Effective Date: January 01, 2006
Security Review for New Security Software and Appliances
Related UT Austin Policies, Procedures, Best Practices and Applicable Laws
Last Reviewed: September 15, 2005
Last Edited: September 14, 2007
See the change log for a list of significant changes made to this document.
I. Purpose
These minimum standards serve as a supplement to the IT Security Operations Manual, which was drafted in response to Texas Administrative Code 202 and UT System UTS-165. Adherence to the standards will increase the security of systems and help safeguard university information technology resources. These minimum standards exist in addition to all other university policies and federal and state regulations governing the protection of the university's data.
Compliance with these requirements does not imply a completely secure system. Instead, these requirements should be integrated into a comprehensive system security plan.
II. Scope
These standards apply to all devices, physical or virtual, connected to the university networks through a physical, wireless, or VPN connection where data is classified as Category I, II, or III (see Data Classification Standard).
III. Audience
All users with systems connected to the university network as in Sec. II, above.
IV. Minimum Standards
This section lists the minimum standards that should be applied and enabled in Category I, II, and III data systems that are connected to the university network. Standards for Category I are generally required.
If products are not available from reputable commercial or reliable open source communities for a specific requirement, then the specific requirement is waived until an appropriate solution is available. In such cases a security exception report will be filed.
IT Owners and IT Custodians, lead researchers, and/or systems administrators are expected to use their professional judgment in managing risks to the information and systems they use and/or support. All security controls should be proportional to the confidentiality, integrity, and availability requirements of the data processed by the system. A current list of recommended software is maintained on the ITS BevoWare Web site.
Backups
Change Management
| # | Practice | Cat I | Cat II & III |
|---|---|---|---|
| 2.1 | There must be a change control process for systems configuration. This process must be documented. | Required | Recommended |
System changes should be evaluated prior to being applied in a production environment.
|
Required |
Recommended |
Computer Virus Prevention
Physical Access
System Hardening
| # | Practice | Cat I | Cat II & III |
|---|---|---|---|
| 5.1 | Systems must be set up in a protected network environment or by using a method that assures the system is not accessible via a potentially hostile network until it is secured. | Required | Recommended |
| 5.2 | Operating system and application services security patches should be installed expediently and in a manner consistent with change management procedures. | Required | Required |
| 5.3 | If automatic notification of new patches is available, that option should be enabled. | Required | Required |
| 5.4 | Services, applications, and user accounts that are not being utilized should be disabled or uninstalled. | Required | Recommended |
| 5.5 | Methods should be enabled to limit connections to services running on the host to only the authorized users of the service. Software firewalls, hardware firewalls, and service configuration are a few of the methods that may be employed. | Required | Recommended |
| 5.6 | Services or applications running on systems manipulating Category-I data should implement secure (that is, encrypted) communications as required by confidentiality and integrity needs. (See Data Encryption Guidelines.) | Required | Recommended |
| 5.7 | Systems will provide secure storage for Category-I data as required by confidentiality, integrity, and availability needs. Security can be provided by means such as, but not limited to, encryption (see Data Encryption Guidelines), access controls, filesystem audits, physically securing the storage media, or any combination thereof as deemed appropriate. | Required | Recommended |
| 5.8 | If the operating system supports it, integrity checking of critical operating system files should be enabled and tested. Third-party tools may also be used to implement this. | Required | Recommended |
| 5.9 | Integrity checking of system accounts, group memberships, and their associated privileges should be enabled and tested. | Required | Recommended |
| 5.10 | The required university warning banner should be installed. | Required | Recommended |
| 5.11 | Whenever possible, all non-removable or (re-) writable media must be configured with file systems that support access control. | Required | Recommended |
| 5.12 | Access to non-public file system areas must require authentication. | Required | Recommended |
| 5.13 | Strong password requirements will be enabled, as technology permits, based on the category of data the account is allowed to access. | Required | Required |
| 5.14 | Apply the principle of least privilege to user, administrator, and system accounts. | Required | Recommended |
Security Monitoring
V. Security Review for New Security Software and Appliances
Departments evaluating the implementation of new security software or appliances, involving Category-I type data, should request a security review by sending a written description of the proposed implementation to the Information Security Office prior to selecting vendors or products. Security reviews tend to be informal and can often be performed quickly, while ensuring that best practices are being considered.
VI. Non-Compliance and Exceptions
For all system administrators—if any of the minimum standards contained within this document cannot be met on systems manipulating Category-I or -II data that you support, an Exception Process must be initiated that includes reporting the non-compliance to the Information Security Office, along with a plan for risk assessment and management. (See Security Exception Report.) Non-compliance with these standards may result in revocation of system or network access, notification of supervisors, and reporting to the Office of Internal Audit.
University of Texas at Austin employees are required to comply with both institutional rules and regulations and applicable UT System rules and regulations. In addition to university and System rules and regulations, University of Texas at Austin employees are required to comply with state laws and regulations.
VII. Related UT Austin Policies, Procedures, Best Practices and Applicable Laws
The policies and practices listed here inform the system hardening procedures described in this document and with which you should be familiar. (This is not an all-inclusive list of policies and procedures that affect information technology resources.)
UT Austin IT Security Operations Manual
UT Austin Acceptable Use Policy
