From ASD Wiki

ADE - IT Security Policy Compliance

This Alma Wiki page is dedicated to ADE's new IT Security Policy and the steps we've taken to comply with their suggestions.

Section 1 - Security Management

Policy Statement & Standards

District management and IT staff will plan, deploy and monitor IT security mechanisms, policies, procedures, and technologies necessary to prevent disclosure, modification or denial of sensitive information.

1B1 - Security Responsibility

1B2 - Data Sensitivity

1B3 - Training

Section 2 - Physical Security

Policy Statement & Standards

Physical access to computer facilities, data rooms, systems, networks and data will be limited to those authorized personnel who require access to perform assigned duties.

2B1 - Workstation Security

2B2 - Computer Room Security

• Data Center - (1023 Hwy 64 E) Admin Annex
  • Most of our servers and our core switches are located in this recently remodeled building which is home to the Technology Department, Special Education, and the Alma Opportunity School (Alternative).
  • Our leased fibre WAN terminates here
    

• Campus Application & Home Directory Servers
  
  • Servers and core switches located in each school, behind at least two doors which only office personnel are permitted
    • High - Office
    • Middle - Tech Data Center
    • Intermediate - Library
    • Primary - Office

Section 3 - Network Security

Policy Statement & Standards

Network perimeter controls will be implemented to regulate traffic moving between trusted internal (District) resources and external, untrusted (internet) entities. All network transmission of sensitive data should enforce encryption where technologically feasible.

3B1 - Perimeter Security

Internet access to and from our LAN passes through our hardware firewall. And beyond that, the state-provided Cisco Router.

3B2 - Wireless Networks

3B3 - Remote Access

We allow remote Terminal Server access over RDP/High, and allow administrative SSH access to a few SLES hosts.

3B4 - Warning Banners

Novell Client is the workstation client facilitating access to Novell Directory Services, and we present our Acceptable Use Policy as a banner graphic during the network login process.



Except for the graphic, this is a completely unmodified Client32 login.

Click this link to find out how to create your own custom Client32 graphic.

Section 4 - Access Control

Policy Statement & Standards

System and application access will be granted based upon the least amount of access to data and programs required by the user in accordance with a business need-to-have requirement.

4B1 - System Access Controls – Authentication

4B2 - System Access Controls – Authorization

4B3 - System Access Controls – Accounting

4B4 - Administrative Access Controls

Section 5 - Application Development & Maintenance

Policy Statement & Standards

Application development and maintenance for in-house developed student or financial applications will adhere to industry processes for segregating programs and deploying software only after appropriate testing and management approvals.

5B1 - Systems Development

5B2 - Systems Maintenance & Change Control

Section 6 - Incident Management

Policy Statement & Standards

Monitoring and responding to IT related incidents will be designed to provide early notification of events and rapid response and recovery from internal or external network or system attacks.

6B1 - Incident Response Plan

Section 7 - Business Continuity

Policy Statement & Standards

To ensure continuous critical IT services, IT will develop a business continuity/disaster recovery plan appropriate for the size and complexity of District IT operations.

7B1 - Business Continuity Planning

Alma currently utilizes the RSYNC project for backup. More on this backup project and how Alma is implementing it can be found here.

Section 8 - Malicious Software

Policy Statement & Standards

Server and workstation protection software will be deployed to identify and eradicate malicious software attacks such as viruses, spyware, and malware.

8B1 - Malicious Software

• We currently use Kaspersky Enterprise Workstation security, and manage all of our staff workstations with Kaspersky Administration Kit. This allows a centralized point of administration to make sure our staff workstations are protected. Every virus detection is logged by the Admin Kit and email notifications are promptly distributed to the tech staff describing the machine and location. Should it detect more than 15 viruses within 10 minutes, the Admin Kit goes into "virus outbreak" mode and schedules an immediate full file scan on all known workstations, notifies the tech staff via email and catapults the local workstation network scanning policy to full protection. This heightened alert state will subside once the threats have been removed.
• We deploy Faronics DeepFreeze on our student workstations and labs. DeepFreeze power-cycles these machines every afternoon, so if anything malicious is accumulated during the day, it is removed nightly.