Network Security Standard Policy

Network Security is an ever-growing threat to our organization and as such we must be prepared to handle any situation that may arise. Below is a set of standards that at minimum must be configured in order to assure that the storage of data is compliant with local laws and meets governance standards, as well as ensuring the safety and security of each individual location.

The purpose of this policy is to define Network security assessments within The Diocese of Paterson. Network security assessments should be performed to identify potential or realized weaknesses as a result of inadvertent misconfiguration, weak authentication, insufficient error handling, sensitive information leakage, etc. Discovery and subsequent mitigation of these issues will limit the attack surface of The Diocese of Paterson’s services available both internally and externally as well as satisfy compliance with any relevant policies in place.

This policy covers all Network assessments requested by any individual, group or department for the purposes of maintaining the security stance, compliance, risk management, and change control of technologies in use at The Diocese of Paterson where the entity is insured by the diocese and are working with large amounts of user data or work with any of the following types of information (Protected Health Information [PHI], Personally Identifiable Information [PII], Payment Card Information [PCI-DSS]), FERPA, CIPA, COPPA, HIPAA.

Network Management, Physical Security and Licensed Hardware must follow these specific standards in order to ensure compliance with our insurance as well as ensure the confidentiality, integrity and availability within the network. As such the following baseline standards must be held in order to make sure that minimum satisfactory levels of security are upheld and user data is protected.

• 4.1 Physical Specifications
  • 4.1.1 Devices should be secured within an area that has physical access control which includes but is not limited to (CDM Program’s Approved List): locks, security cameras, network enabled devices, alarms, access keys which log on entry.
  • 4.1.2 A minimum of 1 Firewall must be used at the edge of the network and it is HIGHLY RECOMMENDED to follow the NIST guidelines to configure the policies and best practices. For an extra layer of security, it is highly encouraged to use 2 firewalls running in parallel to avoid bypass, and failover.
  • 4.1.3 All devices must have an uninterruptible power supply (UPS) attached to them.
  • 4.1.4 All devices connected via Ethernet must be auditable and labeled in the following manner:
    • 4.1.4.1 The subnet mask/wildcard they are on as well as the port number that is connected to must be logged on Monday.com or a secure file with privileged access and password protected.
    • 4.1.4.2 Ethernet cables must have the corresponding port number they are attached to for ease of implementation in the future.
  • 4.1.5 An Intrusion Detection System (IDS) must be implemented within each network segment and report to a firewall log analyzer or network management system of choice.
• 4.2 Configuration Specification
  • 4.2.1 Default Configurations and Passwords should be changed
  • 4.2.2 Unused ports must be disabled
  • 4.2.3 No 802.1q trunk can have the native VLAN be VLAN1
  • 4.2.4 Port fast and BPDU Guard must be properly implemented within each network segment
  • 4.2.5 Plaintext protocols should be avoided and are only allowed to be used with express permission from the technology department
  • 4.2.6 Management traffic cannot be on the same traffic as user traffic
  • 4.2.7 SNMPv3 should be used where possible if not then SNMPv2 should be implemented
  • 4.2.8 Protocols like LDAP should not be used in an unencrypted form and as such must be used in tandem with TLSv1.2 or SSLv3/SSLv2
  • 4.2.9 Access control lists should be implemented in the following manner
    • 4.2.9.1 Access to network devices should only be accessible from specific IP address ranges
    • 4.2.9.2 Protection from layer-3/Layer-4 attacks should be enabled. References to these attacks can be found below on the Helpful Links section
    • 4.2.9.3 Configuration backups are restricted to authorized personnel or The Diocesan Technology department as needed
    • 4.2.9.4 Configuration backups should be kept secure for at least 6 months at which time, then they should be deleted.
• 4.3 Devices that have sensitive information running through them (PCI DSS, HIPAA, COPPA, FERPA, CIPA, etc.) must have these following measures:
  • 4.3.1 All external connections attempting to connect to non-standardized/ high risk ports must be blocked by default and only permitted by authorized administrator approval.
  • 4.3.2 All connections to network devices outside the accepted range of IP addresses must be automatically disconnected.
  • 4.3.3 MAC address filtering must be enabled.
  • 4.3.4 Port Security must be enabled and correctly implemented.
  • 4.3.5 Devices must follow standard password procedures found below on the Helpful links section.
  • 4.3.6 802.1x must be implemented with Diameter as the preference but Radius may also be used.
• 4.4 Network Security Assessments
  • 4.4.1 All Network security assessments will be performed by delegated security personnel either employed or contracted by The Diocese of Paterson. All findings should be confidential and are to be distributed to people with confirmed privileges. Distribution of any findings outside of The Diocese of Paterson, or authorized administrators is strictly prohibited. Any relationships within multi-tiered applications/Hardware found during the scoping phase should be included in the assessment unless explicitly limited. Limitations and subsequent justification must be documented prior to the start of the assessment.

• 5.1 Compliance Measurement
  The DoP Technology team may verify compliance to this Standard through various methods, including but not limited to, business tool reports, internal and external audits, and feedback to the Standard owner.
• 5.2 Exceptions
  All devices should be compliant with cyber insurance standards and local/federal governance standards. Any exception/outliers should be approved by the DoP Technology team in advance.
• 5.3 Non-Compliance
  An employee found to have violated this Standard may be subject to disciplinary action, up to and including termination of employment.

• 6.1 Layer 3 Attacks
• 6.2 Layer 4 Attacks
• 6.3 Cisco best practices
• 6.4 Wireless Communication Standard
• 6.5 Information Logging Standard