ANNUAL COMPUTER SECURITY REFRESHER TRAINING

Transcription

1 ANNUAL COMPUTER SECURITY REFRESHER TRAINING Nrthrp Grumman has a requirement t prvide annual cmputer security training t all emplyees wh have access t classified cmputing systems. This training will infrm yu f current plicies and guidelines. It is prvided t re-emphasize yur cntinued respnsibility fr prtecting classified infrmatin, Infrmatin Systems, and preventing classified data spillages. As a reminder, sme areas/sites may fllw different requirements. If yu have any questins abut lcal plicies and guidelines please seek guidance frm yur lcal Cmputer Security Representative. INFORMATION SYSTEMS (IS) What is an infrmatin system? An infrmatin system is cmputer hardware, sftware and firmware cnfigured fr the purpse f autmating the functins f calculating, cmputing, sequencing, string, retrieving, displaying, cmmunicating r therwise manipulating data, infrmatin and textual material. These systems include: Cmputers Test equipment Printers Laptps Electrnic data managers Thumb drives/memry sticks Netwrk equipment. TERMINOLOGY Belw are terms used thrughut this mdule: Infrmatin Systems Security Manager (ISSM): Persn respnsible fr an rganizatin's infrmatin systems security prgram. Infrmatin Systems Security Officer (ISSO): Respnsible fr the everyday security f the system; may be appinted fr each individual IS. Technical interface between the prgram and the ISSM. System Security Plan (SSP): Used t describe an IS and the necessary prtectins t allw the system t perate securely. Each netwrk has at least ne cpy f the SSP available fr all users. Sme larger netwrks may have multiple cpies thrughut the area. Page 1 f 13

2 ACCESS CONTROL REQUIREMENTS The fllwing requirements must be met befre yu are granted a general user cmputer accunt: Must be prgram briefed. Validated Need-t-Knw. Cmpleted initial general user infrmatin systems security training and annual general user refresher training current within ne year. Signed General User Infrmatin System Acknwledgement Statement n file with the ISSO/ISSM. Cmpleted Classified Infrmatin Systems Accunt Request Frm. The fllwing are yur respnsibilities as a user: Lgff shared wrkstatins if nt in use fr mre than 15 minutes. Fllw apprved startup and shutdwn prcedures fr perids prcessing systems (i.e. shared cmputer with multiple prgram remvable hard drives) r systems with clsed strage requirements. SECURELY MANAGING COMPUTER SYSTEMS Prtect passwrds, d nt share r allw thers t use yur accunt. Unclassified passwrds shuld never be written dwn r stred n files in the cmputer, per Nrthrp Grumman Crprate Prcedure COR600 IT Device and Netwrk Usage Cmpliance and Limitatins. Custmer plicy discurages the writing dwn f classified passwrds. If yu must write it dwn: It must be marked with prper classificatin caveats, Sealed in an envelpe, Marked eyes nly, Attached with a classified cversheet; and Stred in a lcked cntainer which nly yu have access. T minimize the need t share passwrds, utilize file sharing by placing dcuments in a shared area. Maintain need-t-knw prtectin by limiting access t shared areas. Reprt passwrd cmprmises t Cmputer Security. Lck yur cmputer when yu leave it unattended. It is nt sufficient t wait fr the autmatic screen lck. At the end f the day, bth classified and unclassified cmputers must be lgged ff r shut dwn. An unsecured cmputer is an pen invitatin fr misuse. T manually activate yur screen lck yu can use the fllwing ht keys: Windws NT, 2000 Ctrl+Alt+Del then Enter Windws XP, 7 Page 2 f 13

3 Ctrl+Alt+Del then Enter r Windws Key+L MAC/UNIX/Other Call the Enterprise Slutin Center r see yur System Administratr fr system specific prcedure. IS USER ACCOUNTS There are tw kinds f IS user accunts; General users Have apprval t input, mdify, receive and transmit infrmatin n apprved infrmatin systems. Privileged users (i.e., System, Netwrk and Database Administratrs) Are thse persns wh have the authrizatin and accesses t change the cnfiguratin f the IS and administer the accunts and access right f General Users. Includes individuals wh make changes t security relevant sftware. A privileged user shall be cleared t the highest level f IS's accreditatin and shall be the nly persn wh may have access t thse prtins f the IS's hardware, sftware, r firmware that perfrm security functins. Privileged users will have tw accunts- ne accunt as a general user and ne accunt as a privileged user. Must adhere t all general user requirements. Ntify and btain apprval frm the ISSM r ISSO when making system changes r perfrming maintenance. Privileged users have a greater respnsibility than rdinary users t ensure they perfrm their duties in a secure manner. GROUP ACCOUNTS Grup accunts are als smetimes referred t as shared accunts. These accunts are general accunts which multiple individuals have access t and are nt tied t just ne individual. Prir t being created, grup accunts must be apprved by the ISSO/ISSM and may need t be listed in the assciated SSP and have received custmer apprval. Individual users must be pre-apprved fr access t a specific grup accunt by a user s supervisr r their prgram management. When lgging n and ff f a grup accunt, the user must cmplete the prcess fr tracking grup access. This may be a manual access lg fr that system which will be lcated in the area but can vary. Page 3 f 13

