State of Alaska Office of Information Technology Effective:

Information Security Policies Last Review:

Title: Information Security Framework Next Review: Per policy Number: ISP-001 Version: 1.1 Approved by: CIO Pages 9 Distribution: SOA

SOA Internal Page 1 of 9

1. Purpose The State of Alaska (SOA) is responsible for the information assets (e.g., information and information systems and telecommunication systems) it creates, manages, processes, stores, or transmits in order to carry out its functions. The SOA must safeguard these assets from any threats to their confidentiality, integrity, and availability. This document establishes the framework of the Information Security Management System (ISMS) of the SOA, including the ISMS scope and policy. Each branch and agency of the SOA is responsible for the day-to-day management of information security practices and arrangements in accordance with this framework.

2. Statutory Authority Under Alaska Statute (AS) 44.21 et. Seq., the Department of Administration is assigned responsibility for statewide Executive Branch automated data processing and telecommunication support.

The Governor’s Administrative Order 284 (AO 284) establishes the statewide Office of Information Technology (OIT) to be housed within the Department of Administration. The AO further establishes the position of Chief Information Officer (CIO), with designated authority for all telecommunication and information technology services within the SOA Executive Branch.

Records owned by executive branch agencies are subject to oversight as designated by the Commissioner of their respective department as specified in AS 44.17. Record retention requirements are subject to comply with State archivist statutes AS 40.21. OIT sets and enforces digital information security, privacy, and protection standards and practices assuring all SOA information assets.

3. Policy Scope This policy is applicable to the SOA executive branch, departments, divisions, corporations, commissions, or other related entities which will be referred to as Department(s).

4. Definitions Terms in this document are defined in the SOA policy ISP-002 Information Security Glossary.

Office of Information Technology Information Security Policies Title: Information Security Framework Number: ISP-001

SOA Internal Page 2 of 9

5. Framework Scope

5.1. Organization

This information security policy framework applies to all personnel including full-time, part-time and temporary employees, contractors, consultants, vendors, auditors, and other personnel engaged to perform work for or on behalf of the SOA, and collectively are referred to herein as “personnel” The information security policy framework further applies to the executive branch, legislative branch, judicial branch, corporations and commissions of the SOA and to the departments of those branches as illustrated in Figure 1 – Overview of State of Alaska Organization.

EXECUTIVE

BRANCH

LEGISLATIVE

BRANCH

JUDICIAL

BRANCH

Department of Administration

Department o f Commerce, Community & Econ omic

Development

Department of Corrections

Department o f Education & Early

Development

Department o f Environmental Conservation

Department o f Fish and Game

Office of the Governor

Department of Health

Department of Labor & Workforce

Development

Department o f Military &

Veteran’s Affairs

Department o f Natural

Resources

Department of Public Safety

Department of Revenue

Department of Transportation & Public

Facilities

Alaska Legislature

Alaska Court System

Department of Law

Department o f Family & Community Services

Figure 1 – Overview of State of Alaska Organization

5.2. Locations

This information security policy framework applies to all of the locations owned, leased, or otherwise occupied by the SOA and all logical access to SOA internal networks.

5.3. Assets and Technology

This information security policy framework applies to all the information the SOA creates, manages, processes, stores, or transmits and to all the information systems, which include computer systems, applications, networks, peripherals, or electronic media used to develop manage, and operate all SOA informational processes.

5.4. Limitations and Exclusions

This information security policy framework applies to information assets, in any form, throughout the information system and information technology lifecycle and to any stage of an activity, function, project, or product involving information assets. SOA branches, departments, divisions, agencies, corporations and commissions must adapt this framework to the needs of their organizations and fundamentals in accordance with the policy established herein and any applicable legal and regulatory requirements.

6. Policy

6.1. Information Security Strategy

Information Security Policies Title: Information Security Framework Number: ISP-001

SOA Internal Page 3 of 9

6.1.1 Essential and Sanctioned Function

The confidentiality, integrity, and availability of information and related internal controls are essential functions of the SOA, collectively referred to as "information security."

6.1.2 Requirement for Information Security Controls

Information security functions and administrative, technical, and physical controls are considered essential and are sanctioned by the SOA as a proactive service in keeping with industry best practice.

6.2. Establishment and Responsibility

6.2.1 Establishment of Information Security Management System (ISMS) This framework establishes and serves as the charter for the SOA ISMS. The SOA ISMS supports the planning, implementation, monitoring, and improvement of security controls in concert with the information handling, processes, services and technology infrastructure supported and provided by the SOA.

6.2.2 Program Authority

The SOA has designated the State Security Office (SSO) as the single point of authority responsible for establishing the ISMS including information security strategy, policies, and controls.

