD

1 TB SSD Hard Drive

64 GB RAM

Internal Aircard (Optional)

Nvidia RTX A5500 video card

NO DVD-ROM Drive

LCD RGB & IR Camera w/Microphone

3-Year Absolute DDS Premium

3-Years Onsite Hardware warranty

Optional Accessories (must be explicitly requested) o Dell Performance Dock – WD19DCS – CDW #: 6416319 o Dell KM7120W Premier Wireless Keyboard/Mouse Set - CDW # 6081940 o OGIO Gambit - Laptop carrying backpack - 17-inch – black - CDW # 3048862

P a g e | 4

2.2 Authorized Software for Desktops and Laptops

Microsoft Windows 10 Pro Operating System current version or 1 version prior

Internet Explorer 11 (deprecated), Edge and Google Chrome (Note: Browser customizations are unsupported)

Microsoft Office 2019 Pro Plus or Microsoft Office 365 G1/G3, current version or 1 version prior All Microsoft Office applications on the same PC must have matching software versions (i.e., Project, Visio, Word, Power Point, Access, etc.).

Microsoft Visio 2019 Pro/Standard Microsoft Office Pro Plus, current version or 1 version prior Microsoft Project 2019 Pro/Standard current version or 1 version prior Microsoft Visual Studio 2019 Pro current version or 1 version prior ISS Desktop Support must pre-approve any application requiring the use of Active X controls. At a minimum, the application must meet the following criteria:

o It must be an .MSI file with silent installation/distribution from the command line.

o It must install and operate without end-user administrator permissions.

Java 1.8.25 – Only supported version of Java

Silverlight – latest version Bomgar or WebEx for remote access Adobe Acrobat Pro 2020, current version or 1 version prior.

o Please note that older versions may not be able to view newer version files. Check compatibility before ordering.

Adobe Acrobat Reader DC.

2.3 Authorized Network Connectivity

AT&T Wireless AirCards

Cisco AnyConnect VPN Client

Hosted applications must be accessible from devices with automatically assigned network settings. (Dynamic Host Configuration Protocol (DHCP) should supply all settings. Fixed addresses are not allowed.)

For all devices joined to our domain (this also applies to “vendor supported” devices and applications):

ISS must install the Operating System and software on the device.

ISS must receive a copy of all software and installation instructions.

Hardware must be a standard supported model (see also hardware section 2.1).

SCCM management client and Antivirus software must be installed.

PGP is required on all laptops.

The device must receive Windows updates and computer configuration changes via Active Directory policies.

Only ISS personnel shall have administrative rights.

VNC and Remote Desktop are not permitted.

2.4 Authorized Client Based Databases

Oracle (network based database)

SQL Server (network based database)

P a g e | 5

2.5 Authorized Mobile Devices

ISS personnel are responsible for placing orders for all new phones and mobile devices. Individual departments must purchase chargers, holsters, rugged cases, and other accessories, along with other office supplies. Department manager approval is required for all mobile device requests.

Conventional Phones Legacy phone with data & texting disabled

Kyocera DuraXE Epic

Android Phones County Android phones must run Android Version 9.0 or above.

Samsung Galaxy S22 (AT&T )

Samsung Galaxy S20FE (Verizon)

Tablets Tab S7FE 64GB (Wi-Fi Only) Android

Tab S7FE 64GB (Wi-Fi & Cellular Capable AT&T) Android iPad 9th Gen 64GB (Wi-Fi Only) iOS iPad 9th Gen 64GB (Wi-Fi & Cellular Capable) iOS

P a g e | 6

2.6 Authorized Peripherals and Accessories

Black and White LaserJet Printers HP LaserJet Pro 404n (500 to 2,000 pages per month) < 4 users HP LaserJet M506dn or M507dn (5-10 people, 1,500 to 5,000 pages per month + secure printing)

HP LaserJet M608dn (10-25 people, 5,000 to 16,000 pages/month + secureprinting)

Color LaserJet Printers HP Color LaserJet Pro M454 (750-4,000 pages per month, small paper tray) HP Color Laserjet Enterprise M652dn (2,500 to 17,000 pages/month + secure printing)

HP Multi-Function Devices (MFD) (Print/Scan/Copy) HP MFP M428fdn (750 to 4,000 pages per month, B/W) HP color MFP M281fdw (1 or 2 people, occasional scanning)

HP color MFP M479fdn (750 to 4,000 pages per month)

HP color MFP M578dn (2,000 to 7,500 pages per month)

Specialty Printers

Label Printers: Zebra

Badge Printers: Fargo Model HDP6600

Note: Zebra printers are label printers for Pharmacies and the Fargo printers are HR printers for ID badges.

Large Copiers (Full Sized, often leased) – Vendor Supported Toshiba Copiers

Canon Copiers

Scanners (all come with Adobe Acrobat and Automatic Document Feeders [ADF]) Fujitsu ScanSnap iX1600 (30 pages per minute [ppm], 50 sheet ADF, Connected via USB) Fujitsu fi-7160 (60 ppm-mono and color, 80 sheet ADF, Connected via USB)

Note: Printers must use Original Equipment Manufacturer (OEM) toner cartridges only.

