9000-1830-SOP.docx

SBA Policy Notice g 11/5/9612/31/96

This policy establishes the standards that SBA network users must follow when using wireless communications. Abiding by this policy will ensure SBA networks remain secure.

This policy applies to all SBA employees, contractors, and other personnel who are authorized to access any part of the SBA computing infrastructure.

Violations of this policy may result in the loss of or limitation on the use of SBA information resources. It may also result in disciplinary and/or legal action, including termination of employment or referral for criminal prosecution.

Background Wireless networks are ever-present, from hotels, home networks, and coffee-shop “hotspots.” They provide for many of us added convenience. These wireless networks are not just limited to internet access. These devices allow us to connect to company and organizational networks providing access to emails, shared files, and enterprise applications. Wireless connectivity improves productivity for mobile workers and teleworkers, and further enables SBA to support its disaster response mission throughout the United States.

Unfortunately, wireless connectivity also adds new vulnerabilities to SBA’s computer networks. Unlike standard wired networks, wireless networks transmit data through radio frequencies, and their transmissions may be intercepted by anyone with the appropriate equipment. Without proper security, data transmitted by a wireless connection is susceptible to interception by unauthorized users. Intruders can exploit this openness by accessing systems, destroying or stealing data, and launching attacks. Potential disruption of network bandwidth and denial of services pose a constant threat to SBA operations.

Portable wireless devices such as laptops and Blackberry handhelds are particularly vulnerable. Such vulnerabilities could lead to the exposure of stored data or unauthorized access to SBA networks. Because of the additional risks that are faced by wireless networks and devices, additional measures will be taken to safeguard wireless connectivity to the SBA network.

SBA is currently in the process of deploying wireless capabilities to enhance our daily operations. While wireless poses a certain degree of risk, the need to affect a better and more capable SBA makes its impending use vital.

Definitions

Authentication: The process of verifying that a user is who he or she purports to be.

Encryption: The process of transforming readable text into unreadable text (cipher text) for the purpose of security or privacy. Data is encrypted to prevent unauthorized access.

Two-factor Authentication: Is a system where two different means of unique personal identification (e.g., password, code key, fingerprint, etc.) are used in conjunction to authenticate a user’s access to a computer or computer network. Using two factors as opposed to one factor generally delivers a higher level of authentication assurance

Virtual Private Network: is a computer network in which the link between locations are formed using the Internet as a communications conduit; however, the data is protected by security encryption to prevent unauthorized access by unauthorized individuals.

Wireless Technology: Any type of connectivity that transmits data without the use of physical cabling. Wireless systems include radio transmissions, satellite links, cell phones, and devices such as wireless headphones. Infrared (IR) devices such as remote controls, cordless computer keyboards, and cordless mouse devices are also examples of wireless technology.

Security Guidelines Wireless connections to the SBA network will follow these basic security guidelines.

Desktop PCs, Laptop, and tablet PCs

· All computers will follow the SBA computer use and security guidelines defined in SOP 90-47-2, SBA Automated Information Systems Security Program.

· No SBA computer will be connected both to a wireless network and to an SBA-wired network simultaneously. This will prevent the “cross-over” of viruses and malware that could potentially affect the SBA network.

· All laptop and tablet computers purchased by SBA must be configured by the Office of the Chief Information Officer (OCIO) or the Office of Disaster Assistance (ODA) personnel.

· All laptop and tablet computers purchased by SBA must be encrypted with standard encryption software: Safeboot™, and Win Magic™, respectively.

· Laptop and tablet computers will use SBA’s standard patch-management and anti-virus software.

· All laptops and computer tablets will use SBA approved firewalls when connected to non-SBA wireless networks.

Kiosks, “hotspots”

· Since public wireless connections are not secure, SBA wireless users must use appropriate Virtual Private Network (VPN) software and two-factor authentication in order to connect to the SBA network.

· Users should be aware that SBA’s VPN software will perform a scan of the local computer prior to VPN activation; wireless connections will be denied if virus or malware elements are detected on the mobile computer.

· User firewalls must be utilized when connected to non-SBA wireless networks.

Personal Digital Assistants (PDAs) (e.g., Blackberry handhelds)

· PDAs will be provisioned, configured, and inventoried through OCIO’s or ODA’s Help Desk.

· SBA will configure PDAs so that they are password-enabled and provide encryption to data stored on the device (that is, “at rest”) and while being transmitted to or from the device (that is, “in motion.”)

