COMMENTS RE CANTRIL ANALYSIS OF OUR COMPUTER SYSTEM

Information Security Policy

Document in Progress

Physical Security: Workstations & Server

Because our building is "secure," the risk of entry by unauthorized persons is small. To access a workstation would be easy enough by someone after gaining access to the building, but anything residing on the workstation's hard drive is "replaceable." One cannot gain access to the files on the server without proper user name and password. Screen-saver passwords can be more trouble than they are worth. They would prevent network administrator from shutting down when necessary or otherwise accessing the workstation for upgrades, etc.

The building's air conditioning unit is very effective on the ground floor. However, I will discuss with Tushaus the need for installing a high temperature activated alarm (above 75 degrees) within the server room and a fan for ventilation.

Virus Protection

We will replace the current Norton Anti-virus software with the more efficient McAffie Anti-virus software to protect the server and each workstation connected to the server. This software will update the virus definition list nightly and scan for viruses before any file is opened, including E- mail and Internet files.

Modems and External Access

Both of our ISDN modems are necessary. They connect MJ to the server from his home and connect our staff to our Internet provider.

We may be able to remove the modem pool, but should wait to see if it may needed for Gary and the security company to access the security system, in which case a dial-back configuration would be used. At this time, no technical support personnel (our vendors) have remote access to the foundation network! I check the audit logs for unauthorized activity.

Data Storage and Recovery

Cantril had no recommendations.

Internet Vulnerabilities

We will be installing Proxy server as an Internet firewall.

NT Network Configuration

The unused accounts have been deleted.

With one exception, our passwords are at least 5 characters in length. They are set not to expire in order to prevent the need for a password to be changed on a day or week when I'm not here to help the user make the change. If the password expires without being changed in time, the user could not access the system at all. I have a system in place where I assist each user every four months to change their password.

Only MJ, and MU have rather unlimited hours of access (due to their schedules), and Administrator has 24-hour access, although no one can access the system during the three hour nightly backup. In fact, the system will kick out any users during that time.

Unassigned "groups" on the NT server are there to operate and configure and set-up software. I will verify its continued need with Tushaus.

I will also consult Tushaus on how to monitor "File and Object" using NT admin.

Web Site Recovery

I will design a plan to monitor the web site daily for unauthorized access. We have a plan for restoring the site. I will ask Christina to provide us with a zip back-up to keep in the Foundation's media storage unit or perhaps safe deposit box.

Hawley House

The installer will ensure no network cable is exposed.

Yvonne Engel

Program & Network Administrator

October 5, 1999