From Beocat
Jump to: navigation, search
(numeric list formatting)
(Undo revision 788 and number each entry in each section)
Tag: Undo
Line 6: Line 6:
Data subject to ITAR or EAR export control restrictions is referred to collectively below as Controlled Information.
Data subject to ITAR or EAR export control restrictions is referred to collectively below as Controlled Information.


# Access controls
=== Access controls ===
#; Do not post Controlled Information on public websites or websites that rely solely on IP addresses for access control. Instead, secure access using individually-assigned accounts requiring username/password, user certificates, or other user-specific authentication methods.
#; Do not post Controlled Information on public websites or websites that rely solely on IP addresses for access control. Instead, secure access using individually-assigned accounts requiring username/password, user certificates, or other user-specific authentication methods.
#: All Beocat accounts are individually assigned requiring username/passwords This is done through K-State's eID system, using their account and password policies.
#: All Beocat accounts are individually assigned requiring username/passwords This is done through K-State's eID system, using their account and password policies.
#
#; Protect Controlled Information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.
#; Protect Controlled Information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.
#: All Beocat accounts are protected by a username/password. Beocat physical servers are in locked data centers in Durland Hall and Nichols Hall.
#: All Beocat accounts are protected by a username/password. Beocat physical servers are in locked data centers in Durland Hall and Nichols Hall.
# System management  
 
=== System management ===
#; Use regularly-updated malware protection software
#; Use regularly-updated malware protection software
#: What counts as malware protection software in Linux? Does this need to be on all headnodes, compute nodes, or all systems? What are the performance implications of such things?
#: What counts as malware protection software in Linux? Does this need to be on all headnodes, compute nodes, or all systems? What are the performance implications of such things?
#
#; Keep computers hosting Controlled Information up to date on security patches and updates.
#; Keep computers hosting Controlled Information up to date on security patches and updates.
#: We perform routine updates on our systems.
#: We perform routine updates on our systems.
#
#; All Controlled Information must be encrypted if stored on mobile computing devices such as laptops, PDA's and removable media such as thumb drives or CD/DVD. See additional notes below.
#; All Controlled Information must be encrypted if stored on mobile computing devices such as laptops, PDA's and removable media such as thumb drives or CD/DVD. See additional notes below.
#: All storage holding potentially sensitive information is encrypted using LUKS and/or encrypted using aes256.
#: All storage holding potentially sensitive information is encrypted using LUKS and/or encrypted using aes256.
#
#; Wipe electronic media in accordance with NIST 800–88 Guidelines for Media Sanitization
#; Wipe electronic media in accordance with NIST 800–88 Guidelines for Media Sanitization
#: electronic media is disposed of following K-State's policies on [https://www.k-state.edu/policies/ppm/3400/3436.html Media Sanitization and Disposal]
#: electronic media is disposed of following K-State's policies on [https://www.k-state.edu/policies/ppm/3400/3436.html Media Sanitization and Disposal]
# Transmission of Data
 
=== Transmission of Data ===
#; Do not transmit or email Controlled Information unencrypted. If encryption is not available, data must be individually encrypted using at least application-provided mechanisms such as the password-based encryption provided in Microsoft Office 2007 and above.
#; Do not transmit or email Controlled Information unencrypted. If encryption is not available, data must be individually encrypted using at least application-provided mechanisms such as the password-based encryption provided in Microsoft Office 2007 and above.
#: All access to Beocat is encrypted.
#: All access to Beocat is encrypted.
#
#; Provide monitoring and control over inbound and outbound network traffic. Block unauthorized ingress and egress.
#; Provide monitoring and control over inbound and outbound network traffic. Block unauthorized ingress and egress.
#: We monitor inbound and outbound traffic. Unauthorized ingress and egress is controlled via firewalls.
#: We monitor inbound and outbound traffic. Unauthorized ingress and egress is controlled via firewalls.
#
#; Detect exfiltration of data using firewalls, router policies, intrusion prevention/detection systems, or host-based security services.
#; Detect exfiltration of data using firewalls, router policies, intrusion prevention/detection systems, or host-based security services.
#: We use firewalls to prevent exfiltration, and perform monitoring of logs for intrusion detection and prevention.
#: We use firewalls to prevent exfiltration, and perform monitoring of logs for intrusion detection and prevention.
#
#; Transfer controlled information only to subcontractors with a need to know. Subcontractors must adhere to these same data protection requirements. Include these data protection requirements, including this requirement, in all subcontracts if access to or generation of controlled data will take place.
#; Transfer controlled information only to subcontractors with a need to know. Subcontractors must adhere to these same data protection requirements. Include these data protection requirements, including this requirement, in all subcontracts if access to or generation of controlled data will take place.
#: Information transfer to subcontractors is controlled by, and the responsibility of, the individual Beocat user.
#: Information transfer to subcontractors is controlled by, and the responsibility of, the individual Beocat user.
# Shared System
 
