VIII.COMPUTER SECURITY CHECK LIST

Since this module represents the capstone effort of the computer security curriculum, include a checklist for computer security. Necessarily, aim this list at large organizations with mainframes; the list also includes most information needed for microcomputer system security.

  1. General Information
    1. A detailed Statement of Threat for the organization.
    2. A Statement of Threat for individual locations.
    3. A list containing phone numbers for all individuals involved in the organizational security.
    4. A policy document detailing how the security personnel has access to the MIS personnel.
    5. Documentation on the training of all MIS personnel.
    6. An organization chart and documentation demonstrating the separation of duties to minimize the opportunity for collusion.
    7. Documentation of an MIS Security Group (MSG) or equivalent. This documentation should include but not necessarily be limited to:
      1. Names, functions, and phone numbers of all members (for emergency access).
      2. Security Specialists, Operations Specialists, Physical Security Specialists, Auditor, Facilities Engineer, Communications Security Specialists, and others with appropriate skills are fully represented on the committee.
    8. Documentation for each area that demonstrates that an effective liaison has been established with local support activities in the following areas:
      1. Plant engineering and facilities, construction, electrical, air conditioning, and site preparation.
      2. Physical security.
      3. Personnel.
      4. Safety (Safety Officer, Fire Marshal, Transportation).
      5. Records management.
  2. General Security
    1. Documentation that each area has been designated a restricted area following current company policy, if appropriate.
    2. Documentation of security policies and procedures.
    3. Documentation of internal audit efforts that determine compliance with security procedures.
    4. Documentation of a formal risk management program.
  3. Fire Risk and Water Damage Analysis
    1. Specific site documentation for fire risk and exposure should contain, but not necessarily be limited, to the following:
      1. The construction techniques that demonstrate the fire resistance of the building containing the system. Raised floors and ceilings, curtains, rugs, furniture, and drapes should be from non-combustible materials.
      2. The procedures used to manage the paper and other combustible supplies for the computer facilities. In addition, this should document the control of inflammable or dangerous activities in areas surrounding the computer room.
      3. The storage of magnetic media outside the computer room.
      4. The periodic training of operators in fire fighting techniques and assigned responsibilities in case of fire.
    2. Documentation that each site has computer fire protection.
      1. Automated carbon dioxide. If so, do all personnel have training in the use of gas masks and other safety devices.
      2. Halogenated agents.
      3. Water (either wet-pipe or preaction alarm).
    3. Documentation that portable fire extinguishers are spread strategically around the area with markers visible above computer equipment.
    4. Documentation that power shutdown switches are accessible at points of exit. Switches should shut down the air conditioning flow as well.
    5. Documentation on the location of smoke detectors. Are they located in the ceiling, under the raised floor, in air return ducts? It should answer the following questions:
      1. Will air conditioning systems shutdown on detection of smoke?
      2. Who will perform the engineering analysis of the function of smoke alarms and how often?
      3. Who tests the smoke detection system and how often?
      4. Who is responsible for fire drills and how often should they occur?
    6. Documentation of sub floor cleaning and contents, if appropriate. It should include:
      1. water supplies for fire fighting
      2. battery powered emergency/ evacuation lighting
      3. manual alarm systems
    7. Documentation of fire alarm systems to include where they ring, who will respond, and how.
    8. Documentation of 24-hour attendance and procedures for reporting problems.
    9. Documentation of control of potential water damage that includes:
      1. The elimination of overhead water and steam pipes except for sprinklers.
      2. The existence of subfloor drainage including drainage away from all hardware.
      3. The protection of the electrical system from water damage in subfloor area.
      4. The water integrity of doors, windows, and roof.
      5. The location of sheeting materials for protection of hardware components from water damage.
  4. Air Conditioning Systems
    1. Documentation of the air conditioning system should include:
      1. The unique use of computer air-conditioning system.
      2. The existence of fireproof ducts and filters.
      3. Location of compressor.
      4. Backup air-conditioning availability.
      5. Fire protection of cooling tower if applicable.
      6. Air intake protection with protective screening, and is it above street level.
      7. That the air intakes prevent the uptake of pollutants or debris.
    2. Document the temperature and humidity recording and control.
  5. Electrical System: The electrical system is frequently a weak link in information security. PC/workstations are often overlooked as a source of problems.

