Policy

Network Device Passwords

A compromised password on a network device could have devastating network-wide consequences. Passwords that are used to secure these devices, such as routers, switches, and servers, must be held to higher standards than standard user-level or desktop system passwords.

​

Password Construction

The following statements apply to the construction of passwords for network devices:

• Passwords should be at least 8 characters long

• Passwords should be composed of a mix of uppercase and lowercase letters, numerals and special characters (punctuation marks and symbols)

• Passwords should not be comprised of, or otherwise utilize, words that can be found in a dictionary

• Passwords should not contain an obvious keyboard sequence (i.e., qwerty or 1qaz)

• Passwords should not include "guessable" data such as personal information like birthdays, addresses, phone numbers, locations, etc.

​

Failed Logons

Repeated logon failures can indicate an attempt to 'crack' a password and surreptitiously access a network account. In order to guard against password-guessing and brute-force attempts, the company must lock a user's account after 5 unsuccessful logins. This can be implemented as a time-based lockout or require a manual reset, at the discretion of the IT Manager.

​

In order to protect against account guessing, when logon failures occur the error message transmitted to the user must not indicate specifically whether the account name or password were incorrect. The error can be as simple as "the username and/or password you supplied were incorrect."

All login attempts, whether successful or not should be logged in a location that can be accessed on demand. Audit log entries should contain as much identifying information about the event as possible, including date and time accurate to the second.

​

Change Requirements

Passwords must be changed according to the company's Password Policy. Additionally, the following requirements apply to changing network device passwords:

• If any network device password is suspected to have been compromised, all network device passwords must be changed immediately.

• If a company network or system administrator leaves the company, all passwords to which the administrator could have had access must be changed immediately, and all uniquely-identifiable accounts should be disabled if possible. This statement also applies to any consultant or contractor who has access to administrative passwords.

• Vendor default passwords must be changed when new devices are put into service.

​

Password Policy Enforcement

Where passwords are used a mechanism must be implemented that enforces the company's password policies on construction, changes, re-use, lockout, etc.

​

Administrative Password Guidelines

As a general rule, administrative (also known as "root") access to systems should be limited to only those who have a legitimate business need for this type of access. This is particularly important for network devices, since administrative changes can have a major effect on the network, and, as such, network security. Additionally, administrative access to network devices should be logged.

Logging

The logging of certain events is an important component of good network management practices. Logging needs vary depending on the type of network system, and the type of data the system holds. The following sections detail the company's requirements for logging and log review.

​

Application Servers

Logs from application servers are of interest since these servers often allow connections from a large number of internal and/or external sources. These devices are often integral to smooth business operations.

​

Examples: Web, email, database servers

​

Requirement: All login attempts, whether successful or failed should be logged. No passwords should be contained in logs.

​

Network Devices

Logs from network devices are of interest since these devices control all network traffic, and can have a huge impact on the company's security.

​

Examples: Firewalls, network switches, routers

​

Requirement: All login attempts, whether successful or failed should be logged. No passwords should be contained in logs.

​

Critical Devices

Critical devices are any systems that are critically important to business operations. These systems may also fall under other categories above - in any cases where this occurs, this section shall supersede.

​

Examples: File servers, lab or manufacturing machines, systems storing intellectual property

​

Requirements: All login attempts, whether successful or failed should be logged. No passwords should be contained in logs.

​

Log Management

While logging is important to the company's network security, log management can become burdensome if not implemented appropriately. As logs grow, so does the time required to review the logs. For this reason, the company recommends that a log management application be considered.

​

Log Review

Device logs do little good if they are not reviewed on a regular basis. Log management applications can assist in highlighting important events. Log review should be conducted on a regular basis as defined by the company.

​

Log Retention

Logs should be retained in accordance with the company's Retention Policy. Unless otherwise determined by the company, logs should be considered operational data.

Firewalls

Firewalls are arguably the most important component of a sound security strategy. Internet connections and other unsecured networks must be separated from the company network through the use of a firewall.

​

Configuration

The following statements apply to the company's implementation of firewall technology:

• Firewalls must provide secure administrative access (through the use of encryption) with management access limited, if possible, to only networks where management connections would be expected to originate.

