Description
Information security configuration management is the process of establishing, documenting, and maintaining the security controls that are in place to protect an organization's information and systems. This Standard will define the scope and frequency of identification and remediation and is included in the NIST Configuration Management control group.
Scope
All systems attached to Lehigh University networks or containing University data should adhere to the defined security configurations. Secure configurations will be maintained by LTS and be the responsibility of the … (Need to exclude student machines)
Security Requirements
NIST 800-171 compliance requires Lehigh to perform the following:
Item 1
Item 2
Item 3
NIST 800-53
SA-22 - Replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer; and Provides justification and documents approval for the continued use of unsupported system components required to satisfy mission/business needs.
PCI compliance requires Lehigh to perform the following:
Develop configuration standards for all system components that address all known security vulnerabilities and are consistent with industry-accepted definitions. Update system configuration standards as new vulnerability issues are identified.
HIPAA compliance requires Lehigh to perform the following:
ePHI environments need to have a number of technical safeguards enabled. These safeguards are enumerated within applicable standards and should be collected within HIPAA compliance guidance documentation.
Implementation
Basic Configuration Standards
Basic configuration standards are broad guidelines that apply to all systems/technologies that are used by the University.
All systems must be in a supported state. Devices, computers, software that is EOL (end of life) and no longer receiving regular vendor security patches needs to be isolated from the University computing environment.
Default accounts and passwords shall be disabled or changed before placing the resource on the network. If you have a vendor installing devices on the network you should include this requirement in your statement of work.
All systems shall be configured to provide the least functionality to meet the need, only essential capabilities (i.e. restricting the use of unnecessary ports, protocols, or services).
Deploy antivirus and anti-malware solutions on all computers, including servers, desktops, laptops, and mobile devices, to protect against malware and other threats. Systems must also run asset management, patch management, have encryption enabled, and other LTS required tools.
LTS with maintain guidelines for life cycle for standard equipment (switches, servers, workstations, etc)
The CISO or designee may grant exceptions to the policy to avoid business interruptions, assuming mitigating controls can be put in place.
Related
NIST 800-53 Rev 5.1.1 https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
NIST 800-171 Rev. 2 - https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final
Definitions
System Owner - Responsible for an information system, including security. They may delegate technical responsibility to a Technical Owner
Technical Owner - Responsible for the operation, patching, maintenance and configuration of the information system.
Revision History
Date | Version | Description | Approval |
|---|---|---|---|
| 1.0 | Original Document | Draft |