  6. Document electrical system reliability by showing:

    • That uninterruptible power supplies are available at those locations that require them.
    • That motor-generator systems are backed up and that there are lightning arrestors on appropriate circuits.
    • The reliability of the commercial power supply and that it is clean power if the system relies on it.
    • That the security system will continue to function even after a power failure.
    • The backup system test frequency and results.
  7. Natural Disasters: Document the resistance to a natural disaster by showing:
    • The structural soundness and resistance to windstorms, floods, and earthquakes. This would include demonstrating that the buildings are remote from earthquake faults or earthquake-proof. Show relationship to geothermal/volcanic areas.
    • Proper grounding of all electrical equipment for lightning protection.
  9. Backup Systems
    1. Document the existence of backup systems for all critical systems at the site. This should include, but not be limited to:
      1. A fully articulated agreements for backup computers in -
        1. the same room.
        2. another room in the same building.
        3. a separate location.

      2. Benchmarks or other indicators that the backup systems can, in fact, handle the intended workload.

      3. Copies of the contract granting access to computers owned by others.
      4. Quarterly tests, performed to familiarize staff with procedures for using a backup system.
      5. A full security review and plan for a backup system, if needed.
    2. Document a full written contingency plan covering:
      1. Individuals who are responsible for each functional area.
      2. A current “who calls whom” list with alternates. This list should include but not be limited to: Management, Emergency Crews, Selected Users, Service Personnel, Facilities Personnel, and Points of contact at backup sites.
      3. Detailed descriptions of the criteria for determining the duration of disruptions to service.
      4. Individual responsibilities for retaining source documents and/or data files for each application.
      5. Individual responsibilities for the destruction or safeguarding of classified materials in the computer facility in the event the facility must be evacuated.
      6. Individual responsibility for the purchase or lease of new or temporary computer equipment.
      7. Individual responsibility for the acquisition of:
        1. Air conditioning equipment.
        2. Computer time/services.
        3. Additional manpower.
        4. Furnishings, cabinets, etc.
        5. Replacement tapes and disk packs.
        6. Alternate sites and their preparation.
        7. Travel accommodations for essential personnel.
        8. Orderly transportation of computer jobs, personnel, and related materials and appropriate coordination with security.
        9. Duplication of backup files.
        10. Continuing security in the contingency mode.
      8. Document the existence of a contingency training program for all computer personnel
  11. Access Control
    1. Document the access control that is unique to the computer facilities by showing:
      1. That a general guard schedule provides adequate physical security in accordance with the Statement of Threat and a positive identification system exists for all employees.
      2. That the access to computer areas is restricted to selected personnel this would include, but not be limited to:
        1. Unescorted access to the equipment.
        2. Files are segregated so that only specific individuals have access.
      3. That an adequate visitor control procedure exists that including:
        1. Escorts procedures
        2. Proper training of potential escorts about their responsibilities.
        3. Personnel trained to challenge improperly identified individuals.
      4. That security and operations personnel are briefed on how to react to civil disturbances.
      5. That a good liaison program exists with local law enforcement agencies and that suitable articulation agreements are in place.
      6. That all personnel know how to handle telephone bomb threats.
    2. Document that background checks and rechecks are performed on all employees.
    3. Document that policies exist to ensure that computer employees are cross-trained to cover all essential functions.
    4. Document the existence of a continuing personnel education program in computer security matters. This should include but not be limited to:
      1. Knowledge of the provisions of company security policies and procedures
      2. Personnel training of supervisors in human behavior to aid managers in identifying changes in personality and living habits of their people
      3. Personnel training of supervisors so that they can identify possibly disgruntled employees.
      4. Personnel policies that allow for containment or immediate dismissal of employees who may constitute a threat to installation.
    5. Document that all exterior windows accessible from the ground level are covered with metal grills.
    6. Document that no one can gain access to the computer area without the knowledge of a guard or another employee.
    7. Document that the computer facilities are manned by at least two appropriately cleared personnel at all times.
    8. Document that housekeeping standards for the computer room include the prevention of accumulation of trash in the computer area and that floors (and associated underfloor areas), equipment covers, and work surfaces are cleaned regularly.
    9. Document that wastebaskets in the computer room are of metal material with closing tops and that they are dumped outside the computer area to minimize dust.
    10. Document smoking rules in the computer facility. If smoking is allowed, document the existence of self-extinguishing ashtrays.
  12. System Utilization
    1. Document that the hardware utilization policy includes but is not limited to:
      1. that systems comply with operations schedules
      2. that techniques exist for matching meter hours to operational hours. This is to ensure that the equipment is not being used for unauthorized purposes during off duty hours.
      3. that a regular maintenance schedule exists for hardware to ensure reliability and that maintenance personnel have appropriate security clearance.