• No unnecessary services or applications should be enabled on firewalls. The company should use 'hardened' systems for firewall platforms, or appliances.

• Clocks on firewalls should be synchronized to an authoritative time source with the company's other networking hardware using NTP or another means. Among other benefits, this will aid in problem resolution and security incident investigation.

• The firewall ruleset must be documented and audited on at least an annual basis. Audits must cover each rule, what it is for, if it is still necessary, and if it can be improved or removed.

• For its own protection, the firewall ruleset must include a "stealth rule," which forbids connections to the firewall itself.

​

Outbound Traffic Filtering

Firewalls are often configured to block only inbound connections from external sources; however, by filtering outbound connections from the network, security can be greatly improved. This practice is also referred to as "Egress Traffic Filtering."

​

Blocking outbound traffic prevents users from accessing unnecessary, and many times, dangerous services. By specifying exactly what outbound traffic to allow, all other outbound traffic is blocked. This type of filtering would block root kits, viruses, and other malicious tools if a host were to become compromised.

​

The company requires that permitted outbound traffic be limited to only known "good" services, which are the following ports: 53 (DNS), 80 (web), and 443 (secure web). All other outbound traffic must be blocked at the firewall unless an exception is granted from authorized IT personnel.

​

On devices where it is available, the use of content filtering technology must be employed to protect against accidentally browsing to malicious and inappropriate websites within the company network.

Networking Hardware

Networking hardware, such as routers, switches, hubs, bridges, and access points, should be implemented in a consistent manner. The following statements apply to the company's implementation of networking hardware:

• Networking hardware must provide secure administrative access (through the use of encryption) with management access limited, if possible, to only networks where management connections would be expected to originate.

• Clocks on all network hardware should be synchronized using NTP or another means. Among other benefits, this will aid in problem resolution and security incident investigation.

• Switches as opposed to hubs should always be used unless an extenuating circumstance mandates the use of a hub (extremely rare on modern networks). When using switches the company should use VLANs to separate networks if it is reasonable and possible to do so.

• Access control lists must be implemented on network devices that prohibit direct connections to the devices. Connections to the router should be limited to the greatest extent possible. Exceptions to this are management connections that can be limited to known sources.

• Unused services and ports must be disabled on networking hardware.

• Access to administrative ports on networking hardware must be restricted to known management hosts and otherwise blocked with a firewall or access control list.

• Cloud-managed network hardware systems must be secured to only allow authorized IT personnel to access the management interface.

Network Servers

Servers typically accept connections from a number of sources, both internal and external. As a general rule, the more sources that connect to a system, the more risk that is associated with that system, so it is particularly important to secure network servers. The following statements apply to the company's use of network servers:

• Unnecessary files, services, and ports should be removed or blocked. If possible, follow a server-hardening guide, which is available from the leading operating system manufacturers.

• Network servers, even those meant to accept public connections, must be protected by a firewall or access control list.

• If possible, a standard installation process should be developed for the company's network servers. This will provide consistency across servers no matter what employee or contractor handles the installation.

• Clocks on network servers should be synchronized with the company's other networking hardware using NTP or another means. Among other benefits, this will aid in problem resolution and security incident investigation.

Intrusion Detection/Intrusion Prevention

Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) technology can be useful in network monitoring and security. The tools differ in that an IDS alerts to suspicious activity whereas an IPS blocks the activity. When tuned correctly, IDSs are useful but can generate a large amount of data that must be evaluated for the system to be of any use. IPSs automatically take action when they see suspicious events, which can be both good and bad, since legitimate network traffic can be blocked along with malicious traffic.

​

The company requires the use of either an IDS or IPS on critical or high-risk network segments. If an IDS is used, procedures must be implemented to review and act on the alerts expediently. If an IPS is used, procedures must be implemented that provide a mechanism for emergency unblocking if the IPS obstructs legitimate traffic. Also, if an IPS is used, it should be audited and documented according to the standards detailed in the "Firewalls" section of this document.

