A.5 ABC Inc. InfoSec Network Policy

Policy No. 4

Effective date Month / Day / Year

Implement by Month / Day / Year

1.0 Purpose

This policy establishes information security requirements for ABC Inc.'s network to ensure that ABC Inc.'s confidential information and technologies are not compromised, and that production services and other ABC Inc. interests are protected.

2.0 Scope

This policy applies to all internal networks, ABC Inc. employees , and third parties who access ABC Inc. networks. All existing and future equipment, which fall under the scope of this policy, must be configured according to the referenced documents.

3.0 Policy

3.1 Ownership Responsibilities

Network Operations is responsible for the security of the networks and the network's impact on the corporation. Network managers are responsible for adherence to this policy and associated processes. Where policies and procedures are undefined , network managers must do their best to safeguard ABC Inc. from security vulnerabilities.
Network Operations is responsible for the network's compliance with all ABC Inc. security policies. The following are particularly important:
- ABC Inc. Anti-Virus Policy
- ABC Inc. Dial-in Policy
- ABC Inc. Extranet Policy
- ABC Inc. Password Policy
- ABC Inc. Password Protection Policy
- ABC Inc. Remote Access Policy
- ABC Inc. Router Security Policy
- ABC Inc. Server Security Policy
- ABC Inc. VPN Security Policy
- ABC Inc. Wireless Communications Policy
- ABC Inc. Physical Security Policy
Network Operations is responsible for controlling network access. Access to any given network will only be granted by Network Operations to those individuals with an immediate business need within the network, either short- term or as defined by their ongoing job function. This includes continually monitoring the access list to ensure that those who no longer require access to the network have their access terminated .
Network Operations and/or InfoSec reserve the right to interrupt network connections that impact the corporate production network negatively or pose a security risk.
Network Operations must manage all network IP addresses, which are routed within ABC Inc. networks.
Any network that wants to add an external connection must provide a diagram and documentation to InfoSec with business justification, the equipment, and the IP address space information. InfoSec will review for security concerns and must approve before such connections are implemented. Access to the ABC Inc. network from a third party must use ABC Inc.'s managed firewall.
All user passwords must comply with Password Policy. In addition, individual user accounts on any network device must be deleted when no longer authorized within three days. Group account passwords on network computers (Unix, windows , etc.) must be changed quarterly (once every 3 months). Groups accounts must be approved by the IT Network Operations group. For any network device that contains ABC Inc. proprietary information, group account passwords must be changed within three days following a change in group membership.
InfoSec will address non-compliance waiver requests on a case-by-case basis and approve waivers if justified through the completion of the Policy Exception Form.

3.2 General Configuration Requirements

All external network IP traffic must go through a Network Operations maintained firewall.
Original firewall configurations and any changes must be reviewed and approved through the proper IT Operations Change Control process. InfoSec may require security improvements as needed.
Networks are prohibited from engaging in port scanning, network auto-discovery , traffic spamming /flooding, and other similar activities that negatively impact the corporate network and/or non-ABC Inc. networks.
InfoSec reserves the right to audit all network- related data and administration processes at any time, including but not limited to, inbound and outbound packets, firewalls, and network peripherals.
Network gateway devices are required to comply with all ABC Inc. product security advisories and must authenticate against the Corporate Authentication servers.
The password for all network gateway devices must be different from all other equipment passwords in the network. The password must be in accordance with Password Policy. The password will only be provided to those who are authorized to administer the network. There will be no group accounts, and anyone accessing these devices will have an individual account.
In networks where non-ABC Inc. personnel have physical access (e.g., training networks), direct connectivity to the corporate production network is not allowed. Additionally, no ABC Inc. confidential information can reside on any computer equipment in these networks. Connectivity for authorized personnel from these networks can be allowed to the corporate production network only if authenticated against the Corporate Authentication servers, temporary access lists (lock and key), SSH, client VPNs, or similar technology approved by InfoSec.
All network external connection requests must be reviewed and approved by InfoSec. Analog or ISDN lines must be configured to only accept trusted call numbers . Strong passwords must be used for authentication.
All networks with external connections must not be connected to ABC Inc. corporate production network or any other internal network directly or via a wireless connection, or via any other form of computing equipment. A waiver from InfoSec is required where air-gapping is not possible (e.g., Partner Connections to third party networks).

4.0 Enforcement

Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

5.0 Definitions

DMZ (De-Militarized Zone): This describes networks that exist outside of primary corporate firewalls, but are still under ABC Inc. administrative control.

External Connections: Connections that include (but are not limited to) third-party connections, such as a DMZ, data network-to-network, analog and ISDN data lines, or any other Telco data lines.

Extranet: Connections between third parties that require access to connections non-public ABC Inc. resources, as defined in InfoSec's Extranet policy (link).

Firewall: A device that controls access between networks. It can be a PIX, a router with access control lists, or similar security devices approved by InfoSec.

Internal: A network that is within ABC Inc.'s corporate firewall and connected to ABC Inc.'s corporate production network

Network: A network is any non-production environment, intended specifically for developing, demonstrating, training, and/or testing of a product.

Network Manager: The individual who is responsible for all network activities and personnel

Network Owned Gateway Device: A network owned gateway device is the network device that connects the network to the rest of ABC Inc.'s network. All traffic between the network and the corporate production network must pass through the network owned gateway device unless approved by InfoSec.

Network Support Organization: Any InfoSec approved ABC Inc. support organization that manages the networking of non-network networks.

Telco: A Telco is the equivalent to a service provider. Telcos offer network connectivity, e.g., T1, T3, OC3, OC12 or DSL. Telcos are sometimes referred to as "baby bells ," although Sprint and AT&T are also considered Telcos. Telco interfaces include BRI, or Basic Rate Interface, a structure commonly used for ISDN service, and PRI, Primary Rate Interface, a structure for voice/dial-up service.

Traffic: Mass volume of unauthorized and/or unsolicited network Spamming/Flooding traffic.

6.0 Exceptions

Exceptions to information system security policies exist in rare instances where a risk assessment examining the implications of being out of compliance has been performed, where a Systems Security Policy Exception Form has been prepared by the data owner or management, and where this form has been approved by both the CSO or Director of InfoSec and the Chief Information Officer (CIO).

7.0 Revision History

Date ___/____/_____

Version:_______________________

Author:____________________________________

Summary:__________________________________