ExportControl - Revision history

Dan: /* Access controls */

2023-03-29T20:27:02Z

Access controls

← Older revision		Revision as of 15:27, 29 March 2023
Line 11:		Line 11:
	#		#
	#; Protect Controlled Information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.		#; Protect Controlled Information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.
	#: All Beocat accounts are protected by a username/password. Beocat physical servers are in locked data centers in Durland Hall and Nichols Hall.		#: All Beocat accounts are protected by a username/password. Beocat physical servers are in locked data centers in Durland Hall and Nichols Hall. Data center access is logged, and multiple CCTV security cameras are in use to monitor visitor activity.

	=== System management ===		=== System management ===

Dan: /* Guidelines */

2023-01-19T17:01:20Z

Guidelines

← Older revision		Revision as of 12:01, 19 January 2023
Line 4:		Line 4:

	== Guidelines ==		== Guidelines ==
	Data subject to ITAR or EAR export control restrictions is referred to collectively below as Controlled Information.		Data subject to ITAR or EAR export control restrictions is referred to collectively below as Controlled Information. The following are typical guidelines and how Beocat addresses them.

	=== Access controls ===		=== Access controls ===

Dan: /* Export Controlled Data on Beocat */

2023-01-19T17:00:10Z

Export Controlled Data on Beocat

← Older revision		Revision as of 12:00, 19 January 2023
Line 1:		Line 1:
	== Export Controlled Data on Beocat ==		== Export Controlled Data on Beocat ==

	Export-controlled information housed on Beocat must be managed in accordance with these and relevant KSU guidelines. Export-controlled information that is received by or brought to KSU must be housed on a server designated for this purpose. Any exceptions must be explicitly approved by the Chief Information Security Officer, the Director of Export Compliance, and the Vice Provost for Research.		Export-controlled information housed on Beocat must be managed in accordance with these and relevant KSU guidelines. Export-controlled information that is received by or brought to KSU must be housed on a server designated for this purpose. Any exceptions must be explicitly approved by the Chief Information Security Officer, the Director of Export Compliance, and/or the Vice Provost for Research as appropriate.

	== Guidelines ==		== Guidelines ==

Dan: /* Access controls */

2023-01-19T16:59:13Z

Access controls

← Older revision		Revision as of 11:59, 19 January 2023
Line 8:		Line 8:
	=== Access controls ===		=== Access controls ===
	#; Do not post Controlled Information on public websites or websites that rely solely on IP addresses for access control. Instead, secure access using individually-assigned accounts requiring username/password, user certificates, or other user-specific authentication methods.		#; Do not post Controlled Information on public websites or websites that rely solely on IP addresses for access control. Instead, secure access using individually-assigned accounts requiring username/password, user certificates, or other user-specific authentication methods.
	#: All Beocat accounts are individually assigned requiring username/passwords This is done through K-State's eID system, using their account and password policies.		#: All Beocat accounts are individually assigned requiring username/passwords This is done through K-State's eID system, using their account and password policies. 2FA (e.g., Duo) is supported.
	#		#
	#; Protect Controlled Information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.		#; Protect Controlled Information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.

Dan: /* System management */

2022-04-28T19:07:37Z

System management

← Older revision		Revision as of 14:07, 28 April 2022
Line 15:		Line 15:
	=== System management ===		=== System management ===
	#; Use regularly-updated malware protection software		#; Use regularly-updated malware protection software
	#: ~~What counts as~~ malware ~~protection software in Linux? Does this need to be on all headnodes, compute nodes, or all systems? What are the performance implications of such things?~~		#: Nesus is used for malware detection.
	#		#
	#; Keep computers hosting Controlled Information up to date on security patches and updates.		#; Keep computers hosting Controlled Information up to date on security patches and updates.

