ASD Internet & Electronic Communications Guidelines

1.1 Firewall Definition
For purposes of this procedure, firewalls are defined as security systems, which control and restrict both Internet connectivity and Internet services. Firewalls establish a perimeter where access controls are enforced. Connectivity reflects which systems can exchange information. A service, sometimes called an application, refers to the way for information to flow through a firewall. Examples of services include file transfer protocol (FTP) and Web browsing.

1.2 Playing the Role of Firewalls
In some instances, systems of routers may be functioning as though they are firewalls when in fact they are not formally known as firewalls. All ASD systems playing the role of firewalls, whether or not they are formally called firewalls, must be managed according to the rules defined in this procedure. In some instances this will require that these systems be upgraded so that they support the minimum functionality defined in this procedure. Any router that connects a vendor, or any non-ASD entity, into the ASD network must pass through an agency firewall before entering the ASD network.

1.3 Procedure Applicability
All firewalls at ASD must follow this procedure. Departures from this procedure will be permitted only if approved in advance and in writing by the ASD Information Technology Department.

1.4 Defined Decision Maker
Before being enabled, all new firewall services and new connectivity paths must be evaluated in terms of business advantages and security risks. The ASD Information Technology Department is the recognized decision maker who can either approve or deny these requests.

1.5 Default to Denial
Every Internet connectivity path and Internet service not specifically permitted by this procedure must be blocked by ASD firewalls. The list of currently approved services must be documented and distributed to all district employees with a need-to-know by the ASD Information Technology Department.

Likewise, every network connectivity path not specifically permitted by the ASD Information Technology Department must be denied by firewalls. Prior to the deployment of every ASD firewall, a diagram of permissible paths with a justification for each must be submitted to the ASD Information Technology Change Management Team. Permission to enable any paths will be granted by the IT Supervisor only when (1) the paths are necessary for important business reasons, and (2) adequate security measures will be used.

1.6 Logs
All changes to firewall parameters, enabled services, and permitted connectivity must be logged. In addition, all suspicious activity, which might be an indication of unauthorized usage or an attempt to compromise security measures, must also be logged. The integrity of these logs must also be protected with checksums, digital signatures, or similar measures. These logs must be promptly removed from the recording systems and stored in a physically protected container for at least three months. These logs must be reviewed periodically to ensure that the firewalls are operating in a secure manner.

1.7 Intrusion Detection
All ingress points must be protected by firewalls that include intrusion detection systems approved by the ASD Information Technology Department. These intrusion detection systems must each be configured according to the specifications defined by the ASD Information Technology Department. Such intrusion detection systems must also immediately notify technical staff that is in a position to take corrective action. All technical staff working on firewalls must be provided with remote access systems and privileges so that they can immediately respond to these incidents even when they are physically removed from the firewall in question.

1.8 Contingency Planning
Technical staff working on firewalls must prepare a contingency plan which addresses the actions to be taken in the event of various problems including system compromise, system malfunction, and power outage. These contingency plans must be kept up-to-date to reflect changes in the ASD computing environment. These plans must also be periodically tested to ensure that they will be effective in restoring a secure and reliable computing environment.

1.9 External Connections
No ASD computer system may be attached to the Internet unless it is protected by a firewall. Such computer systems include Web servers, electronic commerce servers, and mail servers.

1.10 Virtual Private Networks
To prevent unauthorized disclosure of sensitive and valuable information, all inbound traffic (with the exception of Internet mail and push broadcasts, like PointCaster or Yahoo News Ticker) making access to ASD networks must be encrypted with the products approved as part of the ASD Technical Architecture. These connections are often called virtual private networks or VPNs, and include technologies such as Secure Socket Layer (SSL), Internet Security Association Key Management Protocol (ISAKMP), Point-to-Point Tunneling Protocol (PPTP) or other forms of encryption.

1.11 Firewall Access Privileges
Privileges to modify the functionality, connectivity and services supported by firewalls must be restricted to a few individuals with a business need for these privileges, such as the ASD Information Technology Department personnel. Unless permission from the IT Supervisor has been obtained, these privileges will usually be granted only to individuals who are full-time permanent employees of the ASD (no temporaries, contractors, consultants, or outsourcing personnel). Vendor access for troubleshooting and technical support may be granted on an as needed basis. All firewalls must have at least two staff members who are adequately trained to make changes; as circumstances require they will be retrained to make changes.

1.12 Network Management Systems
Firewalls must be configured so that they are visible to internal network management systems. Cisco Works is the primary auditing and monitoring tool employed by the ASD Information Technology Department.

