Technology Guidelines

Version: 1.0

Status: Approved: November 1, 2002
Contact: Valerie Adkins

PURPOSE:

To provide general information to aid in the planning, installation, and implementation of a Local Area Network (LAN).

SCOPE:

This guideline targets the physical facilities and the supporting infrastructure.

APPLICABILITY:

This guideline is applicable to all VCCS colleges and campuses. 

DEFINITION:

Local Area Network - a communications infrastructure that lies within a limited spatial area, with a specific user group, a specific topology, and may be connected to switched telecommunications network providing transport for voice, video, data and the related services.

GUIDELINE:

The checklist provides an outline of what to included when installing a Local Area Network. These guidelines will assist in planning network security from the facilities perspective. It is important to understand that these guidelines do not specifically apply to particular Operating Systems.  These items are guidelines to developing a security policy for securing physical access to Local Area Networks. They may change based on the business requirements and personnel at each college. This is not an all inclusive list, but it is a good foundation for developing a baseline security approach to assist in the development of the VCCS Network.

Checklist:

• Put all Servers in a restricted area. The facility should be protected by a locking mechanism. Ideally you would have the access mechanism to log who enters and who leaves the privileged area.
• The wiring closets should be secured by a locking mechanism (card reader, etc.)
• The environmental control systems (i.e. power, hvac) should be secured by a locking mechanism.
• The restricted area that all servers and network components reside, should be in a temperature controlled environment. This area ideally would have externally sourced power from the rest of the building. This power configuration would have a redundant power source to keep the environmental controls and security controls on-line.
• Each Restricted area would require Sign-In/Sign-Out Log.
• Closed Circuit TV would ideally monitor each restricted area. (This would be for high-security areas)

• Any Network Access Requests should be documented with a physical request form. This form would detail the following:

  • Username/Password

  • Department

  • Address/Phone Number

  • Manager Name/Phone Number

  • Agreement to follow the Acceptable Use Policy for the Network and its resources outlined by the College

  • Applications and Resources that this user needs to access

  • Remote Access Requirements

• All network ports should be disabled until they are put into production. This would require any new user to request a network connection from the IT Department. This control would help manage who is connecting to the network.

• Logging and Auditing of all Server and Network Logs should be done on a regular basis. This time table would be individual of each colleges needs and business requirements.
• All restricted areas would not allow access from the ceiling (i.e. drop ceilings) This recommendation is meant for very secure facilities.
• All Servers would have the latest Security Patches and OS Patches installed
• All Servers would have Screen Savers with Passwords
• All Servers would allow only Administrators to Log-In Locally
• All Servers would require a BIOS Password
• All Servers would have their floppy drives disabled. Having the password to the bios could only enable them. This would allow for patches, etc.. by administrative staff only.
• All Servers would have their CD-ROM Boot Option Disabled.
• All Network Devices would require authentication from a central authentication server - i.e. Cisco Secure Tacacs Server. Secure ID would also be ideal to be used to control access to servers and network components.
•  

Return to Security