To demonstrate Executive Management’s commitment to the ISMS, Executive Management must:

Establish the commitment of Departments to the information security policy process;

Determine their organization’s approach to managing information security;

Ensure that appropriate plans and budgets are in place to support the information security objectives of the SOA;

Establish, approve, publish, and communicate the SOA information security policies;

Assign responsibility and accountability for information security, including responsibility for protection of individual assets (i.e., Information Owners) and carrying out specific security processes appropriately within the department;

Establish the requirement for a formal, on-going information security training and awareness program within the department;

Assign responsibility for internal audits of the ISMS and ensuring that such audits are performed and reported appropriately to Executive Management and the SSO;

Ensure that necessary corrective and preventative actions are taken to identify, mitigate, and eliminate potential threats to department information assets; and

Identify any potential exception to information security policy, communicating the exception to the SSO, and coordinating the appropriate activities and controls to reduce risk related to any such exceptions.

6.2.3 Information Owners and Custodians

Personnel defined as Information Owners must define the protective requirements for the information assets for which they are responsible, in accordance with SOA policies and applicable legal and regulatory requirements, and must ensure that assigned Information Custodians implement and maintain appropriate safeguards to protect those information assets.

Information Security Policies Title: Information Security Framework Number: ISP-001

SOA Internal Page 4 of 9

6.2.4 Individual Accountability

All personnel are responsible for protecting SOA information assets from all unauthorized access, modification, duplication, destruction, or disclosure. Personnel will be accountable for their actions and will apply due diligence to information asset security. Violations of unauthorized access, modification, duplication or disclosure may result in disciplinary action up to and including dismissal and/or criminal or civil prosecution in accordance with SOA or Federal statutes.

6.3. Security Principles

6.3.1 Awareness

Executive Management must ensure that all personnel have access to information security policies, standards, procedures, and practices. Executive Management must also ensure that ongoing training is conducted, under the guidance of the SSO, to ensure personnel awareness of responsibilities in safeguarding information assets.

6.3.2 Ethics

Executive Management must ensure that access to SOA information assets is granted for approved SOA purposes only. Personnel must use and administer information in an ethical manner. The SOA reserves the right to employ appropriate technologies and procedures to ensure that its information assets are used in an acceptable and ethical manner, in order to ensure the security of SOA information assets.

6.3.3 Safeguard by Default

Persons must safeguard information assets in accordance with SOA data classification schemes. When the classification of an information asset is unknown personnel must safeguard the asset as “confidential” until the classification has been determined.

6.3.4 Need to Know

Personnel who have access to data are prohibited from perusing data unrelated to assigned tasks or projects.

6.3.5 Applicable Law

Personnel must comply with all applicable laws and regulations with respect to the collection, storage, safeguarding, appropriate use, and disposal of information assets in accordance with SOA or Federal Statutes.

6.4. Asset Management

6.4.1 Asset Inventory and Classification

Executive Management must identify information assets and document the confidentiality, integrity, and availability requirements to determine a classification level for each asset.

6.4.2 Control According to Classification

Executive Management must ensure that controls are applied to safeguard information assets consistent with the classification level of the asset.

Information Security Policies Title: Information Security Framework Number: ISP-001

SOA Internal Page 5 of 9

6.5. Incident Management

6.5.1 Incident Reporting

Personnel must report known or suspected information asset security compromises or violation incidents, in a timely manner, according to incident reporting policies and procedures defined by the SOA.

6.5.2 Incident Response

The SSO must establish policies and procedures to identify, evaluate, contain, and address suspected information asset security compromises or violation incidents. The SSO must establish an organizational structure and a process to review the results of information asset security compromises or violation incident responses and implement corrective actions.

6.6. Risk Management

6.6.1 Risk Assessment

Executive Management must establish and implement a risk assessment process to identify and evaluate potential risks to SOA information assets.

6.6.2 Risk Treatment

Executive Management must regularly review the results of risk assessments and must establish and implement risk treatment plans to prioritize, evaluate, and address risks to SOA information assets identified as a result of those assessments.

6.7. Compliance

6.7.1 Compliance

Compliance with information security policies is critical to the secure functionality of the SOA business. The SOA is obligated to function with ethical and confidential management of all information assets.

6.7.2 Implications of Non-compliance

Non-compliance with information security policies may lead to disciplinary actions up to and including termination of employment. Under certain circumstances, violations of information security policies may give rise to civil and/or criminal liability. The SOA may also pursue legal action as deemed appropriate against third parties for unauthorized access, use or destruction of information assets.

6.7.3 Information Systems Compliance

Personnel must report any information asset that is found to be non-compliant with SOA information security policies to the SSO for exception handling in accordance with information security policies.

Information Security Policies Title: Information Security Framework Number: ISP-001

SOA Internal Page 6 of 9

7. Policy Framework

7.1. Framework Diagram

Executive Management must implement support of the ISMS policy established in section 6 above, and further information security policies, standards, procedures, and practices to ensure that safeguards are applied to all SOA information assets, consistent with the framework illustrated in Figure 2 – State of Alaska Framework Diagram.

