Policy and Planning

Current Standards

Security

IT Standards and Policies
Current Standards

ITD Standard STD005-98 March 3, 1998

Strategy

Security policies and standards cover the physical and electronic access to information as well as the transmission, storage, and processing of information. Security measures will be taken to prevent unauthorized modification or the destruction of critical information or systems. Implementation of security measures must also protect the confidentiality of the sensitive data from unauthorized access. Risks associated with unauthorized access should be analyzed and balanced against the cost of protecting the information to ensure that business activities are not unduly hindered or unnecessary costs incurred. The owning agency shall identify the security requirements of their information based on legal requirements and agency policy and will authorize access to the data on a need-to-know basis. Maintaining the security of the data is a joint responsibility between Information Technology Department, state agencies, and their customers who access the data.

Policy

• All computers that share data or are connected to the network shall have current virus protection software implemented if commercially available.
• Written backup and recovery procedures should exist for all critical agency data. (This is also in the data management standard)
• Disaster recovery plans shall be required for all mission critical systems. (addressing requirement for data redundancy and alternate processing)
• The number of conduits through the state system firewall shall be strictly controlled to maintain the integrity/security of the firewall.
• ITD will provide firewall and dial-up services in order to create a "trusted" state network. (The Network Security Policy, N004-97)
• ITD shall maintain secure FTP service and WEB servers to reduce conduits through the firewall.
• All agencies should implement an internal agency security policy to document users' responsibilities for protecting technology resources.
• Mission critical computer processors and related equipment shall be located in a physically secured environment.
• The authentication of users on limited access systems and trusted networks shall be required.
• Login IDs should be assigned on an individual basis. Passwords should not be shared.
• Confidential data should be encrypted when transmitted.
• Unauthorized access attempts should be logged and monitored.
• All network security violations should be reported to ITD.
• Identify requirements for field, record or application level security and choose products which support the requirements

Standards

RACF (Resource Access Control Facility) - mainframe

RAID technology for redundancy

C2 level security or higher on servers requiring restricted access.

Encryption Direction

Authentication Direction

Revision Date
Approved: March 3, 1998