4 Grup accunts shuld nt have administratr privileges. Sme grup accunts require additinal certificatin per custmer requirements. Speak with system ISSO/ISSM fr system specific prcess. COMPUTER USE AND AUDIT LOGS Yur use f classified prgram cmputers is mnitred and audit lgs are maintained. Prgram cmputers are fr fficial prgram use nly. Persnal business n a classified cmputer may subject yu t disciplinary actin. All cmputer use is subject t mnitring. Warning banner: Yu are giving cnsent t mnitring every time yu use a classified cmputer system. Yur cmputer activity is audited and the fllwing infrmatin (at a minimum) is lgged. Date and time f yur activities (lgn, lgff, etc.). Activities invlved (file access attempts, sftware used, etc.). System names where perfrming the activities (wrkstatin, server, etc.). Resurces invlved (netwrk shares, printers, etc.). All sftware cpyright laws and license agreements must be adhered t. "Misuse f cmputer systems" is ne f the criteria used in adjudicating apprval and/r revcatin f security clearances. STEPS TO INTRODUCING UNCLASSIFIED CDS 1. Create unclassified CD n a NGGN cmputer 2. Finalize CD with apprpriate sftware (Rxi, Snic, Sphs Clse Disc Utility) and virus scan the CD. 3. Label CD accrdingly 1. "UNCLASSIFIED" (include NG Prprietary Level I r II as apprpriate) 2. Title 3. Yur name, rganizatin/zne, telephne 4. Date 4. Fllw prgram prcedures fr uplad and destructin. See yur requisite Security Representative fr any site/prgram specific details. Page 4 f 13

5 PERSONALLY OWNED HARDWARE, SOFTWARE AND MEDIA Persnally wned hardware, sftware and media are prhibited in classified areas, see CTM J100 Cmpany Security Manual. Examples f these include, but are nt limited t. PDAs, thumb drives, digital music players. Check with yur Security representative fr specific guidance n these types f devices. Persnally burned CDs and DVDs Persnally wned phtgraphic, vide, and audi recrding equipment Tw-way radis r tw-way pagers Cell phnes (unless apprved by the wner f the particular area) Laptp cmputers (unless apprved by prgram security) Cameras and film (unless apprved by prgram security) Cmmercial music CDs, CD players, and radi rules are defined by each prgram custmer. Seek guidance frm prgram security r ISSM fr specific plicy exceptins. MEDIA MARKING AND STORAGE All media must be labeled t indicate its classificatin level. All unmarked media is assumed t be classified and must be prtected at the highest classificatin level f infrmatin prcessed in the area until reviewed by a knwledgeable persn. Each user is respnsible fr any media they create. D nt c-mingle unclassified and classified prgram media. Stre in unclassified and classified media separate cntainers r different flders within same cntainer. PRINTER SECURITY Netwrked and lcal classified printers are a ptential security risk. Since classified and unclassified pages may be c-mingled n classified printers, a cmprmise f classified infrmatin may ccur. Review every page printed n a classified printer prir t remval frm the classified area. Classified material must be marked apprpriately. During audits the custmer will check fr classificatin markings n the header and fter and prtin marking thrughut classified dcuments. Use apprpriate cver sheets fr all yur printuts. Cver sheets shuld be stred near printers. Befre leaving the classified area, Security must review all technical/prgram related printuts. Page 5 f 13