Note: ISS must review and approve Desktop, Copier, and combo unit purchases used for printing from the PC. Contact SupportCenter@ocfl.net for more information and assistance.

P a g e | 7

3.0 Unsupported Products

3.1 Unsupported Hardware

Pentium dual-core and older desktop systems, Optiplex 755, 960, 990, 9010

Latitude D-series Laptops, Latitude E6500, E6510, E6520, E6530, E65xx

Non-Dell PCs

Wireless keyboards and mice (except conference rooms)

Desktops and Laptops over 5 years old

See also Section 3.4, Peripherals and Accessories.

3.2 Unsupported Software

MS Office platforms 2 versions prior to current (including Visio & Project)

Non MS Windows-based operating systems

Safari Web Browser

MS Office plug-ins or VBScripts

Windows Applications from the Windows App Store

Freeware

Microsoft Windows 7, XP, 98, 95 and 3.5.1 are no longer Orange County Standard (No new applications can be purchased for Win 7 computers)

Freelance

SHL Vision & Vision Express, WIN9x/WINNT/UNIX

Reflections

Chrome extensions

3.3 Unsupported Client Databases

No client-based databases are supported (e.g., Microsoft Access, Filemaker Pro)

3.4 Unsupported Peripherals and Accessories

Inkjet printers

Printers over 7 years old

Scanning to multiple folders per device

Address books in scanners/copiers (users manage their own)

Personal (non-County) mass storage devices (hard drives, thumb drives, etc.)

4.0 Prohibited Products

4.1 Prohibited Hardware

Non MS Windows-based PCs, laptops, and tablets

Recycled, Remanufactured, and non-OEM toner Cartridges

Refurbished PCs

Personal (non-County) computing equipment

Any network (voice or data) device not operated, administered, or expressly approved by ISS

Any internet access device not operated, administered, or expressly approved by ISS

Donated and vendor-provided PCs that do not meet County standards

P a g e | 8

4.2 Prohibited Software

Note: This list is not all inclusive of prohibited software. If you have questions concerning a specific application, please open a ticket or contact the Desktop Support Supervisor.

Microsoft Internet Explorer version 10 and below

Server software is not permitted on workstations (SQL server, print servers, web server, file sharing)

Cloud-based collaborative software (data must be stored within our datacenter).

Personal Software (purchased for non-commercial use)

Firefox, Opera, Vivaldi Web Browsers

Any Alpha, Beta, Shareware, Trialware software not operated, administered or expressly approved by ISS and Purchasing.

Anti-virus products not operated or administered by ISS

Personal firewall products

Network scanning tools

Remote access software other than that ISS explicitly authorizes

Desktop sharing, remote control, or remote communications software such as Remote Desktop

Web page editing tools (without prior approval)

Software coding tools (without prior approval)

User installed screen savers

Games

Third Party Desktops

Disk Compression

Non-Static BITMAP Backgrounds or screen savers iTunes or other content sharing applications

P2P software

MS Access Run-time Libraries

Zoom installed Application (Web ok)

4.3 Prohibited Network Protocols

NETBUI

AppleTalk

Any network (voice or data) software or service not operated, administered or expressly approved by ISS.

Any Internet access service not operated, administered, or expressly approved by ISS.

4.4 Prohibited Peripherals and Accessories

Portable music devices

Webcams (exceptions with Manager approval)

Printer sharing through a PC

Wireless printing

P a g e | 9

5.0 Standards for In-House Servers and Server Operating Systems The following server standards apply to all servers on the Orange County network maintained by County ISS personnel:

Only ISS personnel shall have administrative rights to server-class devices.

All servers shall operate in a VMWare-based virtual environment. The ISS Infrastructure Manager must approve in writing any exceptions to this rule prior to project implementation.

Any device that cannot run in a VMWare-based virtual environment (“stand-alone”) must have hardware and software approved by ISS Infrastructure Manager prior to its connection to the County network.

All servers will comply with ISS standard resource configurations. The ISS Infrastructure Manager must pre-approve any deviation from this standard and may incur additional costs.

No server shall be configured as a ‘file share’. File storage shall be NASbased.

In addition to the requirements listed above, all stand-alone devices must, at a minimum, meet the following requirements:

o Be installed at the County’s Regional Computing Center (RCC) o Be rack-mountable o Only run server-class operating systems o Be configured for out-of-band management and have remote monitoring softwareinstalled o Meet ISS minimum hardware requirements including, but not limited to:

▪ Dual power supplies

▪ Dual NIC’s

▪ Dual processors

▪ Dual HBA’s

▪ Dual hard drives, redundant array of independent disks (RAID) configurable forboot drive

▪ Use storage area network (SAN) for attached storage devices

The following lists the default standards used for specific server operating systems:

5.1 Microsoft Windows-Based Server Requirements

In no case shall an operating system be installed that is not under current manufacturer support (typically this is N-2 for Microsoft…