InfoSecAwarenessTraining.pdf

INFORMATION SECURITY AWARENESS TRAINING

LESSON 1. INTRODUCTION TO INFORMATION SECURITY. This lesson will introduce you to the concepts of information security. You will learn what an information system is and why protecting your organization’s information system is important. You will also learn about common terms, policies and procedures, assets that need protection, and what can occur if your organization’s security is compromised. You will also learn some of the laws and regulations that protect information for individuals, organizations, and government agencies.

! What is an Information System?

" An ‘information system’ is a discrete set of information resources organized for collecting, processing, maintaining, using, sharing, disseminating, or disposing of information. For example, computers, printers, fax machines, telephone systems, handheld computers, Personal Digital Assistants (PDA), mobile phones, and any other equipment connected to your computer are part of an information system.

" The term "information security" means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability.

- Confidentiality--Confidentiality preserves authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information

- Integrity--Integrity guards against improper information modification or destruction and includes ensuring information non-repudiation (ensuring a transferred message has been sent and received by the parties claiming to have sent and received the message.)

- Availability--Availability ensures timely and reliable access to and use of information.

! Why is Information Security Important?

" Information has value.

" Information forms the intellectual property of an organization. Therefore, protecting DOJ's information assets is of primary importance.

" DOJ information systems and information contained in those systems support the missions of the United States Government and the Department of Justice and their responsibilities for carrying out those missions.

" Protecting this information is an essential part of maintaining the confidence of law makers, the judiciary, client agencies, and tax payers.

" Information security protects the assets of the organization. These assets are things of value, such as:

- Hardware

- Software

- Data

- The reputation of the organization

! What can happen if information security is breached?

" The consequences of a security breach can range from repairing a vandalized Web site to the extreme of causing a life-threatening situation.

" A stolen laptop computer could contain sensitive case-related information, national security information, personal information which could be used for identity theft, or business secrets that could result in loss of a strategic business advantage.

! DOJ networks must be protected from software that can be used to identify and attack other computers.

" FOR EXAMPLE: After Hurricane Katrina in August 2005, a bogus email was circulated that offered links to news about the disaster. Unsuspecting victims were lured to a website where a Trojan horse was silently downloaded to their machines and began logging users' keystrokes to gather passwords and other sensitive data.

The malicious website also offered a "free scan" for the Zotob worm, but in reality further infected users with code that gave hackers control over compromised computers.

! Loss of confidentiality can affect more than just your organization.

" FOR EXAMPLE: It was reported in early 2005 that a server at George Mason

University containing the personal information of 32,000 employees and students was hacked. School officials issued a warning that the exposed information could be used by identity thieves. In this case, a vulnerability was exploited t that could have been prevented with proper controls.

! To protect the Department's data in accordance with our policies and procedures, it is important to know what the rules are, to whom they apply, and where information regarding security can be obtained.

" The information security Program Management Plan, IT Security Standards, and

DOJ 2640.2 (series) set standards and guidelines for the way an organization will protect its information systems. DOJ security policy is based on laws, regulations, and management goals tailored to the organization. Standards include a General Rules of Behavior Policy for employees. Some examples include:

- Do's

# Do change your password when prompted every 90 days.

# Do enable your Screen Saver Password or lock your workstation.

# Do lock away all confidential documents, files, and diskettes at the end of each work day.

- Don'ts

# Don't share your password with anyone including staff.

# Don't download unlawful or unlicensed software from the Internet.

# Don't install unlicensed software onto your computer.

" Information security procedures set forth step-by-step instructions for performing a task related to information security, such as:

- Incident response procedures

- Information security access requests

- Information access and disclosure procedures

" You are responsible for reading and understanding your organization's information technology security policies and procedures. You have access to written policies and procedures for your Component or organizational unit through a Web site, through your organization's information technology security team, and through the BOP Information Security section in Central Office.

! Laws, Regulations and Guidelines. To address new advances in IT technologies and our growing dependency on these technologies, new laws and regulations have been developed to maintain protection for individuals, businesses, and government agencies.

" Laws and regulations governing IT Systems include Security Training

Requirements, Security Controls Requirements, Privacy Laws, and Computer Crimes Laws.