· Short messaging service (SMS), PIN-based, and paging features of PDAs may only be used to transmit and receive unclassified or non-sensitive information.

· Bluetooth wireless technology is NOT permitted to be used in the SBA network environment.

Home and personal computers

· SBA network users are prohibited from using any personal computer to connect directly to any SBA network without Virtual Private Network (VPN).

· VPN software must be used for all wireless connections or transmissions to the SBA network utilizing secure Internet connections, i.e., VPN. This implementation must follow the SBA standard, and employ two-factor authentication.

· Government furnished wireless broadband cards may not be installed into home or personal computers. Only the SBA CIO may authorize limited exceptions not to exceed 30 days for natural (earthquakes, hurricanes, etc.) or manmade disasters that would clearly impact SBA’s operational mission in the protection of U.S. Citizens or entities. Replacement government furnished computers will be deployed to the employee as expeditiously as the situation allows.

Wireless access points and routers

· SBA network users shall not procure, or install wireless routers or access points within the SBA network without specific approval and concurrence from SBA OCIO.

· All wireless transmission between an SBA wireless access point or bridge and clients shall be encrypted utilizing the Wi-Fi Protected Access protocol at a minimum to prevent unauthorized access to the SBA network.

Roles & Responsibility SBA network users:

· Follow SBA procedures and guidelines regarding the use of wireless technologies to include connecting to SBA networks from remote locations unless connecting through an SBA-approved VPN solution with two-factor authentication.

· Safeguard SBA information resources and data being accessed or transmitted via any wireless technology by observing the precautions set forth by this policy and SOP 90-47-2.

· Within 24 hours, report the loss or theft of any SBA IT equipment including wireless devices to the SBA CISO.

· Promptly report any known or suspected breaches of wireless security to the CISO.

Chief Information Officer (CIO):

· Responsible for the promulgation of policies and procedures for the protection of all SBA hardware, software, and infrastructure components utilizing wireless technologies.

· Provides direction to all Offices, Directorates, Divisions, and their local and deployed sub-elements with respect to the protection of wireless equipment and data throughout the SBA infrastructure.

· Ensures the protection of all SBA Information Technology (IT) assets that connect to the SBA network via wireless means.

· Develops and maintains wireless standards to ensure the overall SBA mission is conducted expeditiously and securely.

Chief Information Security Officer (CISO):

· Develops, updates, and communicates wireless security policies and procedures to the users of SBA IT resources.

· Ensures all wireless devices connecting to SBA networks adhere to the Wireless Security Policy.

· Coordinates with the Office of Communications Technology Services (OCTS) in ensuring all wireless devices conform to current security procedures and practices.

· Directs OCTS to disable access or service for wireless devices that have been lost, stolen, or pose an imminent threat to SBA operations.

· Conducts monitoring of wireless technologies; ensures any connection to the SBA network abides by appropriate security controls and mitigates risk.

· Ensures the effective issuance of wireless security information to all SBA staff. At a minimum, informs all SBA staff of the existence of wireless policies, and the need to obtain permission from the CISO prior to any implementation of wireless technologies.

Office of Communications Technology Services (OCTS):

· Ensure that acquired wireless devices are approved and registered.

· Maintains an inventory of all SBA approved wireless devices.

· Maintains inventory and setup information of all SBA owned wireless installations.

· Disables access or service for wireless devices that have been lost, stolen, or pose a threat.

This Policy conforms with the following current federal government wireless standards:

· Federal Information Security Management Act of 2002 (FISMA), PL 107-347, December 17, 2002

· OMB Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources, November 28, 2000

· National Institute of Standards and Technology (NIST) Special Publication 800-48 (Revision 1), Guide to Securing Legacy IEEE Wireless Networks

· NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems

· NIST Special Publications 800-97, Establishing Wireless Robust Security Networks: A Guide to IEEE 802.11i

Karen G. Mills Administrator EXPIRES: Page 4 of 5 SBA Form 1353.2 (12-93) MS Word Edition; previous editions obsolete Must be accompanied by SBA Form 58 Federal Recyling Program Printed on Recycled Paper EXPIRES: PAGE 1 of 5 SBA Form 1353.2 (12-93) MS Word Edition; previous editions obsolete Must be accompanied by SBA Form 58 Federal Recyling Program Printed on Recycled Paper image1.wmf oleObject1.bin image2.wmf