#:In such cases where the Controlled Information is a software executable that will be run on a shared (multi-user) system such as a compute cluster, the following additional guidelines apply:
=== Shared Systems ===
In such cases where the Controlled Information is a software executable that will be run on a shared (multi-user) system such as a compute cluster, the following additional guidelines apply:
#; The directories containing the software shall be access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others shall have no access permissions.
#; The directories containing the software shall be access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others shall have no access permissions.
#: All Beocat user directories are access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others have no access permissions.
#: All Beocat user directories are access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others have no access permissions.
#
#; The shared system shall be managed solely by U.S. Persons, as defined in the export regulations. All users with root or sudo privileges must be U.S. Persons.
#; The shared system shall be managed solely by U.S. Persons, as defined in the export regulations. All users with root or sudo privileges must be U.S. Persons.
#: All Beocat staff and those with root/sudo privileges are U.S. Persons.
#: All Beocat staff and those with root/sudo privileges are U.S. Persons.
#
#; Only U.S. Persons shall have unescorted physical access to the shared system.
#; Only U.S. Persons shall have unescorted physical access to the shared system.
#: Visitors to the Engineering and Nichols Data Centers are required to be escorted.
#: Visitors to the Engineering and Nichols Data Centers are required to be escorted.

Revision as of 15:34, 29 March 2022

Export Controlled Data on Beocat

Export-controlled information housed on Beocat must be managed in accordance with these guidelines. Export-controlled information that is received by or brought to KSU must be housed on a server designated for this purpose. Any exceptions must be explicitly approved by the Chief Information Security Officer, the Director of Export Compliance, and the Vice Provost for Research.

Guidelines

Data subject to ITAR or EAR export control restrictions is referred to collectively below as Controlled Information.

Access controls

  1. Do not post Controlled Information on public websites or websites that rely solely on IP addresses for access control. Instead, secure access using individually-assigned accounts requiring username/password, user certificates, or other user-specific authentication methods.
    All Beocat accounts are individually assigned requiring username/passwords This is done through K-State's eID system, using their account and password policies.
  2. Protect Controlled Information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.
    All Beocat accounts are protected by a username/password. Beocat physical servers are in locked data centers in Durland Hall and Nichols Hall.

System management

  1. Use regularly-updated malware protection software
    What counts as malware protection software in Linux? Does this need to be on all headnodes, compute nodes, or all systems? What are the performance implications of such things?
  2. Keep computers hosting Controlled Information up to date on security patches and updates.
    We perform routine updates on our systems.
  3. All Controlled Information must be encrypted if stored on mobile computing devices such as laptops, PDA's and removable media such as thumb drives or CD/DVD. See additional notes below.
    All storage holding potentially sensitive information is encrypted using LUKS and/or encrypted using aes256.
  4. Wipe electronic media in accordance with NIST 800–88 Guidelines for Media Sanitization
    electronic media is disposed of following K-State's policies on Media Sanitization and Disposal

Transmission of Data

  1. Do not transmit or email Controlled Information unencrypted. If encryption is not available, data must be individually encrypted using at least application-provided mechanisms such as the password-based encryption provided in Microsoft Office 2007 and above.
    All access to Beocat is encrypted.
  2. Provide monitoring and control over inbound and outbound network traffic. Block unauthorized ingress and egress.
    We monitor inbound and outbound traffic. Unauthorized ingress and egress is controlled via firewalls.
  3. Detect exfiltration of data using firewalls, router policies, intrusion prevention/detection systems, or host-based security services.
    We use firewalls to prevent exfiltration, and perform monitoring of logs for intrusion detection and prevention.
  4. Transfer controlled information only to subcontractors with a need to know. Subcontractors must adhere to these same data protection requirements. Include these data protection requirements, including this requirement, in all subcontracts if access to or generation of controlled data will take place.
    Information transfer to subcontractors is controlled by, and the responsibility of, the individual Beocat user.

Shared Systems

In such cases where the Controlled Information is a software executable that will be run on a shared (multi-user) system such as a compute cluster, the following additional guidelines apply:

  1. The directories containing the software shall be access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others shall have no access permissions.
    All Beocat user directories are access controlled so that only its designated user(s) as approved by the PI will have read, write and execute permissions. All others have no access permissions.
  2. The shared system shall be managed solely by U.S. Persons, as defined in the export regulations. All users with root or sudo privileges must be U.S. Persons.
    All Beocat staff and those with root/sudo privileges are U.S. Persons.
  3. Only U.S. Persons shall have unescorted physical access to the shared system.
    Visitors to the Engineering and Nichols Data Centers are required to be escorted.