- The Federal Information Security Management Act of 2002 requires all users of government IT systems to have the appropriate security training for their job function. This law assigned the National Institute of Standards and Technology (NIST) the task of developing security standards and guidelines, including standards for security training.

- The Computer Security Act and Paperwork Reduction Act are intended to protect classified or SENSITIVE BUT UNCLASSIFIED (SBU) information from unauthorized access. These laws include requirements for developing security plans for IT systems and for appropriate security measures for automated data processing.

- All DOJ government and non-government personnel are responsible for protection of information about individuals from improper access or disclosure. The Privacy Act, 5 U.S.C. 522a, requires the Department to publish a notice of new or revised systems of records. The Department must ensure that records about individuals are accurate, relevant, timely, and complete. Under specified procedures, the Department is required to allow individuals access to information on themselves and give individuals the opportunity to correct inaccuracies in their records (unless the information is otherwise exempt). Employees of the department may be authorized access to records about individuals when such access is necessary to perform official duties. However, the Privacy Act prohibits the disclosure of records about an individual without their consent except under specified circumstances. Disclosures within the Department are subject to “need to know” standards. Disclosures of Privacy Act protected information outside of the Department must be approved at an appropriate level. There are criminal and civil penalties for violating the Privacy Act.

If you have questions about handling personal information, ask your supervisor, legal counsel, or a privacy specialist.

- The Computer Fraud and Abuse Act provides a legal framework for prosecuting those who use computers to carry out crimes.

" These laws and regulations governing information systems have been developed to protect your organization and you as an individual. You must attend required information security training. Be sure to ask questions if you don’t understand how these laws and regulations apply to your job.

SUMMARY--In this lesson, we learned what an information system is and why protecting your organization’s information system is important. We learned about common terms, policies and procedures, assets that need protection, and what can occur if your organization’s compromised. We also learned about some of security is the laws and regulations that protect information for individuals, organizations, and government agencies.

LESSON 2. INFORMATION SECURITY RESPONSIBILITIES AND YOUR

ORGANIZATION. This lesson will provide an overview of information security in relation to the mission of the organization and the roles and responsibilities of management, security personnel, and end-users.

! Roles and Responsibilities " Whose responsibility is information security? Everyone is responsible for information security! Each individual has specific security duties based on their job function within the organization. Smaller organizations may have individuals performing more than one role.

- Management Roles and Responsibilities. Management is responsible for establishing the organization's information security program, setting program goals and priorities that support the mission of the organization, and ensuring that adequate resources are available to make the security program successful.

- IT Security Personnel. IT Security personnel include groups such as system technical and telecommunications staff and engineers. IT Security personnel are responsible for implementing security controls, analyzing vulnerabilities, responding to incidents, and planning for disaster recovery.

- Users Roles and Responsibilities. A User is any government or non-government person who has access to DOJ networks and systems or any contractor facility individual working on DOJ systems, information, or providing services. All users are responsible for IT security, for following security procedures and reporting security problems.

# User Activity. User activity is subject to monitoring and system activity may be audited to detect unauthorized activity or suspicious behavior. Unauthorized or suspicious behavior by a user may result in loss of access while the incident is being investigated, written reprimand, termination, fine or imprisonment.

# Software and Internet Piracy. Software piracy is defined as illegally copying or reproducing software programs, counterfeiting and distributing software, or violating software licensing agreements such as installing single user software on multiple workstations. Internet piracy is defined as using the Internet as a means of distributing pirated software. The distribution process includes advertising, offering, or acquiring unauthorized copies of software. You are legally compelled to comply with the copyright and site licenses of proprietary software

# Sending, forwarding, storing, printing, viewing sexually explicit, racially degrading, or other material which is inappropriate for the workplace

- Sending, forwarding, storing, printing, viewing or emailing offensive or inappropriate material relating to a person’s gender, sexual orientation, race, creed, culture, etc.

LESSON 3. COMMON THREATS AND VULNERABILITIES. There are many different ways in which an information system is subject to harm from threats and vulnerabilities. There are also things that you can do to assist the Department of Justice in minimizing these threats and vulnerabilities. This lesson will provide an overview of common threats and vulnerabilities, and the role you play in minimizing them.

! Threats. A threat is an unintentional or deliberate event or circumstance that could have an adverse impact on an information system. Threats can come from internal or external sources.