Dan: /* System management */

2022-04-28T19:06:38Z

System management

← Older revision		Revision as of 14:06, 28 April 2022
Line 24:		Line 24:
	#		#
	#; Wipe electronic media in accordance with NIST 800–88 Guidelines for Media Sanitization		#; Wipe electronic media in accordance with NIST 800–88 Guidelines for Media Sanitization
	#: ~~electronic~~ media is disposed of following K-State's policies on [https://www.k-state.edu/policies/ppm/3400/3436.html Media Sanitization and Disposal]		#: Electronic media is disposed of following K-State's policies on [https://www.k-state.edu/policies/ppm/3400/3436.html Media Sanitization and Disposal]

	=== Transmission of Data ===		=== Transmission of Data ===

Dan at 13:23, 30 March 2022

2022-03-30T13:23:32Z

← Older revision		Revision as of 08:23, 30 March 2022
Line 1:		Line 1:
	=== Export Controlled Data on Beocat ===		== Export Controlled Data on Beocat ==

	Export-controlled information housed on Beocat must be managed in accordance with these and relevant KSU guidelines. Export-controlled information that is received by or brought to KSU must be housed on a server designated for this purpose. Any exceptions must be explicitly approved by the Chief Information Security Officer, the Director of Export Compliance, and the Vice Provost for Research.		Export-controlled information housed on Beocat must be managed in accordance with these and relevant KSU guidelines. Export-controlled information that is received by or brought to KSU must be housed on a server designated for this purpose. Any exceptions must be explicitly approved by the Chief Information Security Officer, the Director of Export Compliance, and the Vice Provost for Research.

Dan at 13:22, 30 March 2022

2022-03-30T13:22:56Z

← Older revision		Revision as of 08:22, 30 March 2022
Line 1:		Line 1:
	Export Controlled Data on Beocat		=== Export Controlled Data on Beocat ===

	Export-controlled information housed on Beocat must be managed in accordance with these guidelines. Export-controlled information that is received by or brought to KSU must be housed on a server designated for this purpose. Any exceptions must be explicitly approved by the Chief Information Security Officer, the Director of Export Compliance, and the Vice Provost for Research.		Export-controlled information housed on Beocat must be managed in accordance with these and relevant KSU guidelines. Export-controlled information that is received by or brought to KSU must be housed on a server designated for this purpose. Any exceptions must be explicitly approved by the Chief Information Security Officer, the Director of Export Compliance, and the Vice Provost for Research.

	== Guidelines ==		== Guidelines ==
Line 34:		Line 34:
	#		#
	#; Detect exfiltration of data using firewalls, router policies, intrusion prevention/detection systems, or host-based security services.		#; Detect exfiltration of data using firewalls, router policies, intrusion prevention/detection systems, or host-based security services.
	#: We use firewalls to prevent exfiltration, and perform monitoring of logs from an Elastic Stack instance for intrusion detection and prevention. We run a ~~nessus~~ agent on many user facing systems.		#: We use firewalls to prevent exfiltration, and perform monitoring of logs from an Elastic Stack instance for intrusion detection and prevention. We run a Nessus agent on many user facing systems.
	#		#
	#; Transfer controlled information only to subcontractors with a need to know. Subcontractors must adhere to these same data protection requirements. Include these data protection requirements, including this requirement, in all subcontracts if access to or generation of controlled data will take place.		#; Transfer controlled information only to subcontractors with a need to know. Subcontractors must adhere to these same data protection requirements. Include these data protection requirements, including this requirement, in all subcontracts if access to or generation of controlled data will take place.
Line 42:		Line 42:
	In such cases where the Controlled Information is a software executable that will be run on a shared (multi-user) system such as a compute cluster, the following additional guidelines apply:		In such cases where the Controlled Information is a software executable that will be run on a shared (multi-user) system such as a compute cluster, the following additional guidelines apply:
	#; The directories containing the software shall be access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others shall have no access permissions.		#; The directories containing the software shall be access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others shall have no access permissions.
	#: All Beocat user directories are access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others have no access permissions.		#: All Beocat user directories are access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others have no access permissions. Any exceptions require prior written approval by the appropriate authorities.
	#		#
	#; The shared system shall be managed solely by U.S. Persons, as defined in the export regulations. All users with root or sudo privileges must be U.S. Persons.		#; The shared system shall be managed solely by U.S. Persons, as defined in the export regulations. All users with root or sudo privileges must be U.S. Persons.