Security Testing

Security testing, also known as a vulnerability assessment, a security audit, or penetration testing, is an important part of maintaining the company's network security. Security testing can be provided by IT personnel, but is often more effective when performed by a third party with no connection to the company's day-to-day Information Technology activities. The following sections detail the company's requirements for security testing.

​

Internal Security Testing

Internal security testing does not necessarily refer to testing of the internal network, but rather testing performed by members of the company's IT team. Internal testing should not replace external testing; however, when external testing is not practical for any reason, or as a supplement to external testing, internal testing can be helpful in assessing the security of the network.

​

Internal security testing is allowable, but only by employees whose job functions are to assess security, and only with permission of the IT Manager. Internal testing should have no measurable negative impact on the company's systems or network performance.

​

External Security Testing

External security testing, which is testing by a third party entity, is an excellent way to audit the company's security controls. The IT personnel in conjunction with the company should determine to what extent this testing should be performed, and what systems/applications it should cover.

​

External testing must not negatively affect network performance during business hours or network security at any time.

As a rule, "penetration testing," which is the active exploitation of company vulnerabilities, should only be engaged as required to satisfy regulatory compliance. If penetration testing is performed, it must not negatively impact company systems or data.

​

The company requires that external security testing be performed at minimum once per year.

Disposal of Information Technology Assets

IT assets, such as network servers and routers, often contain sensitive data about the company's network communications. When such assets are decommissioned, the following guidelines must be followed:

• Any asset tags or stickers that identify the company must be removed before disposal.

• Any configuration information must be removed by deletion or, if applicable, resetting the device to factory defaults.

• At a minimum, data wiping must be used. Data wiping procedures must adhere to the guidelines set forth in Section 4 of the Confidential Data Policy.

Network Compartmentalization

Good network design is integral to network security. By implementing network compartmentalization, which is separating the network into different segments, the company will reduce its network-wide risk from an attack or virus outbreak. Further, security can be increased if traffic must traverse additional enforcement/inspection points. The company requires the following with regard to network compartmentalization:

​

Higher Risk Networks

Examples: Guest network, wireless network

​

Requirements: Segmentation of higher risk networks from the company's internal network is required, and must be enforced with a firewall or router that provides access controls.

​

Externally-Accessible Systems

Examples: Email servers, web servers

​

Requirements: Segmentation of externally-accessible systems from the company's internal network is required, and must be enforced with a firewall or router that provides access controls.

​

Internal Networks

Examples: Sales, Finance, Human Resources

​

Requirements: Segmentation of internal networks from one another can improve security as well as reduce chances that a user will access data that he or she has no right to access. The company requires that networks be segmented to the fullest reasonable extent.

Network Documentation

Network documentation, specifically as it relates to security, is important for efficient and successful network management. Further, the process of regularly documenting the network ensures that the company's IT personnel has a firm understanding of the network architecture at any given time. The intangible benefits of this are immeasurable.

​

At a minimum, network documentation must include:

• Network diagram(s)

• System configurations

• Firewall ruleset

• IP Addresses

• Access Control Lists

• Authorized users and devices

​

The company requires that network documentation be performed as systems are implemented, changed or reviewed; and updated on a regular basis.

Endpoint Protection

Computer viruses and malware are pressing concerns in today's threat landscape, and the rise of ransomware attacks is particularly troublesome for all modern organizations. If a machine or network is not properly protected, a virus outbreak or crypto-attack can have devastating effects on the machine, the network, and the entire company. The company provides the following guidelines on the use of endpoint protection software:

• All company-provided user workstations must be installed with a suitable endpoint protection software product.

• The endpoint protection must provide antivirus/anti-malware detection and prevention capability.

• If available, the endpoint protection software must also provide intrusion prevention and web content filtering.

• Endpoint protection software must maintain a current "subscription" to receive patches and virus signature/definition file updates.

• Patches, updates, and signature file updates must be installed in a timely manner, either automatically or manually. Updates should be installed at minimum every 4 hours.

• The use of artificial intelligence-driven “behavior analysis” technology such as EDR to proactively detect and defend against threats using distributed intelligence is strongly recommended. This may become a requirement in a future revision of this policy.