Figure 2 – State of Alaska Framework Diagram

Information Security Policies Title: Information Security Framework Number: ISP-001

SOA Internal Page 7 of 9

7.2. Reference Standard(s)

The primary reference standard employed in the SOA Information Security Framework is the international standard ISO/IEC 27001:2005, Information technology – Security techniques – Information security management systems – Requirements, published by the International Organization for Standardization (ISO) in October 2005. Secondary reference standards include the National Institute of Standards and Technology (NIST) Special Publication 800 series and the international standard ISO/IEC 27002:2005, Information technology – Security techniques – Code of practice for information security management, published by the ISO in June 2005.

8. Security Governance Organization Structure The SOA CIO has established the following security organization responsible for ensuring that SOA ISMS is implemented in accordance with this framework.

8.1. State of Alaska Chief Information Officer (CIO)

Alaska Statute 44.21 designates DOA as the department responsible for the operation and management of telecommunication and information technology data processing resources and activities of the executive branch of State government and the judicial and legislative branches to the extent requested by those branches. DOA is required to provide for periodic review State telecommunication and information technology data processing procedures and mechanisms.

The Commissioner of DOA holds the authority, as the CIO, for the executive branch agencies, corporations, and commissions. The CIO has maintained various governance boards and work groups to provide recommendations and assist in the fulfillment of statutory requirements.

These groups include the Enterprise Investment Board (EIB), the Technology Management Council (TMC), the Incident Response Team (IRT), and the SSO. Responsibilities of the CIO include:

Determining policy requirements consistent with the needs of the SOA and approving information security policies developed by the SSO;

Ensuring adequate funding and staffing of the SSO and other roles of the SOA security organization; and

Reviewing any exceptions to information security policies recommended by the SSO.

8.2. State of Alaska Security Office (SSO)

The SSO, led by the CSO under authority delegated by the CIO, is responsible for establishing, implementing, monitoring, auditing, improving and enforcing the SOA ISMS. Specific responsibilities must include:

Developing, coordinating approval, enforcing and communicating information security strategic plans, policies and implementing procedures, standards and solutions in support of the plans and policies;

Supporting the CIO, EIB, TMC, Functional Work Groups (FWGs), and other SOA organizations as necessary to further the security objectives of the SOA;

Presenting information security issues, policy changes and exceptions, and recommendations to the CIO or EIB;

Providing the management, leadership, coordination and support for the security activities of the executive branch department Information Security Officers (ISOs) and department Computer Security Designees (CSDs);

Providing coordination and support for the activities of the security liaisons of the legislative and judicial branches;

Information Security Policies Title: Information Security Framework Number: ISP-001

SOA Internal Page 8 of 9

Approving, coordinating and overseeing security related investments, improvements, solutions and services for the SOA, audits, incident response analysis and best practices;

Providing technical assistance to the Division of Personnel and Labor Relations on employee related matters;

Acting as the single point of contact for the executive branch departments, agencies, divisions, corporations or commissions for the collection and delivery of electronic data for public record requests, email holds and legal discoveries;

Acting as a point of contact for executive branch on non-criminal related information security issues with special interest groups and entities, including U.S Federal Government, US-CERT(Computer Emergency Readiness Team), Federal Bureau of Investigations (FBI), Secret Service, Alaska State Troopers, Multi-State Information Sharing and Analysis Center (MS-ISAC), InfraGard, National Emergency Numbering Association (NENA), State or local government, private industry, or others;

Coordinating and conducting independent risk assessment activities for the ISMS;

Coordinating and conducting training and awareness activities for the ISMS;

Planning and implementing controls, evaluating, recommending and implementing the selection of solutions, and participating in the development of the information technology strategies of the SOA to ensure consistency with SOA information security policies, procedures and standards and the goals and objectives of the State;

Coordinating the activities and provide Incident Command (IC) for the incident response team and the SOA forensic investigation team;

Monitoring information security, performing independent audits of the operation of the ISMS, and reporting on the State of information security to SOA Executive Management;

Reviewing the results of risk assessments, monitoring activities, audits, incident response, and investigations;

Directing corrective and preventative actions for all information security policies; and Assisting in the performance of risk assessments.

8.3. Enterprise Investment Board (EIB)

The EIB serves as the governance board for the SOA, which is responsible for assisting the CIO in IT governance and setting information security policy and reviewing the ISMS. It is comprised of the Governor’s Chief of Staff, the director of the Office of Management and Budget, the Commissioner of DOA (CIO), a representative from the administrative services directors, and the director of ETS. The EIB meets as deemed necessary. Security related responsibilities include:

Ensuring consistency of departments’ IT;

Managing on an enterprise model in accordance with SOA standards; and Approving information security policies developed by the SSO and presented by the

CIO.

8.4. Technology Management Council (TMC)

The TMC is chaired by the director of ETS. The SSO makes presentations and recommendations to the TMC on security related matters on an “as needed” basis. Security related responsibilities for the TMC include:

Recommending enterprise class technology standards to meet the ISMS;

Providing subject matter expertise in the form of functional workgroups (FWG) to the

CIO, EIB and the SSO;

Participating in supporting the CIO, EIB, and the SSO activities for the ISMS; and

Information Security Policies Title: Information Security Framework Number: ISP-001

SOA Internal Page 9 of 9

Monitoring and reporting on the implementation of technology standards and the operation of controls that ensure executive branch agencies, corporations and commissions are adhering to the standards established by ISMS information security policies.