6 T prevent classified r prprietary infrmatin frm being inadvertently printed after hurs, classified printers are t be turned ff r the paper tray pulled ut as part f the security mnitr checklist. T recycle tner cartridges, print ne sheet f unclassified text and send t the recycling center. Printers must be sanitized by IT Slutins befre remval. Multi-Functinal Devices and printers with internal hard drives must be registered, labeled and fllw the same sanitizatin prcedures as classified cmputers. All unmarked printed material is assumed t be classified and must be prtected at the highest classificatin level f infrmatin prcessed in the area until reviewed and marked by a knwledgeable persn. If classified material cannt be marked during printing, mark the material as sn as practical. Output must be prtected frm unauthrized access. DATA SPILLAGE A data spillage/system cntaminatin, als called a Cde Blue, ccurs when classified infrmatin is intrduced nt a system that is nt apprved fr that level f infrmatin. In the event f a ptential r cnfirmed data spillage f classified infrmatin either fund n an unclassified cmputer, received via , r upladed t a cllabratin system r file server, taking the apprpriate actins as sn as the spillage is identified can cntain the data and minimize further cmprmise. D nt delete r alter the file, attempt cleanup r use the system until cleared by security. Immediately cntact Cmputer Security (ISSO/ISSM) r yur Security Manager D nt frward the material t anyne, including Security Prvide the name and phne number, Sectr, whether it is a standard r restricted spill, date and time, type f system invlved ( , file share, desktp) Discnnect any external cnnectins and secure the cmputer. This may require mving it t a secure area r remain with the cmputer at all times until Cmputer Security prvides additinal guidance. As part f the cleanup, assist security by: Determining the rigin f the file - Prtable media, r frm a shared flder n a server? Determining if the file has been shared r distributed - Has the file been sent as an , upladed t a shared space r saved t the hard drive? Page 6 f 13

7 When in dubt abut what data is classified, see yur prgram lead r Prgram Security Manager. If yu suspect a virus is n a classified system, cntact Cmputer Security immediately. Fr additinal guidance n data spillages visit: INCIDENT REPORTING Reprt suspected r actual cmputer security incidents: Unauthrized access Fraud, waste, and abuse Nn-cmpliance with cmputer security plicy Misuse f Infrmatin Systems (wrkstatin used fr persnal business r malicius intent) Allwing a nn-prgram briefed individual t access a prgram system Nt prtecting cmputer media (CDs, DVDs, hard drives, etc.) Imprper labeling r retentin f cmputer media. IS USER RESPONSIBILITIES As an IS user yu have certain respnsibilities Attend lgged-n systems at all times. When unattended, the screen must be lcked. All classified media in use must be attended at all times. Never allw an uncleared persn physical r visual access t a classified system. Mnitrs must be psitined t prevent unauthrized individuals frm viewing infrmatin. Read the System Security Plans (SSPs) and knw where they are lcated. Yu affirm yur respnsibility every time yu lgn t a prgram Infrmatin System and cnsent t mnitring (lgn warning banner). SUMMARY OF RESPONSIBILITIES Nrthrp Grumman cmputer and netwrk resurces are prvided fr Nrthrp Grumman business purpses nly. Emplyees have n expectatin f privacy while using Nrthrp Grumman cmputer resurces. Nrthrp Grumman may mnitr use at its sle discretin. Access t a classified Infrmatin Systems (IS), hardware, firmware r sftware is Page 7 f 13

8 restricted t authrized and briefed persnnel. Review all infrmatin fr need-tknw and prper classificatin befre sending t thers. Never intrduce classified infrmatin r media nt an unclassified system. Cmputer systems t be used fr classified prcessing must be apprved by the ISSM prir t prcessing. Crdinate all lcatin, status and cnfiguratin changes with Infrmatin System Security. Sharing f individual passwrds is prhibited. Grup accunts may be apprved n a limited basis. When lgged n, each user will ensure prtectin f the cmputer screen and printer utput frm unauthrized access. N sftware will be intrduced r used n any classified cmputer withut prir crdinatin and apprval frm the ISSM. Always crdinate apprval prir t purchasing sftware intended fr use n a classified system. All sftware cpyright laws and license agreements must be adhered t. Label all media prperly PRIOR t use. Secure media befre yu leave yur wrk area. Never remve any classified cmputer hardware withut PRIOR authrizatin. Always infrm the ISSM and/r ISSO prir t a hardware change. Reprt all suspected security incidents such as a malicius cde r virus, misuse, vilatin f system security, unprtected media, imprper labeling and data spillage (e.g. classified data n unclassified systems) thrugh the apprpriate channels. After Hurs - cntact the Cyber Security Operatins Center (CSOC) at Cntact the ISSO when yu n lnger need access t a classified system. SCIF REMINDERS It is yur respnsibility t knw the classificatin f the infrmatin that yu are putting n the system. N devices with Wi-Fi, Bluetth, r wireless transmitting abilities are permitted. D nt use the same passwrd n multiple systems. Cmmercially prduced music may be allwed in the classified area but is prhibited frm being played in Cmpany/Gvernment equipment. Persnal music players may be allwed in the classified area, but must nt have recrding, wireless, r Bluetth capabilities. Persnally wned hardware, sftware, and media are prhibited in classified areas Each user is respnsible fr any media that they create D nt mingle Unclassified and Classified prgram material Mark all classified printed material with the prper classificatin, headers, and fters n all pages Please see yur requisite security representative fr any site/prgram specific details. Page 8 f 13

