2022-077-E-IT Dept-PUBLIC LIBRARY ASSOCIATION, a divison of the American Library Association-Digital learning

Browse Search

DocuSign Envelope ID:24BBAFA9-CD81-4144-ACEF-E9036E703739 deployed to alert security personnel if the "running" configuration of any device does not align to the approved "stored" configuration. • All external network connections rules must be approved by the Chief Information Security Officer, and submitted to the Security/IT Steering Committee for review. Changes to the network control ruleset may not be implemented until written approval from the Chief Information Security Officer is obtained. • Network administrators are responsible for maintaining a set of logical and physical network diagrams that fully document all connections to PHI and PII data, including any wireless networks. • Network controls must be installed at each Internet connection and between any DMZ and the Intranet. • The network controls must restrict connections between publicly accessible servers and any system component storing sensitive(I.e. PHI, PII) data, including any connections from wireless networks. As part of the firewall configuration program, all connections between the DMZ and internal networks must be fully documented. • The DMZ must be considered a semi-public network. As such, all connections carrying confidential data within the DMZ (including those originating from trusted, internal networks) must be encrypted. • The network controls must restrict inbound Internet traffic to IP addresses within the DMZ. No direct connections between the Internet and the internal virtual network is allowed. • The network controls must be configured so that RFC 1918 cannot pass from the Internet into the DMZ\externally. Additionally, dynamic packet filtering will be performed to ensure that only established connections are allowed into the network. • Databases with sensitive information will be placed in an internal network zone, segregated from the DMZ.All inbound and outbound Internet traffic will be monitored. • All Internet traffic passing into the DMZ will be limited to ports included in documented business justification that has been approved by the Chief Information Security Officer. • Jende Solutions considers all wireless networks to be public networks. As such, perimeter network controls must be installed between any wireless networks and the internal network. The configuration of these network controls will be set up to deny or control (if such traffic is necessary for business purposes) any traffic from the wireless environment. • Personal firewall software must be installed on any mobile and/or employee-owned computers with direct connectivity to the Internet (e.g., laptops used by employees), which are used to access the Jende Solutions's network. • The network controls must use network address translation (NAT) to mask internal addresses from the Internet. • Direct connections are not allowed between the Internet and the sensitive data (i.e. PII/PHI) environment. • Disclosure of internal IP addressing and routing information to unauthorized third parties is not permitted. • The network controls must limit inbound and outbound traffic to specifically what is necessary for the sensitive data (i.e. PII/PHI)environment and be reviewed on a semi-annually basis. • Network control rules and router access lists will be reviewed and approved every six (6) months by the CISO. 32. What system hardening strategies are employed by the cloud provider? See answer to question#31 33. How does the cloud provider perform security testing, including logging, correlation, intrusion detection, intrusion prevention, file integrity monitoring, time synchronization,