" There are three main categories of threats:

- Natural. Natural threats can endanger any facility or piece of equipment.

You may not be able to prevent a natural disaster but damage can be minimized with proper planning. Natural threats include fire, flood, lightning, and power failures.

- Unintentional Threats. Unintentional threats are actions that occur due to lack of knowledge or through carelessness. Unintentional threats can be prevented through awareness and training. Unintentional threats include physical damage, deleting information, and permitting unauthorized access.

- Intentional Threats. Intentional threats are those threats that are deliberately designed to harm or manipulate an information system, its software, and/or data. Security software, such as an antivirus program is

SUMMARY--This lesson discussed the roles and responsibilities of management, security personnel and end users in information security.

designed to protect against intentional threats. Intentional threats include, eavesdropping, denial of service, theft, and unauthorized data access.

" Types of Threats

- Internal. Internal threats consist of the possible dangers from 'authorized system users.' More than 60% of security breaches are caused by insiders.

This happens because security controls are usually designed to keep intruders out.

# Why do internal threats happen? Many occur due to honest mistakes or lack of training. Insider threats may also be due to one of three commonly identified motivations:

* Disgruntled employees

* Financially distressed employees

* Emotionally distressed employees

# What can you do to protect IT systems from internal threats?

* When you observe unusual behavior from your coworkers, report the behavior to a supervisor.

* You can also help your organization through training.

* Examples of unusual behavior include:

+ Continued expressions of intent to 'get even‘ + Unusual behavior such as attempting to get unauthorized access to sensitive data + Situations where a coworker has difficulty performing a task they normally do well

- External. External threats originate from outside of the organization. For example, a computer hacker could exploit a vulnerability to gain remote access into the information systems of your organization.

# Malicious Code. One of the most common external threats is malicious code. Malicious code is defined in CNSS 4009 as software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system.

* 'Malware,' also known as malicious software includes:

+ Viruses. A virus is a code fragment that attaches itself to other programs. A virus cannot run on its own. It executes when the host program is run and copies itself to more programs. A virus may cause damage by slowing down the IT system or by modifying or destroying data. Example: The W32/Pulkfer-A virus will attempt to find and infect files with an EXE extension. When an infected file runs, a dialog box is displayed with the message "This file has been infected... :P-- pker/pure."

W32/Pulkfer-A is an appending type virus that does its damage before allowing the infected host to operate normally.

+ Worms. A worm is a self-replicating independent program, similar to a computer virus. It copies itself from one computer to another, usually over a network. A worm can cause damage by deleting files on a host system or by slowing down an information system and its supporting net work infrastructure by generating huge amounts of network traffic while reproducing itself, among other destructive things. Example: In February 2005, the Bropia-F worm turned infected Windows PCs into zombie drones. The worm spread via MSN Messenger by offering "sexy image files" to the IM contacts of infected users.

+ Trojan Horse. A Trojan Horse is a computer program that appears to have a useful function, but also has a hidden and potentially malicious function for falsification, collection, or destruction of information. A Trojan horse causes damage by collecting sensitive information, or by falsifying, destroying, and altering information. Example:

"CCTaker" is an example of a Trojan horse. This program appears to be a charity donation form but is actually used to steal passwords and other personal information

+ Logic Bombs. A logic bomb is a piece of instructional code intentionally inserted into a software system that will trigger malicious action when specified conditions are met. The most common activator for a logic bomb is a date.

Destruction can happen in a matter of seconds but restoring functionality can take hours, even days! A logic bomb does not replicate itself. Example: The classic use for a logic bomb is to ensure payment for software. If payment is not made by a certain date, the logic bomb activates and the software automatically deletes itself, or more maliciously, deletes other data on the system.

+ Phishing scams. A phishing scam or attack impersonates an e-mail alert from a well-known entity. The scam attempts to obtain sensitive information from a user. Phishing frauds have become common as more consumers have begun to do personal banking on the Internet. Example:

Author J.K. Rowling warned Harry Potter fans in early 2005 to beware of Internet fraudsters claiming to be selling electronic copies of her latest book. In this phishing scam, fans were asked to hand over financial information, bank and credit card details, to pay for a supposed copy of Harry Potter and the Half-Blood Prince that was scheduled for July publication.