8.5. Incident Response Team (IRT)

The SOA IRT is directed by the SSO and staffed by subject matter experts identified by the SSO. The IRT meets quarterly to plan, review issues and receive domain-specific training. IRT is convened by the SSO in support of incident response activities and planning. Specific responsibilities include:

Providing subject matter expertise to the SSO and other members of the IRT;

Assisting in the assessment, investigation, containment, remediation and planning of security or disaster related incidents; and Assisting in the development of preventative or corrective actions and continuity of operational activities related to information security.

Information Security Policies Last Review:

Title: Information Security Glossary Next Review: Per policy Number: ISP-002 Version: 1.05 Approved by: CIO Pages 21 Distribution: SOA

SOA Internal Page 1 of 21

1. Purpose To define the terms used within State of Alaska (SOA) information security policies.

2. Statutory Authority Under Alaska Statute (AS) 44.21 et. Seq., the Department of Administration is assigned responsibility for statewide Executive Branch automated data processing and telecommunication support.

The Governor’s Administrative Order 284 (AO 284) establishes the statewide Office of Information Technology (OIT) to be housed within the Department of Administration. The AO further establishes the position of Chief Information Officer (CIO), with designated authority for all telecommunication and information technology services within the SOA Executive Branch.

Records owned by executive branch agencies are subject to oversight as designated by the Commissioner of their respective department as specified in AS 44.17. Record retention requirements are subject to comply with State archivist statutes AS 40.21. OIT sets and enforces digital information security, privacy, and protection standards and practices assuring all SOA information assets.

3. Policy Scope This policy is applicable to the SOA executive branch, departments, divisions, corporations, commissions, or other related entities which will be referred to as Department(s).

4. Definitions Terms used throughout the SOA Information Security Policies are defined within this document.

5. Statement Glossary Definitions This is a list of textual specialized terms used in the Information Security Policies, with the definitions for those terms.

5.1.1 802.11x A family of wireless networking protocols.

5.1.2 Access Control

The principle of limiting access to information assets only to appropriate individuals. See also: Information Assets

5.1.3 Access Rights

The ability granted to personnel authorized for the access to information assets. See also: Information Assets

5.1.4 Administrative Account

A specific category of account on an information system characterized by heightened privilege. See also: Information System

Information Security Policies Title: Information Security Glossary Number: ISP-002

SOA Internal Page 2 of 21

5.1.5 Administrative Security Controls

A type of security control implemented primarily via administrative mechanisms. See also: Security Controls

5.1.6 Advanced Encryption Standard (AES)

An encryption standard adopted by the U.S. government.

5.1.7 Adware

A specific category of malware categorized by unwanted commercial advertising. See also: Malware

5.1.8 AES

Advanced Encryption Standard.

5.1.9 Alaska Public Safety Information Network (APSIN)

A collection of system servers, devices or networks which processes, stores and transports regulated law enforcement information.

5.1.10 Application Security

The process of governing the information security aspects of the applications supported by a particular information system. See also: Information System

5.1.11 APSIN

Alaska Public Safety Information Network.

5.1.12 Asset

A resource owned, managed, or held in trust by SOA. See also: Information Asset

5.1.13 Asset Classification

See Classification

5.1.14 Audit

A formal methodical examination of an organization or individual’s accounts or financial situation.

5.1.15 Authentication

The process of validating a user’s claimed identity using one or more authentication factors. See also: Identity Management, Authentication Factors

5.1.16 Authentication Factor

A piece of information and process used to authenticate or verify the identity of a person or other entity requesting access under security constraints. A specific category of authentication criteria encompassing a vehicle from one of the following three categories:

what you have, what you are, what you know. See also: Authentication

5.1.17 Availability

Indicates a property of information assets, information systems, and other resources whereby appropriate personnel, systems, or other entities have the ability to readily access resources without impedance. See also: Information Asset, Information System

Information Security Policies

SOA Internal Page 3 of 21

5.1.18 Backup

The creation of a duplicate or copy of an information asset.

5.1.19 Bastion

A fortified area or position.

5.1.20 Botnet

A specific category of malware characterized by remote control of numerous information systems for illicit (and often illegal) purposes. See also: Malware

5.1.21 Business Management

Day-to-day operations and maintenance of service, systems, solution or programs that are provided to the various State departments and directed by the Business Manager and Business Owners.

5.1.22 Business Manager

A person, designated by a Business Owner, who is responsible for the service role of function.

5.1.23 Business Owner

Normally a Director level position, which holds the accountability and responsibility for the delivery and day-to-day operations and maintenance of a service, system, solution or program that the State provides.

5.1.24 CED

See Department of Commerce, Community and Economic Development.

5.1.25 Chain of Custody

Refers to the chronological documentation, and/or paper trail, that show the seizure, custody, control, transfer, analysis, and disposition of evidence, physical or electronic.

May help establish that the alleged evidence is related to the alleged crime.

