Attachment__7_Cyber_Security.docx

Attachment 7 Cyber Security Controls Checklist

This is a simple checklist designed to identify and document the existence and status for a recommended basic set of cyber security controls (policies, standards, and procedures) for an organization. Security controls are designed to reduce and/or eliminate the threat/vulnerabilities that place an organization at risk.

PERSONNEL SECURITY

1. Do employees wear ID badges?

2. Is a current picture part of the ID badge?

3. Are authorized access levels and types (employee, contractor, and visitor) identified on the Badge?

4. Do you check the credentials of external contractors?

5. Do you have policies addressing background checks for employees and contractors who are granted facilities access?

6. Do you have a process for effectively cutting off access to facilities and information systems when an employee/contractor terminates employment?

PHYSICAL SECURITY

7. Do you have policies and procedures that address allowing authorized and limiting unauthorized physical access to electronic information systems and the facilities in which they are housed?

8. Do your policies and procedures specify the methods used to control physical access to your secure areas, such as door locks, access control systems, security officers, or video monitoring?

9. Is access to your computing area controlled (single point, reception or security desk, sign-in/sign-out log, temporary/visitor badges)?

10. Are visitors escorted into and out of controlled areas?

11. Are your PCs inaccessible to unauthorized users (e.g. located away from public areas)?

12. Is your computing area and equipment physically secured?

13. Are there procedures in place to prevent computers from being left in a logged-on state, such as setting screens to automatically lock after 10 minutes idle?

14. Do you have policies covering laptop security (e.g. cable lock or secure storage)?

15. Do you have procedures for protecting data during equipment repairs?

16. Do you have an emergency evacuation plan and is it current?

17. Does your plan identify areas and facilities that need to be sealed off immediately in case of an emergency?

18. Are key personnel aware of which areas and facilities need to be sealed off and how?

19. Procedures are in place to allow only authorized individuals to remove IT equipment or media from the facilities.

20. Employees store unclassified removable media out of view after normal working hours.

21. Computers are set up so others cannot view staff entering passwords.

Office computers are facing away from the desk, keyboards are located under desk.

Backbone Security

22. Transmission facility components such as modems, multiplexors, amplifiers, repeaters, PBXs, channel banks, boosters, and concentrators are located in areas to prevent accidental or malicious interruption of service or unauthorized use.

23. The Security Officer maintains locks and electronic sensors on the information processing facility entrances or computer room entrances which are protected at a minimum with spin-dial or dead-bolt locks and an intrusion detection system. Inactive doors must be secured which may be done from the inside with a deadbolt lock (SM-181). These locks are secured at the end of each day. The computer room (server room) is also protected with a push-button lock (Simplex, Unican) which is engaged anytime the room is unattended.

24. The computer room, which houses the servers, central data storage and critical networking devices, is classified as a restricted area for authorized personnel only. A list of authorized individuals is posted outside the door and signed by the facility manager. Individuals not on the computer room Access Control List (ACL) sign the visitors log prior to their access to the computer room. Non-cleared visitors to the computer room are under continuous visual observation by a person with authorized unescorted access.

25. The system manager maintains server room visitor logs for six (6) consecutive months.

26. The computer room equipment power panels are located in an area with adequate protection to prevent accidental or malicious interruption of power to the computer room.

27. The power distribution panels that supply the computer room equipment indicate the equipment served by the panels.

28. An emergency power-off switch is in a readily accessible location outside the main server room door. The switch must have a plastic cover to prevent accidental triggering. The emergency power-off switch also disconnects power to the server room ventilation system.

29. The system manager has identified a secure storage location for backup media that is a reasonable distance from the server room and is protected from extreme environmental conditions. Backups transported off site are encrypted to ensure data confidentiality.

30. The systems manager updates and tests contingency plans annually or when major modifications to the network occur.

31. The computer room and media storage room perimeter walls extend from the structural floor to the structural ceiling. All penetrations must be sealed to maintain environmental integrity.

32. Openings larger than 90 square inches (585 sq. cm) in the perimeter walls of the computer room and the media storage room is securely screened with 12-gauge expanded metal.

33. The fire detection alarms, air conditioning and humidity controls are fully functioning for server rooms.

34. IT Staff offices are equipped with push-button locks which are used whenever the workspaces are unattended.

35. Computer room door combinations are changed at least every 6 months. Combinations are changed immediately when an employee departs or after a security incident involving a lock combination.

36. The system manager ensures a log is maintained of all maintenance or service performed on the AIS. System staff documents within the operations log any abnormal system operations that may result in unauthorized disclosure, loss, or modification of system programs or data.

37. System managers ensure that systems on the network have sufficient redundant control capabilities to reduce single points of failure, enhance reliability and survivability, and provide excess capacity.

ACTIVE DIRECTORY / ACCOUNT AND PASSWORD MANAGEMENT

38. Are group and guest user IDs and passwords are prohibited?

39. Do user accounts follow a standard naming convention? ex: LastFIMI (Last = last name, FI – first initial, MI = middle initial)

40. Do administrator accounts follow a standard naming convention? ex: xxxadmlogon (xxx = location or site code, logon = the user's logon name)

41. The system manager ensures that Admin accounts are not being used to surf the Internet or to perform routine e-mail functions.