+ Spyware. Spyware is a program designed to monitor and gather data on system use, system settings, and user interactions. Though often not malicious, spyware programs can also be used maliciously to intercept passwords and other confidential data or even take control of a system.

Spyware is also well known for targeting web browsers with incessant pop-up advertising.

Example: Susan visits a company's website and sees an advertisement for a program. After clicking the link, a pop-up window asks if she would like to download the program. She clicks "no" but the program downloads and installs itself anyway. In the process, the program also surreptitiously harvests information from her computer and sends it over the Internet.

# Threat Protection. You can protect your information system against malicious software by using antivirus software and good security practices. Use virus-scanning software on diskettes or other removable media. Scan email attachments with antivirus software before opening them. Follow your organization’s security rules about downloading or installing software.

* Tips:

+ Never install or download unapproved software.

Follow organizational procedures.

+ Disable JavaScript in your browser (unless required).

+ Make sure your browser's location line is always visible.

+ Pay attention to the URLs displayed on your browser location line.

+ Use an Anti-Spam software filter.

+ Use a personal Firewall.

+ Scan all CD, diskettes, and attachments prior to use.

If a virus is indicated, discontinue use immediately and contact your computer specialist or Information

Security.

# Social Engineering. Another common external threat is social engineering. Social engineering involves tricking people into revealing information that can be used to gain access to an information system.

* Social engineering can happen by:

+ Telephone + In-person access + Dumpster-diving

* You can protect your organization's information assets against social engineering by asking questions and following good security practices.

+ Ensure a person is authorized to receive the information + Ask for identification + Shred sensitive documents + Don't give out information over the phone

! Vulnerabilities. Vulnerabilities are points where a system is susceptible to attack. Every information system has points of vulnerability such as physical, natural, hardware and software, media, communications, and human. Security measures reduce the chances of a vulnerability being exploited.

LESSON 4. WHAT CAN YOU DO? This section will tell what you can do to prevent those information security risks.

! Controls. Security controls are the policies, practices, and organizational structures designed to provide reasonable assurance that business objectives are achieved and that undesired events are prevented or detected and corrected. Controls are not limited to devices. You are a security control.

" Passwords

- Providing a username and password is the most common way to access an information system.

- Improperly creating and storing a password can introduce risk to business information.

- Create strong passwords (password that are hard to guess):

# Use a mix of upper and lower case letters, numbers, and special

SUMMARY. In this lesson, we discussed threats and vulnerabilities. We identified three main categories of threats and discussed the difference between internal and external threats.

We also discussed what you can do to protect your organization from these threats.

characters: @ # $ # Passwords should be 8 characters in length.

# Use a string not found in the dictionary. For example 'sp@m' instead of 'spam‘ or 'crdnls' instead of 'cardinals.' # Avoid using names of pets or family members, or numbers such as your phone number.

# Make sure that your password is one that can be easily remembered.

- Passwords must be changed :

# The first time you use an account (NEVER use a default password!)

# Every 90 days (the system should automatically prompt you).

# Any time you suspect your password may have been compromised

(notify information security)

- Do not write passwords down. Writing your password near your computer is like leaving the key to your house under the doormat. It is an easy way for an intruder to break in.

- As a general rule, do not record passwords online or by e-mail. Do not record passwords online or send them electronically. Electronic communications can be captured and scanned to obtain this information.

- Do not use the “remember my password” feature. Using this feature allows anyone with access to your computing device to log on.

- Contact the Help Desk if you have forgotten your password. Your system will become locked after the third attempt if you enter an incorrect password.

- Do not divulge your passwords to anyone. Do not divulge your password to anyone or use anyone else's password, even if they have given you permission. Never provide your password or any system information over the phone to an unsolicited or unidentified caller. Hackers will sometimes phone employees and get them to divulge passwords by pretending to be someone from the Help Desk. The DOJ Help Desk or your system administrator will never ask you for your password over the phone, even when helping you troubleshoot a problem.

" Verbal Communication. Policies define requirements for managing business information. The requirements apply to electronic, paper and verbal disclosure of business information. Because you never know who is listening, be careful to follow policies and procedures when verbally communicating information such as:

- Confidential information

- Ongoing investigations

- Grand Jury Information

- Secured data center locations

- Names and IP addresses of mission critical servers

- Key pad entry codes

" Data Security. In accordance with the DOJ Order 2640.2 (series), all IT systems that process unclassified information will be designated as Sensitive But Unclassified (SBU). In order to protect SBU information, there are rules and regulations guiding data security.