9 SPECIALS As a part f maintaining yur additinal accesses the fllwing infrmatin is prvided. Fr area and custmer specific guidance, reach ut t yur lcal ISSM/ISSO r cmputer security pint f cntact. PASSWORD CREATION AND PROTECTION The standards fr passwrds and passwrd prtectin fr SAP/SCI cmputer systems are: Must be a minimum f 12 characters and at least cntain tw numeric, tw alpha uppercase, tw alpha lwercase, tw special characters and n mre than three character types in a rw. Passwrds must nt match any f the last 24 previus passwrds, and at least fur characters must be changed. Cmpsed f at least three different character classes. Change yur passwrd every 180 days (sme prgrams require a change every 90 days). D nt share yur passwrd with anyne. D nt use yur scial security, telephne r license plate numbers, r anything else that wuld be easy fr smene else t determine. Avid shulder surfers-smene clse enugh t watch yu type r guess yur passwrd. Passwrds shuld be unique acrss all f yur user accunts and acrss all systems yu use. CONFIGURATION MANAGEMENT ISSO r ISSM apprval is required t allw privileged users t: Install hardware and/r sftware Relcate hardware All hardware entering r exiting the classified area requires prir apprval by the prgram s ISSO/ISSM and the CPSO/GPSO. Unclassified Cmputers Unclassified cmputers in a classified area must have a strng prgram justificatin and Gvernment Custmer apprval. They must be registered with Cmputer Security and labeled apprpriately. A label will be placed n unclassified cmputers, mnitrs, keybards and printers. The standard label is green in clr, but the clr f the label may vary depending n the custmer. Check with yur Prgram Security Office (PSO) t see which ne is in use. A cautin label will be placed n equipment that cntains an internal hard drive. Page 9 f 13

10 Due t a high risk f cntaminatin f unclassified systems, media drives, micrphnes and USB prts are lcked r disabled. T help avid cmprmise, keep unclassified wrk areas clear f classified material. Be alert t which cmputer is being used. Security incidents ccur when classified infrmatin is entered nt unclassified systems. CLASSIFIED COMPUTERS Classified cmputers must be registered with Cmputer Security and labeled. A label will be placed n classified cmputers, mnitrs, keybards and printers. A yellw cautin label will be placed n equipment that cntains an internal hard drive. The standard classificatin labels are: Green=Unclassified Blue=Cnfidential Red=Secret Orange=Tp Secret Yellw=SCI Hwever, clrs may vary depending n the custmer. Check with yur CPSO t see which labels are in use. Due t a high risk f cmprmise, media drives and USB prts are disabled, lcked, r remved. If yu believe yur system hardware is enabled, cntact yur ISSO/ISSM. A minimum f three feet is required between classified hardware (cmputers, phnes, fax) and unclassified hardware. Yu are required t physically get up, nt swivel yur chair, when mving frm a classified cmputer t an unclassified cmputer. HARDWARE Hardware cnsists f all f the physical cmpnents that make up the system, which encmpasses cmputers, printers, test equipment, peripherals r any cmpnent cntaining memry. The fllwing frms must be used fr all hardware that is: Entering a classified area - Cmputer Registratin Frm Exiting f a classified area - Sanitizatin Prcess (Hardware Release) Frm Relcatin within a classified area - Mvement f AIS Frm and Cmputer Registratin Frm. Make sure that yur hardware has been apprved by Cmputer Security and a letter f vlatility is n file prir t entering the classified area. Page 10 f 13