Mozes: /* Transmission of Data */

2022-03-29T20:41:28Z

Transmission of Data

← Older revision		Revision as of 15:41, 29 March 2022
Line 34:		Line 34:
	#		#
	#; Detect exfiltration of data using firewalls, router policies, intrusion prevention/detection systems, or host-based security services.		#; Detect exfiltration of data using firewalls, router policies, intrusion prevention/detection systems, or host-based security services.
	#: We use firewalls to prevent exfiltration, and perform monitoring of logs for intrusion detection and prevention.		#: We use firewalls to prevent exfiltration, and perform monitoring of logs from an Elastic Stack instance for intrusion detection and prevention. We run a nessus agent on many user facing systems.
	#		#
	#; Transfer controlled information only to subcontractors with a need to know. Subcontractors must adhere to these same data protection requirements. Include these data protection requirements, including this requirement, in all subcontracts if access to or generation of controlled data will take place.		#; Transfer controlled information only to subcontractors with a need to know. Subcontractors must adhere to these same data protection requirements. Include these data protection requirements, including this requirement, in all subcontracts if access to or generation of controlled data will take place.

Mozes: Undo revision 788 and number each entry in each section

2022-03-29T20:34:40Z

Undo revision 788 and number each entry in each section

← Older revision		Revision as of 15:34, 29 March 2022
Line 6:		Line 6:
	Data subject to ITAR or EAR export control restrictions is referred to collectively below as Controlled Information.		Data subject to ITAR or EAR export control restrictions is referred to collectively below as Controlled Information.