- Use only data for which you have been granted authorization. Do not attempt to access information for which you do not have both the authority to access and a 'need to know' to perform your job.

- When working with government data, it is important to share information with only those who are authorized to see it. The authorization may be based on 'need to know', security clearance level, or other criteria. For example, Tax Payer Information requires 'personally and directly engaged in' a matter.

- Limit the number of people who have access to your shared files to those who are authorized to see it.

- Remove files from shared directories when the information is no longer needed. Remember that you are responsible for safeguarding all SBU or classified material under your control.

- Coordinate your computer system access requirements and parameters with your supervisor.

- Your activity while operating a government computer system can be monitored and you are responsible and held accountable for any activity associated with your account.

- Department personnel and non-Department personnel (including contractors and volunteers) who access Department computers will be granted access levels appropriate to the sensitivity of information stored on the computer.

- Non-U.S. citizens shall not be authorized to access or assist in the development, operation, management or maintenance of Department IT systems, unless a waiver has been granted by the Head of Component, with a concurrence of the Department Security Office and the CIO.

- Protecting Sensitive But Unclassified (SBU) Information # Secure your work area. Limit access to your workstation and its resources to authorized personnel.

# Be aware of who is in your workspace while you are working on your computer.

# Use the screen lock function when you leave your workstation for short periods during the day.

# Log off your system at the end of the day or when you plan to be away from your terminal for long periods.

# Store data securely. When not in use, lock it up.

# Do not store SBU data on electronic media that cannot be protected against unauthorized access.

# A cover sheet must precede all SBU facsimile transmissions. The cover sheet should contain the name, office, and voice or fax telephone numbers for the recipient and sender as well as a warning banner with instructions to the recipient if the facsimile was received in error.

# When no longer usable, diskettes, tape cartridges, ribbons, and other similar items used to process SBU must be destroyed by shredding, incineration, or degaussing; whichever method is available, appropriate, and cost effective.

# IT systems that have processed, stored, or transmitted SBU information will not be released from a component's control until the equipment is sanitized, all stored information is cleared, and the transfer approved. This requirement includes equipment transferred to schools.

# When no longer required for mission or project completion, IT storage media that will be utilized by another person within the component will be overwritten with software prior to use and protected in a manner consistent with the sensitivity of the data contained. The software will delete any traces of the data that was previously on the storage media.

" Physical Security. Physical safeguards are also necessary to protect DOJ employees, business information and supporting systems.

- Badges. All employees and visitors are required to display an identification badge while on DOJ property.

# Badges should be visible at all times. Your badge should be removed when you leave your building # Never let anyone make a photo copy of your badge.

# Badges serve four purposes:

* Identification

* Authorization

* Access into the building

* Access to secured areas.

# Never let anyone use your badge.

# Never let anyone follow you into secured areas that do not have proper identification.

# Request to see the ID badges of people you do not know and ask, 'May I help you?'. Although you might feel uncomfortable asking to see an ID badge, unauthorized personnel can present security risks to the organization.

- Telecommuting. Working offsite is a common practice in today's business environment. This requires gaining access to a computer or network from a remote location. Offsite workers should be aware of potential risks while accessing DOJ information from remote sites. Here are some things that you can do to mitigate risks:

# Ensure that your virus protection is enabled and current.

# Protect DOJ-issued devices and documents from theft.

# Do not disclose work-related information to strangers.

# Do not work on classified information in public.

# Do not use public devices or wireless access points to view or transmit classified business information.

- You can protect your mobile computing devices and information from theft by:

# Password-protecting laptops and PDA # Locking laptops and briefcases to a fixed object # Keeping portable devices in your possession at all times # Encrypting and password-protecting sensitive documents on your portable devices # Storing sensitive documents in locked file cabinets # Restricting access to rooms that store sensitive information

" E-mail Security Basics. E-mail is a quick, convenient form of business communication that allows you to share information in many formats. Since e-mail is so widely used, it is a frequent source of security problems. When appropriate, encrypt attachments that contain sensitive information such as Grand Jury information or Federal Tax Payer information.

