Â鶹´«Ã½

Servers — Minimum Security Standards

Last Updated 2023-02-06

As defined by the , a server is a computer or device on a network that manages network resources. Examples include file servers (to store files), print servers (to manage one or more printers), network servers (to manage network traffic), and database servers (to process database queries).

Please refer to the Implementation Guides for assistance with implementing the minimum security standard for your device.

Key

Item	Description
	Implementation required
	Implementation recommended
	Recurring task

When working with Regulated Data, please refer to the applicable Standard, Act, or Policy (e.g., CMMC, PCI DSS, HIPAA, FERPA, NIST SP800-171, etc.) for specific details on any additional controls needed.

The standards listed below are adapted from a subset of the Center for Internet Security's (CIS) Controls, which are a prioritized set of actions that collectively form a defense-in-depth set of best practices that mitigate the most common attacks against systems and networks. The subset of CIS Controls were chosen based on their applicability to the University of Â鶹´«Ã½.

Quick Reference

• 1.0 - Patching
• 2.0 - Firewall Configuration
• 3.0 - Password Security
• 4.0 - Data Management
• 5.0 - Encryption
• 6.0 - Asset Management
• 7.0 - Data Inventory
• 9.0 - Malware Protection
• 10.0 - Session Timeout
• 11.0 - Backups
• 12.0 - Multi-Factor Authentication
• 13.0 - Centralized Logging
• 14.0 - Secure Access
• 15.0 - Secure Configuration
• 16.0 - Event Logging
• 17.0 - Network Security
• 18.0 - Access Control
• 19.0 - Account Management
• 20.0 - Vulnerability Scanning

#	Standards		Institutional Data Category
1.0	Patching	Recurring Task	Public	Restricted	Sensitive	Regulated
1.1	Enable automatic updates for operating systems and software if possible.
1.2	Install standard operating system and software security patches on a monthly basis for servers and networking devices.
2.0	Firewall Configuration	Recurring Task	Public	Restricted	Sensitive	Regulated
2.1	Configure and manage a host based firewall or a network firewall device with a default deny-all policy. Only necessary services should be allowed through the firewall.
3.0	Password Security	Recurring Task	Public	Restricted	Sensitive	Regulated
3.1	Ensure that all servers have strong and unique password protected individual logins for all local and remote accounts.
3.2	Ensure that all web applications have strong and unique password protected individual logins for administrative accounts.
4.0	Data Management	Recurring Task	Public	Restricted	Sensitive	Regulated
4.1	Utilize the University's records management process for .
4.2	Securely dispose of Institutional Data following our Disposal Guidelines.
5.0	Encryption	Recurring Task	Public	Restricted	Sensitive	Regulated
5.1	Ensure that data is encrypted with a secure encryption algorithm while in transit.
5.2	Ensure that files containing Sensitive and Regulated data stored on servers, applications, databases, and removable media are encrypted or stored in an encrypted file container such as Veracrypt.
6.0	Asset Management	Recurring Task	Public	Restricted	Sensitive	Regulated
6.1	Complete the Annual Device Registration.
6.2	Maintain an updated inventory of all software and hardware assets.
6.3	Ensure that hardware and software assets are fully supported by their vendors.
6.4	Review asset lists on a monthly basis. Remove or replace unauthorized and end-of-life assets if possible.
7.0	Data Inventory	Recurring Task	Public	Restricted	Sensitive	Regulated
7.1	Complete the annual Personal Information Survey (PIS).
9.0	Malware Protection	Recurring Task	Public	Restricted	Sensitive	Regulated
9.1	Install and enable an anti-malware solution.
9.2	Ensure automatic anti-malware signature updates are enabled.
10.0	Session Timeout	Recurring Task	Public	Restricted	Sensitive	Regulated
10.1	Configure a maximum 15 minute session timeout for system access and remote access protocols (SSH, RDP, etc.)
11.0	Backups	Recurring Task	Public	Restricted	Sensitive	Regulated
11.1	Maintain an offline, off-site, or cloud-based backup instance.
11.2	Ensure backups are encrypted.
11.3	Perform manual or automatic backups of systems on at least a weekly basis.
12.0	Multi-Factor Authentication (MFA)	Recurring Task	Public	Restricted	Sensitive	Regulated
12.1	Enable multi-factor authentication to access externally-exposed applications, remote network access, and administrative access where possible.
12.2	Utilize for public facing web application logins if applicable.
13.0	Centralized Logging	Recurring Task	Public	Restricted	Sensitive	Regulated
13.1	Deploy a centralized log management system for servers and aggregate logs.
13.2	Retain centralized logs for at least 90 days. Adequate log storage must be accounted for.
13.3	Review centralized audit logs on a weekly basis.
14.0	Secure Access	Recurring Task	Public	Restricted	Sensitive	Regulated
14.1	Access applications and manage software over a secure encrypted connection (SSH, HTTPS, etc.).
15.0	Secure Configuration	Recurring Task	Public	Restricted	Sensitive	Regulated
15.1	Ensure that servers and network devices are configured following industry security best practices. CIS Configuration Guides are recommended. Configuration scripts are available upon request.
15.2	Uninstall or disable unnecessary and unused services on servers and network devices.
16.0	Event Logging	Recurring Task	Public	Restricted	Sensitive	Regulated
16.1	Enable logging of system, security, and application events.
16.2	Retain logs for at least 90 days. Adequate log storage must be accounted for.
16.3	Review audit logs on a weekly basis.
17.0	Network Security	Recurring Task	Public	Restricted	Sensitive	Regulated
17.1	Utilize network segmentation to address least privilege by isolating personal, untrusted, and IoT devices from critical services.
17.2	Maintain network architecture diagrams.
17.3	Utilize Wi-Fi Protected Access 2 (WPA2) with AES-128 or greater and a strong password for wireless networks.
18.0	Access Control	Recurring Task	Public	Restricted	Sensitive	Regulated
18.1	Maintain an updated access control list of user roles, accounts and permissions for local/remote file systems, databases, and applications.
18.2	Grant access and apply access privileges to systems and services on a need to know basis.
18.3	Revoke privileges to systems and services upon employee termination, rights revocation, or role change.
19.0	Account Management	Recurring Task	Public	Restricted	Sensitive	Regulated
19.1	Restrict administrator privileges to individually dedicated administrator accounts.
19.2	Remove dormant accounts (45 days of inactivity).
19.3	Disable default system and software accounts or make them unusable.
19.4	Review account privileges and permissions quarterly.
20.0	Vulnerability Scanning	Recurring Task	Public	Restricted	Sensitive	Regulated
20.1	Â鶹´«Ã½Vulnerability Scan Site Perform vulnerability scans using ScanUH or Nessus Agents on a monthly basis.
20.2	Remediate all High and Critical severity vulnerabilities within 7 days.