Security Guide for Interconnecting Information Technology Systems ANUSHA KAMINENI SECURITY MANAGEMENT

AGENDA Introduction Background Lifecycle of System Interconnection

EXECUTIVE SUMMARY Security guide for Interconnecting systems Life-Cycle Management Planning a system interconnection Establishing a system interconnection Maintaining a system interconnection Disconnecting a system interconnection ISA and MOU/A System Interconnection Implementation plan

INTRODUCTION Authority Purpose Scope Audience Document Structure

Figure 1: Interconnection Components BACKGROUND Figure 1: Interconnection Components

Why to interconnect IT systems? Exchange data & information Provide customized levels Collaborate on Joint projects Provide full time communications Provide online training Provide secure storage of data

PLANNING A SYSTEM INTERCONNECTION Figure 2. Steps to plan a system interconnection

PLANNING A SYSTEM INTERCONNECTION Establish a Joint planning team Define the Business case Perform C & A Determine Interconnection Requirements Document Interconnection Agreement Approve or Reject Interconnection

Determine Interconnection Requirements Level and method of interconnection Impact on existing Infrastructure and Operations Hardware Requirements Software Requirements Data Sensitivity User Community Services and Applications Security controls Segregation of Duties Incident Reporting and Response Contingency Planning

…..continued Determine Interconnection Requirements Data element naming and ownership Data Backup Change Management Rules of Behavior Security Training and Awareness Roles and Responsibilities Scheduling Costs and Budgeting

Document Interconnection Agreement Develop an interconnection security agreement Establish a memorandum of Understanding

Approve or Reject Interconnection Approve the interconnection Grant interim approval Reject the interconnection

ESTABLISHING A SYSTEM INTERCONNECTION Fig 3. Steps to Establish a system Interconnection

ESTABLISHING A SYSTEM INTERCONNECTION Develop Implementation Plan Execute Implementation Plan Activate Interconnection

Execute Implementation Plan Implement or configure security controls Firewalls Intrusion Detection Auditing Identification and Authentication Logical Access controls Virus scanning Encryption Physical and Environmental security

…. continued Execute Implementation Plan Install or configure hardware and software Communications line VPN Routers and switches Hubs Servers Computer Workstations Integrate Applications Conduct operational and security testing Conduct security Training and awareness Update systems security plans Perform Recertification and Reaccreditation

MAINTAINING A SYSTEM INTERCONNECTION Maintain clear lines of communication Maintain equipment Manage user Profiles Conduct security reviews Analyze audit logs Report & respond to security incidents Coordinate contingency planning activities Perform Change management Maintain system security plans

DISCONNECTING A SYSTEM INTERCONNECTION Planned disconnection Emergency disconnection Restoration of interconnection

EXECUTIVE SUMMARY Security guide for Interconnecting systems Life-Cycle Management Planning a system interconnection Establishing a system interconnection Maintaining a system interconnection Disconnecting a system interconnection ISA and MOU/A System Interconnection Implementation plan

IMPORTANT TERMS Audit Trail Integrated Services Digital Network(ISDN) Interconnection Security Agreement(ISA) Intrusion Detection System (IDS) Memorandum of Understanding/Agreement(MOU/A) RADIUS (Remote Authentication Dial-In User Service) Security Controls System interconnection Virtual Private Network(VPN)

QUESTIONS?