5.1.26 Chief Information Officer (CIO)

The executive branch authority for information technology and telecommunications solutions and services within the SOA Government. The Commissioner of the Department of Administration holds this authority, responsibility, role, and function under

AS 44.21.

5.1.27 Chief Security Officer (CSO)

The executive branch authority, delegated by the CIO, responsible for establishing, implementing, monitoring, auditing, improving and enforcing the SOA ISMS.

5.1.28 CIO

Chief Information Officer.

5.1.29 CJIS

Criminal Justice Information System (CJIS).

Information Security Policies

SOA Internal Page 4 of 21

5.1.30 Classification

The process of segregating assets into groups according to priority, risk, or information assets processed. See also: Risk, Information Asset, Asset

5.1.31 Compensating Control

Compensating controls give organizations an alternative to security requirements that cannot be met "due to legitimate and documented technical or business constraints."

Compensating controls must sufficiently mitigate the risk associated with the original control requirements.

5.1.32 Compliance

The process that ensures adherence to governing regulation, legislation, contractual requirements, or industry best practice.

5.1.33 Compromise

A violation of the confidentiality, integrity and availability of an information system or information asset. See also: Confidentiality, Integrity and Availability, Information System, Information Asset

5.1.34 Confidential

The classification level ascribed to the most sensitive of information assets containing information whereby unauthorized disclosure could be prejudicial to SOA, its employees, personnel and citizens. See also: Classification and SOA Internal

5.1.35 Confidentiality

A property of information assets, information systems, and other resources whereby access is limited only to personnel and entities authorized to view the information or access the resource. See also: Information Asset, Information System

5.1.36 Continuity of Operation Plan (COOP)

The creation of the documentation and process which allows for the continuation of the essential functions of government departments or agencies during any incident or emergency that may disrupt normal operations.

5.1.37 COOP

Continuity of Operation Plan.

5.1.38 Corrective Action

A plan or process (usually consisting of one more security controls) designed to address a specific vulnerability, threat, or area of risk to an information asset. See also:

Information Asset, Security Control, Vulnerability, Threat, Risk.

5.1.39 Courtroom Admissibility

The ability for evidence to be presented within a court of law by the support of digital forensics refers to the requirement that the chain of custody be maintained and appropriate procedures are followed to preserve evidence integrity. See also: Forensics

5.1.40 Cryptographic Key

A confidential data value used as input to a cryptographic operation. See also:

Encryption

Information Security Policies

SOA Internal Page 5 of 21

5.1.41 CSO

Chief Security Officer.

5.1.42 Data

Numerical or other information represented in a form suitable for processing by computer.

5.1.43 Data Wipe

The process to render information assets unreadable through erasure and subsequent multiple overwrites. See also: Information Disposal

5.1.44 DEC

See Department of Environmental Conservation.

5.1.45 Defense Information Systems Agency (DISA)

Department of Defense (DoD) combat support agency with the goal of providing real-time information technology (IT) and communications. DISA plans, engineers, acquires, and supports IT products and services for the US president, vice president, secretary of defense, and all DoD agencies. Specifically, it provides communications networks, hardware, software, databases, applications, and other IT capabilities to meet the information processing and communication transport needs of the DoD.

5.1.46 Degaussing

The process to render information assets unreadable via exposure to a sufficiently-strong magnetic field or pulse. See also: Information Disposal

5.1.47 Department(s)

All SOA branches, departments, divisions, corporations, commissions or other related entities.

5.1.48 Department of Administration (DOA)

State of Alaska Department of Administration.

5.1.49 Department of Commerce, Community & Economic

Development (CED) State of Alaska Department of Commerce, Community & Economic Development.

5.1.50 Department of Corrections (DOC)

State of Alaska Department of Corrections.

5.1.51 Department of Education & Early Development (EED)

State of Alaska Department of Education & Early Development.

5.1.52 Department of Environmental Conservation (DEC)

State of Alaska Department of Environmental Conservation.

5.1.53 Department of Fish and Game (DFG)

State of Alaska Department of Fish and Game.

Information Security Policies

SOA Internal Page 6 of 21

5.1.54 Department of Health & Social Services (HSS)

State of Alaska Department of Health & Social Services.

5.1.55 Department of Labor & Workforce Development (DOL)

State of Alaska Department of Labor & Workforce Development.

5.1.56 Department of Law (LAW)

State of Alaska Department of Law.

5.1.57 Department of Military & Veteran’s Affairs (DMVA)

State of Alaska Department of Military & Veteran’s Affairs.

5.1.58 Department of Natural Resources (DNR)

State of Alaska Department of Natural Resources.

5.1.59 Department of Public Safety (DPS)

State of Alaska Department of Public Safety.

5.1.60 Department of Revenue (DOR)

State of Alaska Department of Revenue.

5.1.61 Department of Transportation & Public Facilities (DOT) State of Alaska Department of Transportation & Public Facilities.

5.1.62 DFG

See Department of Fish and Game.

5.1.63 DISA

Defense Information Systems Agency.