	# Access controls		=== Access controls ===
	#; Do not post Controlled Information on public websites or websites that rely solely on IP addresses for access control. Instead, secure access using individually-assigned accounts requiring username/password, user certificates, or other user-specific authentication methods.		#; Do not post Controlled Information on public websites or websites that rely solely on IP addresses for access control. Instead, secure access using individually-assigned accounts requiring username/password, user certificates, or other user-specific authentication methods.
	#: All Beocat accounts are individually assigned requiring username/passwords This is done through K-State's eID system, using their account and password policies.		#: All Beocat accounts are individually assigned requiring username/passwords This is done through K-State's eID system, using their account and password policies.
			#
	#; Protect Controlled Information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.		#; Protect Controlled Information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.
	#: All Beocat accounts are protected by a username/password. Beocat physical servers are in locked data centers in Durland Hall and Nichols Hall.		#: All Beocat accounts are protected by a username/password. Beocat physical servers are in locked data centers in Durland Hall and Nichols Hall.
	# System management
			=== System management ===
	#; Use regularly-updated malware protection software		#; Use regularly-updated malware protection software
	#: What counts as malware protection software in Linux? Does this need to be on all headnodes, compute nodes, or all systems? What are the performance implications of such things?		#: What counts as malware protection software in Linux? Does this need to be on all headnodes, compute nodes, or all systems? What are the performance implications of such things?
			#
	#; Keep computers hosting Controlled Information up to date on security patches and updates.		#; Keep computers hosting Controlled Information up to date on security patches and updates.
	#: We perform routine updates on our systems.		#: We perform routine updates on our systems.
			#
	#; All Controlled Information must be encrypted if stored on mobile computing devices such as laptops, PDA's and removable media such as thumb drives or CD/DVD. See additional notes below.		#; All Controlled Information must be encrypted if stored on mobile computing devices such as laptops, PDA's and removable media such as thumb drives or CD/DVD. See additional notes below.
	#: All storage holding potentially sensitive information is encrypted using LUKS and/or encrypted using aes256.		#: All storage holding potentially sensitive information is encrypted using LUKS and/or encrypted using aes256.
			#
	#; Wipe electronic media in accordance with NIST 800–88 Guidelines for Media Sanitization		#; Wipe electronic media in accordance with NIST 800–88 Guidelines for Media Sanitization
	#: electronic media is disposed of following K-State's policies on [https://www.k-state.edu/policies/ppm/3400/3436.html Media Sanitization and Disposal]		#: electronic media is disposed of following K-State's policies on [https://www.k-state.edu/policies/ppm/3400/3436.html Media Sanitization and Disposal]
	# Transmission of Data
			=== Transmission of Data ===
	#; Do not transmit or email Controlled Information unencrypted. If encryption is not available, data must be individually encrypted using at least application-provided mechanisms such as the password-based encryption provided in Microsoft Office 2007 and above.		#; Do not transmit or email Controlled Information unencrypted. If encryption is not available, data must be individually encrypted using at least application-provided mechanisms such as the password-based encryption provided in Microsoft Office 2007 and above.
	#: All access to Beocat is encrypted.		#: All access to Beocat is encrypted.
			#
	#; Provide monitoring and control over inbound and outbound network traffic. Block unauthorized ingress and egress.		#; Provide monitoring and control over inbound and outbound network traffic. Block unauthorized ingress and egress.
	#: We monitor inbound and outbound traffic. Unauthorized ingress and egress is controlled via firewalls.		#: We monitor inbound and outbound traffic. Unauthorized ingress and egress is controlled via firewalls.
			#
	#; Detect exfiltration of data using firewalls, router policies, intrusion prevention/detection systems, or host-based security services.		#; Detect exfiltration of data using firewalls, router policies, intrusion prevention/detection systems, or host-based security services.
	#: We use firewalls to prevent exfiltration, and perform monitoring of logs for intrusion detection and prevention.		#: We use firewalls to prevent exfiltration, and perform monitoring of logs for intrusion detection and prevention.
			#
	#; Transfer controlled information only to subcontractors with a need to know. Subcontractors must adhere to these same data protection requirements. Include these data protection requirements, including this requirement, in all subcontracts if access to or generation of controlled data will take place.		#; Transfer controlled information only to subcontractors with a need to know. Subcontractors must adhere to these same data protection requirements. Include these data protection requirements, including this requirement, in all subcontracts if access to or generation of controlled data will take place.
	#: Information transfer to subcontractors is controlled by, and the responsibility of, the individual Beocat user.		#: Information transfer to subcontractors is controlled by, and the responsibility of, the individual Beocat user.
	# Shared ~~System~~
	#:In such cases where the Controlled Information is a software executable that will be run on a shared (multi-user) system such as a compute cluster, the following additional guidelines apply:		=== Shared Systems ===
			In such cases where the Controlled Information is a software executable that will be run on a shared (multi-user) system such as a compute cluster, the following additional guidelines apply:
	#; The directories containing the software shall be access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others shall have no access permissions.		#; The directories containing the software shall be access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others shall have no access permissions.
	#: All Beocat user directories are access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others have no access permissions.		#: All Beocat user directories are access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others have no access permissions.
			#
	#; The shared system shall be managed solely by U.S. Persons, as defined in the export regulations. All users with root or sudo privileges must be U.S. Persons.		#; The shared system shall be managed solely by U.S. Persons, as defined in the export regulations. All users with root or sudo privileges must be U.S. Persons.
	#: All Beocat staff and those with root/sudo privileges are U.S. Persons.		#: All Beocat staff and those with root/sudo privileges are U.S. Persons.
			#
	#; Only U.S. Persons shall have unescorted physical access to the shared system.		#; Only U.S. Persons shall have unescorted physical access to the shared system.
	#: Visitors to the Engineering and Nichols Data Centers are required to be escorted.		#: Visitors to the Engineering and Nichols Data Centers are required to be escorted.