11 When leaving a classified area, the sanitizatin prcess must be cmpleted by IT Slutins, Service Center technician, r Vendr technician and apprved by Cmputer Security befre the hardware is released. Users d nt mve hardware. Mdificatins t hardware cnfiguratin must be crdinated with IT Slutins and apprved by Cmputer Security. MEDIA Media is defined as any strage device that hlds digital data, such as, USB (flash, key, drive, thumb, jump, and stick, etc., t include dngles), cmpact discs, DVDs, tapes, flppies and internal drives, etc. Bring all incming media t yur CPSO. All incming media will be virus scanned, marked and lgged, including purchased sftware. Classified and unclassified media must be stred separately. Check with yur CPSO fr strage requirements in yur area. Blank media must be brught t Security fr strage. It is required that media be labeled at the highest classificatin level f the netwrk n which it was created. Unclassified media must be marked and write prtected. Persnally prduced media, (data r music) is prhibited in a classified area. Playing cmmercially manufactured music CDs n cmputers in the classified area is prhibited. They have been fund t cntain malicius cde embedded in the CD. They may be brught int the classified area and played n a stand-alne player nly. Thumb drives, memry sticks and flash cards are als prhibited. SOFTWARE/VIRUS PROTECTION IT Slutins prvides all standard applicatin sftware. If yu need sftware that is nt available frm IT Slutins, crdinate yur request with Cmputer Security. Sftware develped by a freign wned cmpany, even if residing in the U.S., requires apprval prir t purchase (sme U.S. vendrs distribute cde develped verseas). All sftware (i.e. COTS, GOTS, Open Surce, Shareware and Freeware) must receive Gvernment Security and ISSO apprval prir t installatin. Persnally wned sftware is prhibited within a classified area. Netwrk servers autmatically update virus definitins. It is imprtant t verify the server is updating yur virus definitins. Reprt any indicatin f virus cntaminatin t IT Slutins and Cmputer Security immediately. Page 11 f 13

12 /MEETING NOTICES It is the respnsibility f the riginatr t ensure that all s are apprpriately marked (which includes headers/fters, and prtin marks), and that all recipients n distributin have a valid "need- t-knw". When sending cmpany prprietary infrmatin via , the infrmatin must be marked with the apprpriate level per Nrthrp Grumman Crprate Prcedure CO J300 Prtectin f Infrmatin. If yu are transmitting Nrthrp Grumman Prprietary Level I internally, within the Nrthrp Grumman Managed Netwrk (NGMN), n encryptin is required. If yu are transmitting Prprietary externally, t recipients utside the NGMN, it must be encrypted. Level II must be encrypted fr internal and external transmissins. Only encryptin tls r cmmunicatin systems apprved by Infrmatin Security may be utilized. When inputting the subject matter int an Outlk meeting ntice n the classified system, the infrmatin must be unclassified. Many emplyees print ut a daily calendar and take it in and ut f the classified area. Keeping the subject matter unclassified eliminates the ptential fr a security vilatin. FILE TRANSFERS/MEDIA RELEASE File transfers frm classified systems t unclassified systems require a media release authrizatin. Media releases are the exceptin, nt the rule and are reserved fr missin critical files nly. It requires tw technical reviews, prgram management apprval, CPSO apprval, and a frensic review by Cmputer Security (ISSO/ISSM). If a media release is required, cntact Cmputer Security. All utging media must be apprved by Cmputer Security prir t remval. RISK MANAGED DOWNLOADS/MEDIA RELEASES Fr DD/SAP Risk Managed Dwnlads r SCI Media Releases: Require a cmpleted "Data Transfer Request Frm." Must be missin critical and have a valid missin justificatin. Requires signature apprval frm the prgram manager r IPT lead. Requires signature f a knwledgeable prgram accessed witness. Requester and witness are respnsible t ensure the data is at the classificatin level stated n the "Data Transfer Request Frm." Remember t examine print previews, master slides, and file prperties. Will be perfrmed by prgram security persnnel r authrized data transfer agents, if applicable. All utging media must be apprved by Cmputer Security prir t remval. Page 12 f 13

13 CONTACT INFORMATION This cncludes yur annual Security refresher training. Fr questins r guidance cntact yur lcal security representative, r call the Enterprise Security Shared Service at ; ptin 3, ptin 2. If yu are viewing this presentatin, n sme ther area than the Learning Exchange (LX), the ESSS Training Grup at ESSS_DDTraining@ngc.cm stating yu have cmpleted the security refresher training. In yur e mail include: Yur legal first and last name Yur MyID, and The training cnfirmatin cde (COMPSEC17) If yu are a derivative classifier, select the apprpriate link t cmplete the additinal training. Inside the NG Dmain Outside the NG Dmain Page 13 f 13