5.1.64 DMVA

See Department of Military & Veteran’s Affairs.

5.1.65 DNR

See Department of Natural Resources.

5.1.66 DNS

Domain Name System.

5.1.67 DOA

See Department of Administration.

5.1.68 DOC

See Department of Corrections.

5.1.69 DoD 5220-22.0

The Federal Department of Defense (DoD) guidelines for disposal of electronic equipment and data. ftp://ftpguest:ftpguest@transfer.state.ak.us/diskcleaner/dban

Information Security Policies

SOA Internal Page 7 of 21

5.1.70 DOL

See Department of Labor & Workforce Development.

5.1.71 Domain Name System (DNS)

A system that translates names into the numerical (binary) identifiers associated with network equipment for the purpose of locating and addressing these devices world-wide.

See also: Network Address

5.1.72 DOR

See Department of Revenue.

5.1.73 DOT

See Department of Transportation & Public Facilities.

5.1.74 DPS

See Department of Public Safety.

5.1.75 EED

See Department of Education & Early Development.

5.1.76 Electronic Mail (commonly referred to as Email/E-mail) A method of exchanging two-way high-speed electronic information communications across the Internet or other computer networks.

See also: Electronic Messaging System

5.1.77 Electronic Messaging System

A communication system whose purpose is to provide efficient means for two-way high-speed electronic information communications.

5.1.78 Electronically Stored Information (ESI)

Information that is stored electronically, regardless of the media or format.

5.1.79 Encryption

A technical security control used to protect the confidentiality of an information asset.

See also: Information Asset, Confidentiality, Technical Security Control

5.1.80 Environmental Threat

A type of threat associated with the environment in which an asset, facility, or resource is located and may be compromised or exposed to a security violation. See also: Threat

5.1.81 EPHI

Electronically Protected Health Information (EPHI).

5.1.82 ESI

Electronically Stored Information.

5.1.83 ESI Hold

An ESI hold preserves electronically stored information related to the criteria selected until released. ESI holds can be placed for a variety of reasons. For example, an ESI hold may be placed to assist in fulfilling a public records request, legal discovery, or an investigation.

Information Security Policies

SOA Internal Page 8 of 21

5.1.84 Event Log

Chronological records produced by a telecommunication or information technology system concerning the access, attempted access, operational changes, or other internal operating system or application functionality to include changes and access occurring to the data that resides on, or facilitated by, the system.

5.1.85 Executive Employee

The following persons are executive employees: (1) the Executive Branch employees defined as “public officials” in AS 39.50.200(a)(9); and (2) the persons employed in the following job classifications:

Assistant Commissioner Executive Director Assistant Director Labor Relations Manager State Accountant State Leasing and Facilities Manager Department of Public Safety Liaison Chief, Worker’s Compensation Adjudication Veterans Affairs Administrator Administrator, Violent Crimes Compensation Board Administrator, Highway Safety Planning Agency Marine Highway Transportation Services Manager

Positions placed in the partially exempt service under AS 39.25.130(a) (1) or (2) will be added to this list.

5.1.86 Executive Management

Senior or top-level management, with statutory authority to make business, financial, and operational decisions and changes within an SOA department, corporation or commission. These are generally exempt commissioner office positions that hold the liability for department functions, service programs or other activity of department staff.

5.1.87 Externally-Facing Systems

Information systems characterized by their accessibility by users on the public Internet or on non-SOA networks. See also: Information System

5.1.88 Fair Use

Doctrine in United States copyright law that allows limited use of copyrighted material without requiring permission from the rights holders 17 USC § 107.

5.1.89 Federal Information Processing Standard (FIPS)

The current standard of conformance for modules implementing cryptographic algorithms and security functions. Conformance is managed through the Cryptographic Module Validation Program under NIST Computer Security Resource Center.

5.1.90 Financial Account Number

A numeric or alphanumeric group of identifiers where potential financial harm could occur to an owner if it is disclosed to an unauthorized person.

5.1.91 FIPS

Federal Information Processing Standard.

Information Security Policies

SOA Internal Page 9 of 21

5.1.92 Firewall

Software deployed on an information system for the purpose of limiting network connectivity to that asset. See also: Information System

5.1.93 Forensics

The application of scientific examination of evidence to determine information about a crime or other event.

5.1.94 Flaw

An imperfection, defect or unaccountable inconstancy capable of jeopardizing the integrity of a system.

5.1.95 Geopolitical Threat

A type of threat associated with the politics of a region in which an asset, facility, or resource is located (for example, civil unrest). See also: Threat

5.1.96 GOV

See Office of the Governor.

5.1.97 HIPS

Host-Based Intrusion Prevention System.

5.1.98 Host-Based Intrusion Prevention System (HIPS)

A software package, network application, or other system designed to proactively detect and prevent intrusions.

5.1.99 HSS

See Department of Health & Social Services.