      4. that batch type jobs are logged and cross-checked against an authorized job list.
      5. spot checks of output for possible misuse of a system and that output distribution systems prevent an unauthorized person from receiving a confidential report.
    2. Document communications control techniques.
    3. Document the existence of emanation security (no RFI detectable outside computer facility).
  14. System Operation
    1. Document that erasure and declassification procedures include the erasure and overwriting of classified data before the contents of that memory can be reused.
    2. Document that the necessary programs, equipment, and procedures exist for declassifying any and all computer equipment used for the processing or storage of classified data on-site.
    3. Document that policies exist for magnetic tapes and disks that require:
      1. Accountability for use and cleaning frequency of tapes and disks.
      2. Use by authorized individuals only.
      3. The orderly filing of tapes and disks.
      4. Tapes Storage (vertically and in containers) except when in use.
      5. Tape and disk pack utilization records.
      6. The frequent cleaning of tape heads to ensure data reliability.
      7. Location of the media library in an area secure from an explosion or other dangers.
      8. The use of magnetic detection equipment to preclude the presence of a magnetic field near the magnetic media.
      9. Adequate protection for magnetic media while in transit between locations.
    4. Document that media or devices are marked with:
      1. Date of creation.
      2. The highest classification level of any information contained on the media.
      3. Downgrading or exemption instructions when placed in permanent files.
      4. A unique identifier.
      5. The classification of the system’s environment when the product was produced, if the assigned classification cannot be immediately verified by the customer.
      6. Special access restrictions.
      7. Color codes.
  16. Software
    1. Document that software security policy includes the following:
      1. That physical security includes backup file systems at a secondary location for both the programs and the associated documentation. Essential programs, software systems, and associated documentation of programs in the library are located in a locked vault or a secured area.
      2. That access to the essential programs and software systems is restricted to a need to know basis in the prime and backup areas.
      3. That a multilevel access control to the data files (read/write/update, block, record, field, and characters) is provided by various levels of security classification.
      4. That periodic checks are made to validate the security software utilities and the tables of access codes.
      5. What techniques are employed that preclude more than one user updating files at any given time, in those areas where remote access to on-line databases is allowed.
    2. Document that in those areas that allow access by remote terminals:
      1. That keyword or password protection with periodic changes of passwords is employed.
      2. That data is encryption (either hardware or software) techniques are employed during transmission of vital data.
      3. That terminal users are restricted to higher-level language access only.
  17. Hardware
    1. Document that the operating systems are protected from unauthorized activity by:
      1. Maintaining built-in protection to prevent the bypassing of security utilities and unauthorized access to databases by a knowledgeable programmer familiar with the system.
      2. Demonstrating that memory bounds are tested following maintenance, initial program load, and each restart.
      3. Verifying vendor modifications to the operating system before being installed on the system.
      4. Verifying all local modifications to the operating system by the security officer or personnel designated by him.
      5. Maintaining a record of all operating system modifications until at least the next software release.
      6. Monitoring software technologists to ensure that they do not circumvent the normal access procedures by the use of special coding.
    2. Documenting that application programs are designed to restart using internal recovery procedures.
    3. Documenting that all programming changes and maintenance are well controlled. Configuration Control.
    4. Documenting that threat monitoring is accomplished by showing:
      1. That a log of those who access data banks or sensitive files is maintained.
      2. That there are software security routines that monitor unauthorized attempts to access portions of the system via on-line notification of an operator or end of day printout.
      3. That attempts to misuse the system are followed up in a systematic manner and according to the appropriate rules established by the SSO and the MIS manager.
    5. Documenting that in house service personnel are controlled in their access to vital areas. All non cleared individuals should have special escorts while performing their tasks.
    6. Document that a list of vendor-authorized service and system support personnel is maintained. That positive identification of these individuals is required and that they do not compromise security.
  19. File Security
    1. Document that online and offline program files are:
      1. Protected by copies being maintained in a separate building from the original.
      2. Stored in low fire hazard containers.
      3. That there is a current inventory of the files.
    2. Document that system backup dry runs are attempted on a regular (quarterly) basis and that the backups contain programs currently under development.
    3. Document that program changes are controlled and recorded and that changes are made only to a reproduced version of the original program file with the original left intact.
    4. Document that computer operations staff review systems documentation on a regular basis to ensure compliance with operational standards.
    5. Document that minimum documentation standards are met throughout all operational sections. Documentation should include but not be limited to:
      1. Detailed production specifications.