42. Does the IT staff make all users aware of the private nature of their passwords when issued?

43. Do system administrators delete user accounts immediately when a user's employment has been terminated?

44. Are user accounts not members of administrator groups?

45. Are service accounts located only in the Service Account OU?

46. Are system access requests, password receipts, and security acknowledgement forms kept for 6 months past the user's departure?

47. Are initial passwords distributed to users in a secure manner which prevents disclosure to other individuals?

48. Do you require that passwords have minimum complexity requirements (minimum length, numbers, special characters, no sequences)?

49. Does the system manager ensure that personnel do not configure the default parameters of any software to permanently store their user ID and password on the computer?

50. Are all passwords required to expire after a set amount of time?

51. Are all built in administrator accounts disabled?

52. Are computers positioned to prevent unauthorized viewing of monitors and password entry?

53. Do program managers and office managers annually review access privileges of each user under their supervision to verify the privileges originally granted are still appropriate?

54. Does the system manager review and maintain the list of remote access users on an annual basis to ensure accuracy?

55. The system manager ensures all required system access, maintenance, audit and operation logs are maintained for all facilities (1) Authorized access lists for AIS facilities; (2) Visitors logs for the main computer room; (3) System access requests; (4) Password receipts / security acknowledgements; (5) System maintenance logs; (6) Audit logs; and (7) System operation logs

General

56. The system manager ensures that all new releases, upgrades, or patches to information systems are applied.

57. The system manager maintains an inventory of approved software and hardware.

58. Computer support and operations documentation includes a current list of workstations (including stand-alone), printers, servers, and other network devices. The list should include the office location, cable/device number, and switch/router port number.

59. The system manager ensures that computers with non-removable storage media (i.e., fixed disks) and those with nonvolatile memory are located within a locked office, suite or container.

60. The systems manager ensures that only organization-owned hardware and software, including removable media are used on the organization’s systems.

61. The system manager ensures all removable media is scanned for viruses on a standalone system before being introduced to the network.

62. The systems manager ensures that all software used on the network is fully licensed. Software updates, transfers, and maintenance are within the terms of the licensing agreements.

63. The systems manager ensures that all systems connected to the network have anti-virus software installed and maintained.

64. The systems manager ensures software security patches are applied in an expeditious manner.

65. All laptops are encrypted to FIPS 140-2 standards for data at rest.

66. Any wireless networks are properly implemented according to WLAN Security Standard published by DS/SI/CS.

CONFIDENTIALITY OF SENSITIVE DATA

67. Do you classify your data, identifying sensitive data versus non sensitive?

68. Are you exercising responsibilities to protect sensitive data under your control?

69. Is the most valuable or sensitive data encrypted?

70. Do you have a policy for identifying the retention of information (both hard and soft copies)?

71. Do you have procedures in place to deal with credit card information?

72. Do you have procedures covering the management of personal private information?

73. Do you have procedures for disposing of waste material?

74. Is waste paper binned or shredded?

75. Does your paper shredder comply with NSA recommendations for destruction of classified information?

76. Do your policies for disposing of old computer equipment protect against loss of data (e.g.. by reading old disks and hard drives)?

77. Do your disposal procedures identify appropriate technologies and methods for making hardware and electronic media unusable and inaccessible (such as shredding CDs and DVDs, electronically wiping drives, burning tapes) etc.)?

78. The system manager controls access to system administration software or other specialized system software, utilities, and functionality that could be used to gain unauthorized access to application data and program code. Access is limited to the minimum number of authorized users required to accomplish their duties.

DISASTER RECOVERY

79. Do you have a current business continuity plan?

80. The system manager has documented a full backup procedure for system programs and information to ensure continuity of operations.

81. Do you have an emergency/incident management communications plan?

82. Do you have a procedure for notifying authorities in the case of a disaster or security incident?

83. Does your procedure identify who should be contacted, including contact information?

84. Is the contact information sorted and identified by incident type?

85. Does your procedure identify who should make the contacts?

86. Have you identified who will speak to the press/public in the case of an emergency or an incident?

87. Does your communications plan cover internal communications with your employees and their families?

SECURITY AWARENESS AND EDUCATION

88. Are you providing information about computer security to your staff?

89. Do you provide training on a regular recurring basis?

90. Are employees taught to be alert to possible security breaches?

91. Are your employees taught about keeping their passwords secure?

92. Are your employees able to identify and protect classified data, including paper documents, removable media, and electronic documents?

93. Does your awareness and education plan teach proper methods for managing credit card data (PCI standards) and personal private information (Social security numbers, names, addresses, phone numbers, etc.)?

COMPLIANCE AND AUDIT

94. Do you review and revise your security documents, such as: policies, standards, procedures, and guidelines, on a regular basis?

95. Do you audit your processes and procedures for compliance with established policies and standards?

96. Do you test your disaster plans on a regular basis?

97. Does management regularly review lists of individuals with physical access to sensitive facilities or electronic access to information systems?