1.13 Disclosure of Internal Network Information
The internal system addresses, configurations and related system design information for ASD networked computer systems must be restricted such that neither systems nor users outside the ASD's internal network can access this information. Firewalls must be configured so they will not broadcast route or Simple Network Management Protocol (SNMP) information on an outbound basis.

1.14 Secure Back-Up
Current off-line back-up copies of firewall configuration files, connectivity permission files, firewall systems administration procedural documentation files, and related files must be kept close to the firewall at all times. A permissible alternative to off-line copies involves on-line encrypted versions of these files. Either of these options will help to keep trusted copies away from intruders, but at the same time immediately available to reestablish a secure and reliable computing environment. The ASD Information Technology Department will be responsible for maintaining backup information on all router and firewall configurations.

1.15 Firewall Change Control
Because they support critical ASD information systems activities, firewalls are considered to be production systems. This means that all changes to the software provided by vendors (excluding vendor-provided upgrades and patches) must be approved in advance by the ASD Information Technology Department, and then tested and approved before being used in a production environment.

1.16 Posting Updates
Because hackers and other intruders use the latest attack techniques, ASD firewalls must be running the latest software to repel these attacks. Where available from the vendor, all ASD firewalls must subscribe to software maintenance and software update services. Unless approved in advance by the IT Supervisor, staff members responsible for managing firewalls must install and run these updates within a week of receipt. This update provision must be met by the ASD Information Technology Department.

1.17 Monitoring Vulnerabilities
ASD staff members responsible for managing firewalls should subscribe to advisories and other relevant sources providing current information about firewall vulnerabilities. Any vulnerability, which appears to affect ASD networks and systems, must be promptly brought to the attention of the ASD IT Supervisor.

1.18 Firewall Physical Security
All ASD firewalls must be situated in locked rooms accessible only to those who must have physical access to such firewalls. The placement of firewalls in the open area is prohibited; although placement within separately locked rooms or areas which are within a general data processing center is acceptable.

2.1 Purpose
The purpose of this procedure is to provide guidelines for Remote Access IPSec Virtual Private Network (VPN) connections to the ASD network.

2.2 Scope
This procedure applies to all ASD employees, contractors, consultants, temporaries, and other workers including all personnel affiliated with third parties utilizing VPNs to access the ASD network. This procedure applies to implementations of VPN that are directed through an IPSec Concentrator or SSL VPN.

2.3 Procedure
Approved ASD employees and authorized third parties (customers, vendors, etc.) may utilize the benefits of VPNs, which are a "user managed" service. This means that the user is responsible for selecting an Internet Service Provider (ISP), coordinating installation, installing any required software, and paying associated fees.

Additionally:

2.4 Enforcement
Any employee found to have violated this procedure may be subject to disciplinary action, up to and including termination of employment.

3.1 Purpose
This procedure establishes information security requirements for all networks and equipment deployed in the ASD "De-Militarized Zone" (DMZ). Adherence to these requirements will minimize the potential risk to ASD from the damage to public image caused by unauthorized use of ASD resources, and the loss of sensitive or confidential data.

3.2 Scope
ASD networks and devices (including but not limited to routers, switches, hosts, etc.) that are Internet facing and located outside ASD Internet firewalls are considered part of the DMZ and are subject to this procedure. All existing and future equipment, which falls under the scope of this procedure, must be configured according to the referenced documents. This procedure does not apply to networks and devices residing inside ASD's Internet firewalls or trusted networks.

3.3 Procedure

3.4 Enforcement
Any employee found to have violated this procedure may be subject to disciplinary action, up to and including termination of employment.

4.1 Purpose
The purpose of this procedure is to provide a methodology for creating traffic shaping rules.

4.2 Scope
This procedure applies to all traffic leaving the egress point of the ASD network.

4.3 Procedure
A business analysis needs to be done to classify all traffic in one of three areas: Sensitive, Best-Effort, and Undesired. Based upon these three areas shaping of outbound and inbound traffic will occur.

5.1 Purpose
The purpose of this procedure is to provide a guideline for filtering Web traffic.

5.2 Scope
This procedure applies to all Web traffic leaving the egress point of the ASD network. This procedure will affect all users within the ASD network.

5.3 Procedure
Generally, URL filtering devices can be deployed in 2 different modes: promiscuous and inline. It is recommended to deploy in promiscuous mode when able because of flexibility and minimal impact on traffic flow. All Web based traffic will be compared against the following list. Determination of how this traffic is filtered will be dictated by ASD policies.

5.4 Exceptions