      2. A comprehensive narrative description of the function of the program.

      3. Detailed logic or flowcharts following established industry standards.
      4. Current program listings.
      5. Input and output formats.
      6. Output samples.
      7. User documentation.
      8. Copies of test data are used to generate output samples following the procedures in the user documentation.
      9. Explanations of codes, tables, calculations, and other details unique to the particular program.
      10. Explanations of all error messages, and program halts.
      11. Procedures for handling rejected records.
      12. File sequence descriptions.
      13. Control and balancing instructions.
    7. Document that duplicates of all documentation are stored in low fire hazard storage equipment in a separate building from the original.
    8. Document that the documentation is inventoried at least annually and that the backups are reviewed periodically to ensure that the documentation package is current.
    9. Document that changes in programs and documentation are coordinated and approved by the cognizant areas and that these changes are reviewed by the internal auditor.
  20. Data File Standards
    1. Document that there is a retention cycle for all data files for all applications. This retention cycle review should include:
      1. Certification that the data and documentation retention cycles are coordinated with the file reconstruction procedures.
      2. Review by the user for compliance.
      3. Certification that the data files are maintained within and under the control of the computer complex rather than the user.
      4. Certification that all files are properly classified in terms of the degree of sensitivity and value to the organization.
    2. Document that the data files are kept in:
      1. an area other than the computer room.
      2. a fire protected area.
      3. Kept in an access controlled area.
      4. low fire hazard storage containers.
    3. Document that dry runs of the data file security system are performed periodically to ensure compliance with standard procedures.
    4. Document that the staff members understand and comply with the legal requirements for file retention and that they understand the relative value of the programs and applications.
    5. Document that an overall audit control philosophy relating to computer systems concerning assets exists. This philosophy should include:
      1. Computer usage and production controls.
      2. Control of user input to ensure receipt of all data.
      3. Monitoring of output to meet site established standards.
      4. Error reporting and follow-up procedures.
      5. Control of program changes.
      6. Certification that all program options have been tested.
      7. Certification that program conversions provide similar results and do not disrupt production continuity.
      8. A policy detailing the separation of duties.
      9. Policies for both hardware and software backups.
      10. The audibility of the system.
      11. A policy of auditor involvement during the development cycle.
  21. Shared Resource Systems Security
    1. Document that for resource sharing systems, remote terminals are available only to selected individuals. This access may be controlled by one or more of the following:
      1. Locked doors.;
      2. Posted guards;
      3. Other approved restraints.
    2. Document that terminals are located such that each user’s privacy is ensured.
    3. Document the use of passwords and the fact that:
      1. they are tamper-proof.
      2. they are linked to individuals and locations.
      3. that they are combined with physical keys.
      4. the ability to change passwords is closely controlled.
    4. Document that systems software restricts a given individual to specific data files. This access should control the right to add, delete or modify files.
    5. Document that the system maintains accurate records of all activity against each data file and that the security override procedure is closely monitored.
    6. Document the procedures used to monitor the changes to the operating and security systems.