5.1.100 Identity Management

A formalized process for identifying, governing, and maintaining the user identifiers assigned to individuals and the rights associated with those identifiers. See also: User Identifier

5.1.101 IDS

Intrusion Detection System

5.1.102 Incident Reporting

The specific process of informing appropriate personnel in response to a security incident. See also: Security Incident

5.1.103 Incident Response

The process of taking appropriate action to a security incident. See also: Security Incident

5.1.104 Information

The communication or reception of knowledge or intelligence in written, electronic or oral communication form.

Information Security Policies

SOA Internal Page 10 of 21

5.1.105 Information Asset

Information owned, held in trust, stewarded or otherwise maintained by the SOA for any purpose. See also: Information System, Information Owner

5.1.106 Information Custodians

A person, as prescribed by their information owner, who must implement and maintain appropriate safeguards to protect those information assets.

5.1.107 Information Disposal

The process of appropriately decommissioning information assets in a manner that preserves confidentiality as required. See also: Information System, Information Asset, Confidentiality

5.1.108 Information Owner

A person, as prescribed by their Business Manager, who must define the protective requirements for the information assets for which they are responsible, in accordance with SOA policies and applicable legal and regulatory requirements, and must ensure these requirements are clearly communicated to the Information Custodian.

5.1.109 Information Processing Facility

A physical location, (e.g. data center, or specially designated area) that is used for the purpose of housing information systems and/or storing, processing, or transmitting information assets. See Information Asset, Information System

5.1.110 Information Security

The protection of information assets and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity and availability.

5.1.111 Information Security Management System (ISMS)

A formalized methodology for managing information security processes, oversight, and governance within an organization.

5.1.112 Information System

A discrete set of information resources organized for the collection processing, maintenance, use, sharing, dissemination, or disposition of information.

5.1.113 Information Technology (IT)

Any equipment or interconnected system or sub system of equipment used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency.

5.1.114 Information Type

Indicates a specific category of information (e.g., privacy, medical, proprietary, financial, investigative, contractor sensitive, security management), defined by an organization, by a specific law, Executive Order, policy or regulation.

5.1.115 Ingress/Egress

Ingress: Network traffic that originates from outside of the network’s routers and proceeds toward a destination inside of the network; or

Information Security Policies

SOA Internal Page 11 of 21

Egress: Network traffic that begins inside of a network and proceeds through its routers to a destination somewhere outside of the network.

5.1.116 Integrity

The property of information assets, information systems, and other resources, whereby the reliability of the asset is ensured of its adherence to a code of ethical truth, through the implementation of protections against unauthorized tampering, modification, or corruption. See also: Information Asset, Information System.

5.1.117 Intrusion Detection System (IDS)

Software or hardware designed to detect unauthorized attempts at accessing, manipulating, or disabling computer systems, mainly through a network, such as the Internet.

5.1.118 Intrusion Prevention System (IPS)

A network security device that monitors network and/or system activities for malicious or unwanted behavior and can react, in real-time, to block or prevent those activities. This technology is considered by some to be an extension of intrusion detection (IDS) technology.

5.1.119 IPS

Intrusion Prevention System

5.1.120 ISMS

Information Security Management System. See also: Information Security Management System.

5.1.121 IT

Information Technology.

5.1.122 Kazaa

A peer-to-peer data sharing package. See also: Peer-to-Peer Network

5.1.123 Kludge or Kludgy

A system, especially a computer system, that is constituted of poorly matched elements or of elements originally intended for other applications; or a clumsy or inelegant solution to a problem.

5.1.124 Labeling

The process of attaching, associating or designating data classification to a container, system, or information asset. See also: Classification, Information System, Information Asset

5.1.125 LAN

Local Area Network

5.1.126 LAW

See Department of Law.

Information Security Policies

SOA Internal Page 12 of 21

5.1.127 Least Privilege

An access control methodology characterized by granting the minimum required privilege to users to accomplish their duties. See also: Access Control

5.1.128 Limewire

A peer-to-peer data sharing package. See also: Peer-to-Peer Network

5.1.129 Local Area Network (LAN)

A communications network connecting various hardware devices together within a building by means of a continuous cable or an in-house voice-data telephone system.

5.1.130 MAC Address

A network-unique hardware identifier used by layer-2 communication protocols.

5.1.131 Major Revision

Process of a product upgrade which could involve a software version improvement or service pack advancement on software from any security flaws.

5.1.132 Malicious Software

Software designed to circumvent one or more security controls and/or create damage that would compromise security.

5.1.133 Malware

Software designed to interfere with a computer’s normal function. See also: Malicious Software

5.1.134 Malware Prevention Software

Software deployed for the purposes of finding and removing malicious software. See also: Malicious Software

5.1.135 Minor Revision

Process of a product update to keep pace with the most recent software effectiveness, which could involve security patches to fix a flaw in the software.

5.1.136 Mobile Code

Software characterized by the ability to transmit itself across network boundaries for remote execution.

5.1.137 NAT

Network Address Translation.

5.1.138 Need to Know

“Need-to-know” means an individual has a business reason to access or share information.