- Since there is no expectation of privacy for e-mail, information could be read by individuals who should not have access to it. Also, be careful not to e-mail classified information on an unsecured network. As a precaution, end-users should be familiar with DOJ policies on transmitting classified information found in the DOJ Security Program Operating Manual

(SPOM).

- Broadcast messages (spam). Spam is an e-mail message sent to groups of people, much like the junk mail sent through the postal system. Spam messages can overload the IT system by adding to the amount of information that must be stored and processed. Such unofficial mass mailings are not permitted.

- E-mail attachments. Incoming file attachments can contain malicious code, such as the "I Love You" virus. Examples of other suspicious file attachments include those with the following filename extensions: *.exe, *.vbs, *.bin, *.com, or *.pif.

- Chain letters. Chain letters urge you to read an 'important' message then send it to your friends. Typically, the content isn't true. Chain letters can disrupt the IT system by adding to the amount of information that must be stored and processed.

- Hotlinks. Hot links could be contained in an e-mail message that directs you to click on a Web link. That Web link may contain a Trojan horse virus that could run a malicious program in the background of your computer system.

- Use caution when sending Sensitive But Unclassified (SBU) materials to individuals outside of the Department, and be careful to use the correct email for each addressee.

- Automatic or manual forwarding of email sent to your DOJ account to a non-Department email system (such as AOL, Yahoo!, or Hotmail) is prohibited.

" Peer-to-Peer File Sharing. Peer-to-peer (P2P) file sharing and other emerging technologies are becoming a major risk to information security. These networks allow users to circumvent network security controls and enables the spread of viruses and malicious code.

- P2P and Emerging Technologies Policy Installation of P2P networks or other emerging technologies are NOT permitted except when a business case analysis demonstrates that the use of P2P outweighs the inherent risk.

Business cases for P2P networks and other emerging technologies must be presented to and specifically approved by the Department CIO or his designee in each component.

- Additional policy information on P2P networks can be found in the IT Security Standard, parts 2.7 and 3.2.

" Safely using the Internet. The Internet has become a valuable commodity with a wealth of information. Some of this information, however, has been deemed inappropriate within the DOJ. To safely use the Internet, you should not:

- Link, bookmark, access, download, transmit, or store objectionable material, images, or content.

- Watch or listen to non-business related streaming media broadcasts, including, but not limited to, Internet-based radio stations, music channels, music videos, and television stations.

- Adjust the browser security settings to be less restrictive than the DOJ approved configuration.

" Recognizing Incidents. Information security depends in large part on the DOJ’s ability to take a proactive stance on detecting and recognizing security incidents that threaten its business information and systems.

- What is a security incident? It is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices. Some examples of security incidents include . . .

# Physical Theft. If you are missing any equipment, notify security immediately. Missing equipment may be an indication of physical theft.

# Information Theft. When information is stolen, symptoms may include missing files or signs of unauthorized access. In some cases, theft may be detected through the use of physical or electronic logs.

# System Compromise. Slow system performance or unusual system activity may indicate that a system has been compromised.

# Information Compromise. Indications that information may have been altered comes from unusual file activity or changes in file modification dates.

# Unauthorized Access. Symptoms of unauthorized access include unauthorized modification, a compromised password, and missing or compromised files. In some cases, this may be detected through the use electronic logs.

# Misuse or Unethical Use. Indications of inappropriate usage are sending harassing e-mail messages to coworkers, acquisition or distribution of pirated materials, and the exporting of sensitive materials from the organization.

# Malicious Code. Indication of a malicious code attack could come from an antivirus alert or a malfunction in the system. There may also be transmission of information to an unknown Internet site.

Also, data may have been corrupted. Some examples of malicious code include viruses, worms, and Trojan horses.

# Denial of Service. A system compromise may also be a Denial of Service (DoS). In this instance, someone, or something, is using all available network band with by generating unusually large volumes of traffic. They may be sending illegal requests to an application to crash it, or they may be consuming available disk space by creating many large files.

- Reporting an Incident. Reporting an incident helps assess the damage and prevent future occurrences. You should report anything that looks different or out of the ordinary.

