Cloud Storage Security Policy

Cloud security is an ever-growing threat to our organization and as such we must be prepared to handle any situation that may arise. Below is a set of policies that at minimum must be handled in order to assure that the storage of the data is compliant with local laws and meeting governance standards to ensure that we are not holding data that is no longer necessary. (Risk of financial loss).

The purpose of this policy is to define cloud security assessments within The Diocese of Paterson. Cloud security assessments are performed to identify potential or realized weaknesses as a result of inadvertent mis-configuration, weak authentication, insufficient error handling, sensitive information leakage, etc. Discovery and subsequent mitigation of these issues will limit the attack surface of The Diocese of Paterson services available both internally and externally as well as satisfy compliance with any relevant policies in place.

This policy covers all Cloud security assessments requested by any individual, group or department for the purpose of maintaining the security stance, compliance, risk management, and change control of technologies in use at The Diocese of Paterson.

All Cloud security assessments will be performed by delegated security personnel either employed or contracted by The Diocese of Paterson. All findings are considered confidential and are to be distributed to people with confirmed privileges. Distribution of any findings outside of The Diocese of Paterson is strictly prohibited unless approved by the Director of Technology.

Any relationships within multi-tiered applications found during the scoping phase will be included in the assessment unless explicitly limited. Limitations and subsequent justification will be documented prior to the start of the assessment.

• 4.1 Personal Identifiable Information (PII) and Authentication Data (including but not limited to the following below) must be kept securely and must be deleted as soon as no longer needed. Additionally, all information must be kept within people with confirmed privileges and no information below can be sent through an externally facing application or storage media without being fully encrypted (including but not limited to email and USB devices)
  • Passwords
  • Names and Addresses
  • Social security numbers (SSN)
  • State issued identification cards and numbers
  • Financial account numbers (including any form of security codes)
  • Medical and/or health information
  • Payroll data
  • Benefit records
  • Sacramental information
  • Revenue Data
  • Accounts receivable data
• 4.2 Ownership and responsibilities of data must be auditable and, on a need, to know basis following the least privilege principle. Additionally, the following steps must be taken to ensure that the safety of the data is properly maintained which includes but is not limited to:
  • Limited the allowed characters within the name of a file to be [a-z, A-Z, 0-9, and the following symbols within quotes (not including quotes): “_”, “-”, “[”, “]”, “(”, “)”, “<”, “>”] Any and all other symbols are strictly prohibited as it creates security vulnerabilities and it creates problems with upgrading of software. Please not that [“\”, “/”, “`”, “’”, “””, “%”] are not allowed characters.
  • Ensuring data within 4.1 is properly maintained and only on secured devices.
  • Logging and having a clearly defined list of who is responsible for maintaining cloud security, selecting new cloud security, making significant changes to cloud security, and ensuring the number of users of the system is kept to an absolute minimum as needed.
  • Additionally, a qualified individual must be responsible for the following, implementing security for new services, customizing the configuration of the cloud security services (defaults must be avoided if possible), maintaining access control and permissions each service as needed and ensuring least possible privilege, and retiring old machines and services and well as migrating to any new services.
• 4.3 Unauthorized services will be logged and blocked and depending on the severity there may be disciplinary consequences. All services must first be approved by the appropriate qualified individual and it is up to their discretion whether or not allow the service to be enabled.
• 4.4 Technical controls shall be put into place by a qualified individual and for all cloud service infrastructure should include traffic analysis, configuration monitoring an alerts for change, and access control shall include the following for auditing purposes.
  • Login attempts
  • File permission implementation
  • Any form of access control (RBAC etc.)
  • Server access rights
  • Firewall permissions
  • Database access rights
  • Encryption in transit and at rest
  • Access control lists for diocesan used networks, workstations, databases, mobile devices, websites, cloud storage, services etc.

• 5.1 Compliance measurement
  The DoP Technology team may verify compliance to this Standard through various methods, including but not limited to, business tool reports, internal and external audits, and feedback to the Standard owner.
• 5.2 Exceptions
  All devices should be compliant with cyber insurance standards and local/federal governance standards. Any exception/outliers should be approved by the DoP Technology team in advance.
• 5.3 Non-Compliance
  An employee found to have violated this Standard may be subject to disciplinary action, up to an including termination of employment.

Cloud computing - the delivery of computing services, including storage, processing power, and software, over the internet. It enables users to access and utilize these resources on demand without relying solely on local hardware or servers.