5.1.139 Network Address

A unique identifier assigned to a device for the purpose of routing network packets. See also: Unique Identifier

Information Security Policies

SOA Internal Page 13 of 21

5.1.140 Network Address Translation (NAT)

NAT (Network Address Translation or Network Address Translator) is the translation of an Internet Protocol address (IP address) used within one network to a different IP address known within another network. One network is designated the inside network and the other is the outside. Typically, a company maps its local inside network addresses to one or more global outside IP addresses and unmaps the global IP addresses on incoming packets back into local IP addresses. This helps ensure security since each outgoing or incoming request must go through a translation process that also offers the opportunity to qualify or authenticate the request or match it to a previous request. NAT also conserves on the number of global IP addresses that a company needs and it lets the company use a single IP address in its communication with the world.

5.1.141 Network Security

A process of governing information security aspects of wired and wireless network, transport, and data communications pathways.

5.1.142 Network Sniffer

A software utility or a device used to passively eavesdrop, collect or analyze information packets on a network.

5.1.143 Network Time Protocol (NTP)

A TCP/IP protocol used to synchronize the real-time clock in computers, network devices and other electronic equipment that is time sensitive. It is also used to maintain the correct time in NTP-based wall and desk clocks.

5.1.144 Non-repudiation

A concept of ensuring that a party in a dispute cannot repudiate, or refute the validity of a statement or contract. Although this concept can be applied to any transmission, including television and radio, the most common application is in the verification and trust of signatures.

5.1.145 NTP

Network Time Protocol.

5.1.146 Office of the Governor (GOV)

State of Alaska Office of the Governor.

5.1.147 Open Web Application Security Project (OWASP)

OWASP is an open-source application security project. The OWASP community includes corporations, educational organizations, and individuals from around the world.

This community works to create freely-available articles, methodologies, documentation, tools, and technologies. OWASP advocates approaching application security by considering the people, process, and technology dimensions.

5.1.148 Operating System Security

The process of governing the information security aspects of the operating system installed on a particular information system. See also: Information System

5.1.149 OWASP

Open Web Application Security Project

Information Security Policies

SOA Internal Page 14 of 21

5.1.150 Password Cracker

A software utility or a device used for the purpose of obtaining passwords – usually via brute force. See also: Authentication

5.1.151 Payment Card Industry Data Security Standard (PCI DSS) Industry self-regulation governing the information security aspects of storing, processing, or transmitting information related to payment processing.

5.1.152 PCI DSS

Payment Card Industry Data Security Standard. See also: Payment Card Industry Data Security Standard

5.1.153 Peer-to-Peer Network

A distributed data sharing network often times used to share copyrighted music, software, and movies.

5.1.154 Personally Identifiable Information (PII)

An "individual's name", which means a combination of an individual's first name or first initial; and last name; and one or more of the following information elements:

The individual's social security number;

The individual's driver's license number State identification card number;

The individual's account number;

Credit card account number;

Debit card account number; or Financial account passwords or access codes.

5.1.155 Personnel

Employees, partners, contractors, consultants, temporaries, other SOA workers and workers affiliated with third parties or anyone having access to SOA information that is not directly accessible to the general public from a non-SOA network (e.g. Internet).

5.1.156 Physical Security Controls

A type of security control implemented primarily via physical mechanisms. See also:

Security Controls

5.1.157 Physical Threat

A type of threat associated with the physical parameters of an asset, facility, or resource.

See also: Threat

5.1.158 PII

Personal Identifiable Information.

5.1.159 PKI

Public Key Infrastructure Cryptographic Algorithm.

5.1.160 Policy Exception

A formalized written statement granting one or more processes, information systems, personnel, or other entities the license to continue performing activities on behalf of the

Information Security Policies

SOA Internal Page 15 of 21 organization for a defined period of time despite known areas of noncompliance with defined information security policy. See also: Information System

5.1.161 Policy Statement

A formalized statement detailing the requirements, mandates, and strictures to be used within the organization.

5.1.162 Post Mortem Report

A report created after a security incident violation detailing all specific events related to the security incident. See also: Security Incident

5.1.163 Privacy

The property of confidentiality ascribed to a particular information asset. See also:

Confidentiality, Information Asset

5.1.164 Private Key

The portion of a cryptographic key within a public key cryptosystem that must be kept secret and not shared with others. See also: Public Key Cryptosystem, Cryptographic Key, Public Key

5.1.165 Prohibited

To forbid, by authority, access to any established list, objective or action; such as in reference to forbidden sites – e.g. pornographic, gambling, etc.

5.1.166 Proxy Server

Is a computer within the networks system that acts as an intermediary for requests from users seeking resources from other servers. A user connects to the proxy server, requesting some service, such as a file, connection, web page, or other resource, available from a different server. The proxy server evaluates the request according to its filtering rules. If the request is validated by the filter, the proxy server provides the resource by connecting to the relevant server and requesting the service on behalf of the user.

5.1.167 Public

The classification level ascribed to assets that have been specifically approved for access to the general public. See also: Classification

5.1.168 Public Key

The portion of a cryptographic key within a public key cryptographic algorithm that may be…