# Notify your supervisor, Help Desk, or the appropriate point of contact # Tell only people who need to know # Unless you are responsible for the reporting of incidents externally, do not contact any other entity outside the organization in which you work

# Do not do anything to your system unless you are told to, including shutting off or rebooting your computer

# Do not send incident details from your computer # When you report an incident, be prepared to provide all the information that your POC will need to determine the nature and scope of the incident. Remember to take detailed notes, including dates and times, when preparing to report an incident. Below is a list of information you should be prepared to provide.

* Who noticed signs that there may be an incident?

* What indications were noticed?

* When did each indication become evident?

* Where and under what conditions did each indication appear?

# Security managers should notify the Information Security Section.

LESSON 5. BASIC INFORMATION SECURITY PROCEDURES. This lesson will provide an overview of some basic information security procedures established in the Bureau of Prisons. You will become familiar with the requirements necessary for system access, how to initiate an incident report to your local Information Security Officer, and understand your role in these processes.

! Monitoring. IMPORTANT! Inmates must be monitored whenever in an area where computers are located.

! Violations. The following are examples of information security violations:

" Password Sharing " Social Engineering " Computer Hacking " Software Viruses " Unauthorized System Access " Loss or Theft of Computer Equipment or Data " Sabotage, Damage, or Destruction of Information or Information Systems

! Incident Reporting. Information security violations should be reported to the facility Information Security Officer (ISO) as well as relevant supervisors as soon as possible.

The ISO will, subsequently, notify relevant personnel within a working day of the incident, to include:

" Facility Executive Staff " Appropriate Regional Staff " Information Security (INFOSEC) in Central Office

! System Access.

" To access government systems, individuals must have:

- Approval from a Supervisor or Sponsor. Computer or network access requests will need approval from a supervisor or sponsor in the user’s chain-of-command. Individuals may require certain privileges in order do their job. The most common approvals are access to department or branch folders or directories, special applications, or access to other systems, certain utilities, or even Administrator’s access, and remote access.

Supervisors will know what resources their subordinates need in order for them to do their jobs. They should list what resources are needed for the employee and update as necessary.

SUMMARY. In this lesson, we showed how to distinguish between different security controls, identify steps to protect each security control, and recognize security incidents when they occur. Remember, it is your responsibility to report anything out of the ordinary. You are a key control in the security of the DOJ.

- Security clearance. Anyone requiring system access must minimally have a background security clearance initiated. Contractors and volunteers who need system access may not have a background clearance initiated, so a NACI may need to be procured and started (further information can be obtained from the Personnel office). To verify clearance, the supervisor or program manager sponsoring the contractor must obtain the NACI case number and date from the Personnel office.

- Attended a security awareness briefing. In accordance with access standards, all users must attend a Security Awareness briefing before accessing the system. Awareness training can be in the form of the Information Security portion of the Annual Refresher Training, the Security Awareness portion of the New Employee Orientation or Institution Familiarization, ad hoc security briefings, or other training as approved by the local Information Security Officer. The course should be documented to show the user’s proof of attendance.

- Acknowledged the “Rules of Behavior for the system. All government systems are required to produce a statement of rules for users to abide by in order to ensure the proper operation of the system and to address security issues.

# Users are required to read and acknowledge these rules before access is granted.

# Those individuals who have Administrative privileges will be required to acknowledge an additional set of rules that especially pertains to this unique kind of access.

- Signed a non-disclosure agreement (non-BOP employees only).

Contractors, volunteers, interns, and other non-BOP employees will need to sign a non-disclosure agreement if access to information systems is required. This agreement assists in safeguarding BOP information and ensures outside parties are aware of their responsibilities regarding our agency’s information. A non-disclosure agreement may already be part of the individual’s contractual agreement.

" Documenting System Access (HelpDesk). Upon fulfilling these requirements, the supervisor or sponsor will initiate a HelpDesk request or ticket for the user to access the system. This request is usually entered into BMC Service Desk Express system for processing. Evidence of fulfilling the System Access requirements are input into the system. The local ISO then processes the request and provides system credentials (USERID and passwords) to the user.

" Duty Status Changes and System Access Changes. Whenever there is a change in an employee’s duty status, such as new arrivals, departures, retirements, separations, or special duty assignments, Employee Services will notify the ISO of such changes at least 24 hours before the change is to occur. Supervisors who become aware that an employee’s duty status will change should contact their local ISO. The ISO will disable the account as required by policy. System Administrators need to prevent unauthorized access. Individuals retiring, transferring, or separating from employment should be promptly removed from the system in order to protect the integrity of the data.

