Configuration Management Standard

Description

Information security configuration management is the process of establishing, documenting, and maintaining the security controls that are in place to protect an organization's information and systems. This Standard will define the scope and frequency of identification and remediation and is included in the NIST Configuration Management control group.

Scope

All Lehigh systems attached to Lehigh University networks or containing University data should adhere to the defined security configurations. Basic and specific secure configurations will be maintained by LTS. System owners are responsible to ensure their systems are configured in appropriately. Technical personnel are responsible for understanding the configuration standards and applying them, and informing the System owner of any configuration gaps.

Security Requirements

NIST 800-171 compliance requires Lehigh to perform the following:

• 3.4 Configuration Management

  • 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.

  • 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems.

  • 3.4.6 Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.

  • 3.4.7 Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.

NIST 800-53

• SA-22 - Replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer; and Provides justification and documents approval for the continued use of unsupported system components required to satisfy mission/business needs.

PCI compliance requires Lehigh to perform the following:

• Develop configuration standards for all system components that address all known security vulnerabilities and are consistent with industry-accepted definitions. Update system configuration standards as new vulnerability issues are identified.                      

HIPAA compliance requires Lehigh to perform the following:

• ePHI environments need to have a number of technical safeguards enabled. These safeguards are enumerated within applicable standards and should be collected within HIPAA compliance guidance documentation.

Implementation

Basic Configuration Standards

Basic configuration standards are broad guidelines that apply to all systems/technologies that are used by the University.

• All systems must be in a supported state. Devices, computers, software that is EOL (end of life) and no longer receiving regular vendor security patches should be upgraded or replaced. If this is not possible, systems will be isolated from the University computing environment. 

• Default accounts and passwords shall be disabled or changed before placing the resource on the network. If you have a vendor installing devices on the network you should include this requirement in your statement of work. 

• All systems shall be configured to provide the least functionality to meet the need, only essential capabilities should be enabled (i.e. restricting the use of unnecessary ports, protocols, or services).

• Deploy antivirus and anti-malware solutions on all computers, including servers, desktops, and laptops to protect against malware and other threats. Systems must also run asset management, patch management, have encryption enabled, and other LTS required tools. 

• LTS will maintain guidelines for life cycle for standard equipment (switches, servers, workstations, etc).

• The CISO or designee may grant exceptions to the standard to avoid business interruptions, assuming mitigating controls can be put in place.

Specific Configuration Standards

Specific configuration standards are applied in specific situations (e.g. a secure research environment) or for specific categories of devices (e.g. network switches, windows systems). Specific Configurations Standards which are university-wide will be developed and maintained by LTS by the individuals or teams with the technical expertise required.

Related

NIST 800-53 Rev 5.1.1 NIST Special Publication (SP) 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

NIST 800-171 Rev. 2 - NIST Special Publication (SP) 800-171 Rev. 2 (Withdrawn), Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Definitions

System Owner - Responsible for an information system, including security. They may delegate technical responsibility to a Technical Owner

Technical Personnel - Responsible for the operation, patching, maintenance and configuration of the information system.

Revision History