• In addition to the workstation requirements, virus and malware scanning must be implemented at the Internet gateway to protect the entire network from inbound threats.

Software Use Policy

Software applications can create risk in a number of ways, and thus certain aspects of software use must be covered by this policy. The company provides the following requirements for the use of software applications:

• Only legally licensed software may be used. Licenses for the company's software must be stored in a secure location.

• Open source and/or public domain software can only be used with the express consent of the company and authorized IT personnel.

• Software should be kept up-to-date by installing new patches and releases from the manufacturer. Most patches do not need to be installed immediately after release, but should be scheduled on a regular basis, preferably once per month.

• Vulnerability alerts should be monitored for all software products that the company uses. Any patches that fix vulnerabilities or security holes must be installed expediently.

Maintenance Windows and Scheduled Downtime

Certain tasks require that network devices be taken offline, either for a simple re-boot, an upgrade, or other maintenance. When this occurs, the IT personnel must perform the tasks outside of normal business hours. Tasks that are deemed "emergency support," as determined by IT personnel, may be performed at any time with the coordination and consent of the company.

Change Management

Documenting changes to network devices is a good management practice and can help speed resolution in the event of an incident. The IT Staff must document hardware and/or configuration changes to network devices in a "change log." Network devices must bear a sticker or tag indicating essential information, such as the device name, IP address, MAC address, asset information, and any additional data that may be helpful, such as information about cabling.

Suspected Security Incidents

When a security incident is suspected that may impact a network device, the IT Staff should refer to the company's Incident Response policy for guidance.

Redundancy

Redundancy can be implemented on many levels, from redundancy of individual components to full site-redundancy. As a general rule, the more redundancy implemented, the higher the availability of the device or network, and the higher the associated cost. The company wishes to provide IT personnel with latitude to determine the appropriate level of redundancy for critical systems and network devices. Redundancy should be implemented where it is needed, and may include some or all of the following:

• Hard drive redundancy, such as mirroring or RAID (typically for servers only)

• Server level redundancy, such as clustering or high availability

• Component level redundancy, such as redundant power supplies or redundant NICs

• Keeping hot or cold spares onsite

Manufacturer Support Contracts

Outdated products can result in a serious security breach. When purchasing critical hardware or software, the company wherever possible must purchase a maintenance plan, support agreement, or software subscription that will allow the company to receive updates to the software and/or firmware for a specified period of time. The plan must meet the following minimum requirements:

• Hardware: The arrangement must allow for repair/replacement of the device within an acceptable time period, as determined by authorized IT personnel, as well as firmware or embedded software updates.

• Software: The arrangement must allow for updates, upgrades, and hotfixes for a specified period of time.

Security Policy Compliance

It is the company's intention to comply with this policy not just on paper but in its everyday processes as well. With that goal in mind the company requires the following:

​

Security Program Manager

An employee must be designated as a manager for the company's security program. He or she will be responsible for the company's compliance with this security policy and any applicable security regulations.  This employee must be responsible for A) the initial implementation of the security policies, B) ensuring that the policies are disseminated to employees, C) training and retraining of employees on the company's information security program (as detailed below), D) any ongoing testing or analysis of the company's security in compliance with this policy, E) updating the policy as needed to adhere with applicable regulations and the changing information security landscape.

​

Security Training

A training program must be implemented that will detail the company's information security program to all users and/or employees covered by the policy, as well as the importance of data security. Employees must sign off on the receipt of, and in agreement to, the user-oriented policies. Re-training should be performed at least annually.

​

Security Policy Review

The company's security policies should be reviewed at least annually. Additionally, the policies should be reviewed when there is an information security incident or a material change to the company's security policies. As part of this evaluation the company should review:

• Any applicable regulations for changes that would affect the company's compliance or the effectiveness of any deployed security controls.

• If the company's deployed security controls are still capable of performing their intended functions.

• If technology or other changes may influence the company's security strategy.

• If any changes need to be made to accommodate future IT security needs.

Applicability of Other Policies

This document is part of the company's cohesive set of security policies. Other policies may apply to the topics covered in this document and as such the applicable policies should be reviewed as needed.