Effective 23.2.1998

• vision, mission, objectives, and functions
• definitions
• role and responsibilities

• operational framework
• network connection
• security
• IP addressing
• domain naming
• services access
• technology standards

• data standard
• electronic government domain
• information update
• e-mail
• firewall
• state IT resource security
• use of approved software
• acceptable use
• anti-virus

Firewall

Firewall compromise would be potentially disastrous to subnet security. For this reason, agencies will, as far as is practical, adhere to the below listed stipulations when configuring and using firewalls.

1. Limit firewall accounts to only those absolutely necessary, such as the administrator. If practical, disable network logins.

2. Use smartcard or authentication tokens to provide a much higher degree of security than that provided by simple passwords. Challenge-response and one-time password cards are easily integrated with most popular systems.

3. Remove compilers, editors, and other program development tools from the firewall system(s) that could enable a cracker to install Trojan horse software or backdoors.

4. Do not run any vulnerable protocols on the firewall such as TFTP, NIS, NFS, UUCP.

5. Consider disabling finger command. The finger command can be used to leak valuable user information.

6. Consider not using the e-mail gateway commands (EXPN and VFRY) which can be used by crackers to probe for user addresses.

7. Do not permit loopholes in firewall systems to allow friendly systems or users special entrance access. The firewall should not view any attempt to gain access to the computers behind the firewall as friendly.

8. Disable any feature of the firewall that is not needed, including other network access, user shells, applications, and so forth.

9. Turn on full-logging at the firewall and read the logs weekly at a minimum.