Goals of Information Technology Support

A few months ago I was casually discussing roles of IT personnel with a law enforcement professional. This discussion was rather short as we were only briefly going over the scope of duties. However, the discussion got me thinking about how much security is integrated (at least should be) with of IT support staff.

Yes, everyone’s job is security but IT needs to make sure security controls are working properly. The emphasis is being more proactive than reactionary. These goals best represent the department, and overall, the organization or agency.

In coordination with other departments, all IT support staff protect information and systems that store this information from compromise by performing the following:

1. Know where information is stored, copied, transmitted, and printed.
2. Know the planned end of life for information and information systems.
3. Protect information by taking appropriate preventative measures and corrective actions to protect information at rest in the data center, in transit through networks or media, and at the end of life.
   1. Properly protect information systems from viruses, worms, Trojan horses, and other malicious code.
   2. Install and update antivirus.
   3. Scan any outside owned external media for malware.
4. Be knowledgeable of required technical requirements and policies.
5. Take appropriate action to ensure maximum uptime and availability of information. Perform backups and restores using approved best practices.
   1. Perform data backups and take appropriate measures to protect critical information.
   2. Ensure only authorized personnel transport off-site backups that are removed from the data center.
   3. Ensure any electronic media released is properly sanitized or destroyed.
6. Use effective configuration management. Allow for timely application of system patches.
   1. Identify applications, services, and information systems containing software or components affected by recently announced software flaws and potential vulnerabilities resulting from those flaws.
7. Employ access control measures.
   1. Address least privilege and separation of duties.
   2. Enable event logging of:
      1. Successful and unsuccessful system log-on attempts.
      2. Successful and unsuccessful attempts to access, create, write, delete or change permission on a user account, file, directory or other system resources.
      3. Successful and unsuccessful attempts to change account passwords.
      4. Successful and unsuccessful actions by privileged accounts.
      5. Successful and unsuccessful attempts for users to access, modify, or destroy the audit log file.
   3. Prevent authorized users from utilizing publicly accessible computers.
      1. Publicly accessible computers include but are not limited to hotel business center computers, convention center computers, public library computers, public kiosk computers, etc.
8. Engage in effective account management.
   1. Ensure that all user IDs belong to currently authorized users.
   2. Keep login access current, updated, and monitored. Remove or disable terminated, transferred, or associated accounts.
   3. Authenticate verified users as uniquely identified.
   4. Prevent multiple concurrent active sessions for one user identification, unless authority is granted based upon operational business needs.
   5. Prevent usage of shared generic or default administrative user accounts or passwords for any device.
   6. Use strong password management.
      1. Follow secure password creation guidelines.
      2. Follow authorized standard of password rotation.
      3. Refrain from transmitting in the clear outside of the secure location.
      4. Obfuscate password display when entering.
      5. Ensure passwords are only reset for an authorized user.
9. Utilize network infrastructure protection measures.
   1. Take action to protect data from unauthorized public access.
   2. Control access and monitor boundary protection firewalls. Update configurations and patch firmware as needed.
   3. Enable and update personal firewall on mobile devices as needed.
   4. Ensure protected or confidential electronic data is only transmitted on secure network channels using encryption and advanced authentication when leaving data center. No protected or confidential data should ever be transmitted in clear text.
   5. Ensure any media that is removed from the data center is encrypted in transit by a person or network.
   6. Refrain from using default accounts on network equipment that pass information like switches, routers, firewalls, etc.
10. Communicate and keep appropriate personnel informed of all scheduled and unscheduled network that may involve system downtime.
11. Appropriately communicate all security incidents and general misuse.

This was a very basic and high-level list for protecting critical data. Your list will certainly vary depending on needs and equipment.

What would you change or add to the list?