DOC

Session Controls Standard

By Leslie Payne,2014-07-02 15:05
14 views 0
Session Controls Standard

    STATE of ARIZONA

    TITLE: Session Controls Government Statewide Information STANDARD Technology

    Effective Date: October 10, 2008 P800-S825 Rev 2.0 Agency

    1. AUTHORITY

    The Government Information Technology Agency (GITA) shall develop, implement and maintain a coordinated statewide plan for information technology (IT) (A.R.S. ? 41-3504(A (1))), including, the adoption of statewide technical, coordination, and security standards (A.R.S. ? 41-3504(A (1(a)))).

    2. PURPOSE

    The purpose of this standard is to coordinate budget unit and State efforts to prevent unauthorized access to critical systems via workstations left unattended. Unattended workstations logged into networks, systems, and applications may allow unauthorized access to critical information and resources.

    3. SCOPE

    This applies to all budget units. Budget unit is defined as a department, commission, board, institution or other agency of the state organization receiving, expending or disbursing state funds or incurring obligations of the state including the Arizona Board of Regents but excluding the universities under the jurisdiction of the Arizona Board of Regents the community college districts and the legislative or judicial branches. A.R.S. ? 41-3501(2).

    The Budget Unit Chief Executive Officer (CEO), working in conjunction with the Budget Unit Chief Information Officer (CIO), shall be responsible for ensuring the effective implementation of Statewide Information Technology Policies, Standards, and Procedures (PSPs) within each budget unit.

    4. STANDARD

    The following session controls provide minimum requirements for preventing unauthorized access to information, systems, applications, and networks via unattended workstations at budget units, regardless of location, throughout the State. Requirements shall be documented and maintained as part of, and in accordance with, Statewide Standard P800-S810, Account Management.

    4.1 SESSION/SYSTEM TIMEOUT: Budget units shall develop, implement, and

    communicate procedures for:

    ; Automatic session timeouts to be in place on multi-user information

    systems and remote communication systems, with the maximum period of

    inactivity set commensurate with the sensitivity of information housed on

    the individual system.

    ; All system users to log off at the end of the business day, regardless of the

    sensitivity of information on the system. If budget unit business

    Standard P800-S825 Rev 2.0 Effective: October 10, 2008

    Session Controls Page 2 of 3

    requirements necessitate a deviation, rationale and procedures shall be

    documented.

    ; Locking screensavers to be in use on all personal computers (including

    laptops). Screensavers shall be automatically activated by the personal

    computer’s operating system after a specific period of inactivity. The

    period of inactivity shall be determined by the budget unit. 4.2 PASSWORD PROTECTION FOR LOCKING SCREENS: Requirements for

    password strength used on locking screen savers shall be determined by the

    capabilities of the applicable operating system. Passwords used to unlock

    screens shall meet requirements of Statewide Standard P800-S820,

    Authentication and Directory Services, unless otherwise prevented by the

    capabilities of the applicable operating system.

    4.3 LOCKOUT BASED ON UNSUCCESSFUL LOGON ATTEMPTS: Budget

    units shall establish, document, implement, and communicate a requirement for

    locking an account from further use following a maximum number of detected,

    unsuccessful login attempts. Budget unit password resetting procedures shall

    ensure that the correct account holder is requesting the reset. 4.4 STRONG AUTHENTICATION: In controlling the authenticity of local

    and/or remote user identities, it is recommended that budget unit’s provide at

    least two of the three authentication methods as identified in the Statewide

    Standard P800-S820 Authentication and Directory Services, authentication by

    knowledge, authentication by ownership, and/or authentication by

    characteristic.

    4.5 ACCESS (SECURITY EVENT) LOGS: Access logs, if available, shall be

    turned on and protected from accidental or deliberate overwriting. Access logs

    should be proactively analyzed, correlated with other logs, and evaluated.

    Systems should be configured to log information locally, and the logs should

    be sent to a remote system. Logs should contain details of:

    ; Access by types of user;

    ; Servicing activities;

    ; Failed sign-on attempts;

    ; Error / exception conditions; and

    ; Sufficient information to identify individual userIDs, resources, and

    information accessed, access paths, and patterns of access.

    Access logs shall be maintained for a period of time determined by the business

    needs of the budget unit. Budget units shall establish and document access log

    retention requirements. Storage and backup of access logs shall be in

    accordance with Statewide Standard P800-S870, Backups.

    5 DEFINITIONS AND ABBREVIATIONS

    Refer to the PSP Glossary of Terms located on the GITA website at http://www.azgita.gov/policies_standards/ for definitions and abbreviations.

    Standard P800-S825 Rev 2.0 Effective: October 10, 2008

    Session Controls Page 3 of 3

    6. REFERENCES

    6.1. A. R. S. ? 41-621 et seq., “Purchase of Insurance; coverage; limitations,

    exclusions; definitions.”

    6.2. A. R. S. ? 41-1335 ((A (6 & 7))),“State Agency Information.”

    6.3. A. R. S. ? 41-1339 (A),“Depository of State Archives.”

    6.4. A. R. S. ? 41-1461, “Definitions.”

    6.5. A. R. S. ? 41-1463, “Discrimination; unlawful practices; definition.”

    6.6. A. R. S. ? 41-1492 et seq., “Prohibition of Discrimination by Public Entities.”

    6.7. A. R. S. ? 41-2501 et seq., “Arizona Procurement Codes, Applicability.”

    6.8. A. R. S. ? 41-3501, “Definitions.”

    6.9. A. R. S. ? 41-3504, “Powers and Duties of the Agency.”

    6.10. A. R. S. ? 41-3521, “Information Technology Authorization Committee;

    members; terms; duties; compensation; definition.”

    6.11. A. R. S. ? 44-7041, “Governmental Electronic Records.”

    6.12. Arizona Administrative Code, Title 2, Chapter 7, “Department of Administration

    Finance Division, Purchasing Office.”

    6.13. Arizona Administrative Code, Title 2, Chapter 10, “Department of

    Administration Risk Management Section.”

    6.14. Arizona Administrative Code, Title 2, Chapter 18, “Government Information

    Technology Agency.”

    6.15. Statewide Policy P100, Information Technology.

    6.16. Statewide Policy P800, IT Security.

    6.16.1. Statewide Standard P800-S810, Account Management.

    6.16.2. Statewide Standard P800-S820, Authentication and Directory Services.

    6.17. State of Arizona Target Security Architecture,

    http://www.azgita.gov/enterprise_architecture.

    7. ATTACHMENTS

    None.

Report this document

For any questions or suggestions please email
cust-service@docsford.com