proc9000-1397-SOP.doc

SBA Procedural Notice

This is a reminder to all SBA telecommuters including those that connect to the Internet through a Digital Subscriber Line (DSL), Cable modem, or other means. DSL and Cable modem connections generally represent a greater hacker threat than dial-up connections when used for telecommuting. Threats to all types of Internet connections can be reduced by using the appropriate security tools and techniques. The following SBA security requirements for telecommuters are based on guidance found at: http://csrc.nist.gov/publications/nistpubs/index.html in NIST Special Publication 800-46, Security for Telecommuting and Broadband Communications:

The actions listed below are those that SBA telecommuters must take to secure their telecommuting and home networking resources in order to protect the confidentiality, availability, and integrity of SBA’s information.

· All computers used in telecommuting and are connected to the Internet all of the time must have a firewall device installed. Using a personal firewall on your PC helps to stop an intruder from accessing the data on your PC through the Internet. It does this by keeping unauthorized persons or data from entering or exiting the PC. High-quality, low-cost and no-cost personal firewalls can be downloaded from the Internet at: www.webattack.com/freeware/security/fwfirewall.shtml. These personal firewalls are easy to set up on a home PC.

· Anti-virus software must be installed on the home PC and set up to scan all incoming files and e-mail. The virus database file should be updated at least weekly. Most commercial anti-virus programs are sold with annual subscriptions that include weekly virus database updates. Low-cost and no-cost anti-virus software can be downloaded from the Internet at: www.webattack.com/freeware/security/fwvirus.shtml.

· SBA information must be stored so that it is not accessible by other family members. Information should be stored on removable media or in a password protected directory or file.

The actions listed below are those that SBA telecommuters should take to secure their telecommuting and home computing resources in order to protect the confidentiality, availability, and integrity of SBA’s information.

· The browser should always be updated with the latest and most secure version when it becomes available and cookies should be disabled.

· Operating system set up options that increase security should be selected. File and printer sharing should always be disabled. Patches should be up-to-date. NIST SP 800-47 and the different operating system vendors have information for securing home PCs. A copy of NIST SP 800-47 can be found at: http://csrc.nist.gov/publications/nistpubs/index.html

· Wireless networking devices should not be used since the encryption software is easily broken.

· Spyware should be removed. Spyware is any technology that aids in gathering information about a person or organization without their knowledge. Spyware, while usually not intended to be malicious, reports information on users (generally without their knowledge) to a third party. This information could be general information about the system or specifics on web browsing habits. A variety of programs are available for detecting and removing spyware. No-cost or low-cost, reliable spyware removal software can be downloaded from the Internet at: www.webattack.com/freeware/security/fwcookie.shtml The benefits and risks of telecommuting are here to stay. Computing resources and access to office networks while on the road or working from home are essential, but access procedures must include security awareness and methods. While there will always be risks associated with remote access to SBA’s resources, most of these can be mitigated by implementing these requirements and recommendations, and following secure telecommuting practices.

Supervisors of telecommuters please ensure that your employees read and understand this policy before approving their telecommuting agreement. This notice is in addition to, but does not supercede SOP 33 59 1, Telecommuting.

If you require additional information, please contact Lewis Baskerville on (202) 401-1980 or Joyce Lewis on (202) 205-6318

Lawrence E. Barrett

Chief Information Officer

EXPIRES: 12/1/2003

SBA Form 1353.3 (12-93) PerForm Version; previous editions obsolete.

Must be accompanied by SBA Form 58.