Policy 12 - Server Security Policy

1.0 Purpose

The purpose of this policy is to establish standards for the base configuration of internal server equipment that is owned and/or operated by Murray State University. Effective implementation of this policy will minimize unauthorized access to Murray State University proprietary information and technology. Any questions or comments about this policy should be directed to Information Systems.

2.0 Scope

This policy applies to server equipment owned and/or operated by Murray State University and to servers registered under any internal network owned by Murray State University. It is specific for equipment on the internal Murray State University network and does not apply to servers set up in a classroom or lab environment for instructional purposes.

3.0 Policy

The following are general configuration guidelines that must be followed on all Murray State University servers. While these guidelines are non-operating system specific, all servers must also abide by the more detailed guidelines outlined in either the Windows Configuration Standards or the Linux Configuration Standards.

3.1 Ownership and Responsibilities

• Approved server configuration guides must be established and maintained based on university needs and approved by Murray State University Information Systems. Operational groups should monitor configuration compliance and implement an exception policy tailored to their environment. 
• New System Authorization forms must be submitted to Information Systems before purchasing and installing a new server. 
• Information Systems should be informed of any major changes to a server’s purpose, configuration, location, etc.

3.2 General Configuration Guidelines

• Operating System configuration should be in accordance with approved Murray State University Information Systems standards. 
• Services and applications that will not be used must be disabled where practical. 
• The most recent security patches must be installed on the system as soon as is practical, the only exception being when immediate application would interfere with normal operations. 
• Always use the standard security principle of least required access to perform a function. 
• Use a non-privileged account when possible. 
• If a methodology for secure channel connection is available (i.e., technically feasible), privileged access must be performed over secure channels, (e.g., encrypted network connections using SSH or IPSec). 
• Servers should be physically located in an access-controlled environment. 
• Servers are specifically prohibited from operating from uncontrolled cubicle/office areas. 

3.3 Monitoring

• All security-related events on critical or sensitive systems must be logged and audit trails saved as follows:
  • All security related logs will be kept online for a minimum of 2 weeks. 
• Security-related events will be reported to the appropriate system administrator, who will review logs and report incidents according to the Incident Response Policy. Corrective measures will be prescribed as needed. Security-related events include, but are not limited to:
  • Evidence of unauthorized access to privileged accounts
  • Anomalous occurrences that are not related to specific applications on the host.
  • Loss or breach of sensitive data.

3.4 Compliance

• Audits will be performed on a regular basis by Information Security Personnel within Murray State University. 
• Audits will be managed by the Murray State University Information Security Personnel, in accordance with the Audit Policy. Murray State University Information Security Personnel will filter findings not related to a specific operational group and then present the findings to the appropriate support staff for remediation or justification. 

4.0 Enforcement

Anyone found to have violated this policy may be subject to disciplinary action according to personnel policies and procedures. A violation of this policy by a temporary worker, contractor or vendor may result in action up to and including termination of their contract or assignment with Murray State University.

5.0 Definitions

Server

For purposes of this policy, a Server is defined as an internal Murray State University Server. Desktop machines and Lab equipment are not relevant to the scope of this policy.

SSH (Secure Shell)

SSH is a network protocol that allows data to be exchanged using a secure channel between two networked devices.

IPSec (Internet Protocol Security)

IPSec is a suite of protocols for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a data stream.

Murray State University Network

Being connected to a Murray State University network includes the following:

• If you have a network capable device (ex. laptop) plugged into a Murray State University owned building, then you are connected to the MSU LAN (local area network).
• If you have a wireless capable device (ex. laptop, iPhone) and connect to MSUWireless or MSUSecure, then you are connected to the MSU WLAN (wireless local area network).
• If you connect from a computer through the Murray State University VPN (virtual private network), you are then connected to the MSU LAN (local area network).

---

Policy adopted:  02-25-2011
Revision adopted: 
Policy approval and adoption: Murray State University President's Office and Information Systems Security