! Protecting sensitive information " Handling. Share sensitive information on a “need to know” basis only " Storage. Lock up or secure sensitive information when not in use.

" Labeling. BOP sensitive information should be labeled “Sensitive But

Unclassified–SBU.” This includes both electronic media and paper documents.

" Disposal. When it is no longer needed, sensitive information should be properly disposed of. This includes both electronic media and paper documents. Contact your computer specialist or information security officer for further guidance.

! Personal Use of Government Equipment. Government equipment can be used by an employee if:

- Negligible cost to the government

- Before or after official working hours or during non-paid meal breaks

- Does not adversely affect the performance of official duties

- No inappropriate materials

- Government equipment includes:

# Computers # Printers # Fax machines # Telephones # Copiers

! Processing Bureau SENSITIVE Data From Non-Bureau Locations. The CEO’s written approval is required for processing SENSITIVE data from non-Bureau locations, such as a home, or from remote locations when on official travel. This written approval is also required when removing sensitive material from the workplace.

SUMMARY–In this lesson, we showed how to recognize security violations when they occur and report those incidents. Remember, it is your responsibility to report anything out of the ordinary. You are a key control in the secure and orderly running of an institution.

LESSON 6. INMATES. This lesson will provide an overview of information security in relation to inmates. You will learn Bureau policy on Inmate Access to Computers and Information Systems as well as the role you play and your responsibilities as a Bureau employee to ensure that security is not compromised.

! Inmate access to computer resources is determined by the local facility.

! Inmates may be allowed computer access as part of:

" Program Statement 1315.07 Legal Activities, Inmate

- The Bureau of Prisons affords an inmate reasonable access to legal materials, counsel, and a reasonable opportunity to prepare legal documents. Accessing some legal materials may involve the use of a computer.

" Inmate Education and Training Programs

- Inmates taking part in education and training programs may be afforded the use of computers and computer systems, if approved locally.

" Work Details

- Inmates may be approved to use computers as part of a work detail.

" Special Permission

- Inmates may be given special permission by the local CEO to use a computer as part of a court order or to review legal discovery material.

- In addition, special permission by the local facility can allow an inmate the use of special software tools and utilities. Such software tools may be required as part of an inmate’s work detail, education, or training program.

! Inmates are prohibited from:

" Accessing STAFF ONLY computers " Using computers for personal use not associated with a vocational or training program, or a work detail " Possessing electronic media without the CEO’s permission.

" Possessing or reading prohibited publications " Possessing or using software utilities without prior approval

! STAFF ONLY and Inmate Access Computers " Computer systems used by Bureau employees are distinguished from inmate computer systems by displaying “STAFF ONLY” in a red label.

" Inmate computers and printers must clearly display a blue label marked

“INMATE ACCESS.”

" Any computer not labeled “INMATE ACCESS” is presumed as STAFF ONLY and may not be accessed by inmates.

" Inmates may not access computers or computer systems that are operationally critical, contain SENSITIVE information or attached to a modem or the Internet.

! Inmate Personal Use

" As a general rule, inmates are prohibited from using computers for personal use.

" Only the facility CEO can authorize personal use of computer equipment for inmates, for legal activities, or other correspondence. This includes the use of:

- Printers

- Printing materials

- Electronic media

! Inmate Possession of Electronic Devices " Electronic devices that interfere, or can be configured to interfere, with information systems or a facility’s operation are prohibited.

" Devices considered affecting information systems are, but not limited to:

- Cell Phones

- Any Radio-Frequency Generating Device

- Wireless Computing Devices

- Computer Peripherals ! Prohibited Publications

" Information Technology (IT) magazines, books, and other publications that supply information on the computer underground or other such malicious activities are prohibited.

" Examples:

- The Hacker Quarterly

- Hacking % The Art of Exploitation

- Windows Hacking % Even You Can Hack

- Mind Hacks % Tips and Tools

SUMMARY–In this lesson, we explained how to distinguish between authorized and unauthorized inmate access to computer systems, identify areas inmates are not allowed, and be familiar with the requirements for monitoring inmates in areas computers are located. It is important to be aware of an inmate’s activities and be alert when an inmate is accessing computer systems.