Cloud Server Security Policy

Unsecured and vulnerable servers continue to be a major entry point for malicious threat actors. Consistent server security policies, ownership and configuration management are all about doing the basics well.

The purpose of this policy is to establish standards for the base configuration of cloud server equipment that is outside of the Diocese of Paterson (DoP). Effective implementation of this policy will minimize unauthorized access to the Diocese of Paterson’s proprietary information and technology.

All employees, contractors, consultants, temporary, volunteer and other workers at DoP and its subsidiaries must adhere to this policy. This policy applies to server equipment that is owned, operated, or leased by DoP or registered under the Diocese of Paterson. This policy specifies requirements for equipment on the DoP cloud environments.

• 4.1 General Requirements
  • 4.1.1 All cloud servers deployed at the DoP must be owned by an office that is responsible for system administration. Approved server configuration guides must be established and maintained by each office, based on office needs, and should be compliant with the guidelines, standards, and policies of the DoP technology department as well as local state and federal laws. Diocese center offices should monitor configuration compliance and implement an exception policy tailored to their environment. Each office must establish a process for changing the configuration guides, which includes review and approval by the DoP technology department. Diocesan locations should follow suit in establishing these process. The following items must be met:
    • Servers must be registered with the DoP IT team (support will be available upon request).
    • Information in the system must be kept up to date.
    • Configuration changes for production servers must follow the appropriate change management procedures.
  • 4.1.2 For security, compliance, and maintenance purposes, authorized personnel may monitor and audit equipment, systems, processes, and network traffic per Information Logging Standard.
  • 4.1.3 Within the server itself the use of special characters is prohibited. This includes but is not limited to the following characters: [ , . ; - _ = + () {} [] & % $ # @ ! ^ ]
  • 4.1.4 Finally, no file can end in a period (e.g., temp.)
• 4.2 Configuration Requirements
  • 4.2.1 Services and application that will not be used must be disabled where practical.
  • 4.2.2 Backups must have some form of RAID enabled to comply with state and federal laws.
  • 4.2.3 Chancery cloud server must have backups on the following approved programs and Diocesan locations are encouraged to implement the same systems.
    • Unitrends
    • The archiver
    • Barracuda backup
  • 4.2.4 Unless absolutely required all countries except the USA and Canada should be geo-fenced.
  • 4.2.5 Access to services should be logged and/or protected through access-control methods such as a web application firewall, if possible.
  • 4.2.6 Trust relationships between systems are a security risk, and their use should be avoided. Do not use a trust relationship when some other method of communication is sufficient.
  • 4.2.7 Always use standard security principles of least required access to perform a function. (Do not use root when a non-privileged account will do).
  • 4.2.8 If a methodology for secure channel connection is available (i.e., technically feasible), privileged access must be performed over secure channels, (e.g., encrypted network connections using SSH or IPsec).
  • 4.2.9 Cloud inventory must be configured to ensure appropriate measures are taking place to secure data. (HIPAA/COPPA compliance if server contains PHI [Protected Health Information] of child PII [Personal Identifiable Information])
  • 4.2.10 All steps within the Cybersecurity guidelines must be followed at a minimum.
  • 4.2.11 Training procedures to correctly demonstrate how to use the service must be done to ensure all users within the office understand the proper usage of the service.
• 4.3 Monitoring
  • 4.3.1 All security-related events on critical or sensitive systems must be logged and audit trails saved as follows:
    • All security-related logs will be kept online for a minimum of 4 weeks.
    • Daily incremental backups will be retained for at least 3 months.
    • Weekly full tape backups of logs will be retained for at least 6 months.
    • Monthly full backups will be retained for a minimum of 3 years.
    • All sacrament-based information must be kept permanently and backups of these must also be kept indefinitely.
  • 4.3.2 Security-related events will be reported to the DoP technology department, who will review logs and report incidents to IT management. Corrective measures will be prescribed as needed. Security-related events include, but are not limited to:
    • Port-scan attacks.
    • Evidence of unauthorized access to privileged accounts.
    • Anomalous occurrences that are not related to specific applications on the host.

• 5.1 Compliance measurement
  The DoP Technology team may verify compliance to this Standard through various methods, including but not limited to, business tool reports, internal and external audits and feedback to the Standard owner.
• 5.2 Exception
  All devices should be compliant with cyber insurance standards and local/federal governance standards. Any exception/outliers should be approved by the DoP Technology team in advance.
• 5.3 Non-Compliance
  Any employee found to have violated this Standard may be subject to disciplinary action, up to and including termination of employment.

• 6.1 Cloud Security

None.