DHS OFFICE OF INFORMATION TECHNOLOGY Page 11 ecurity wareness is or veryone Georgia Department of Human Services Web site http://www.dhr.state.ga.us This information was provided by the DHS Information Security Office Please send any questions, comments, or to report any Information Security related incidents to: infosec@dhr.state.ga.us Acknowledgement The Multi-State Information Sharing and Analysis Center (MS-ISAC) is a collaborative effort for State and Local Governments in strong partnership with the US Department of Homeland Security. Georgia Department of Human Services Office of Information Technology Information Security 2 Peachtree Street, NW 3rd Floor Atlanta, Georgia 30303 InfoSec@dhr.state.ga.us GTA Helpdesk 1-877-482-3233 @2005 Multi-State Information Sharing & Analysis Center (MS-ISAC) October 2011 Office of Information Technology Information Security Awareness The Goals of Information Security are: Confidentiality - Protecting sensitive information from unauthorized disclosure. Integrity Ensuring information is authentic and not corrupted. Availability - Ensuring information is available when needed. DHS OFFICE OF INFORMATION TECHNOLOGY Introduction Page 1 Information is a critical asset. Therefore, it must be protected from unauthorized modification, destruction and disclosure. This pamphlet describes information security concepts and defines steps required to properly safeguard information. It is the responsibility of everyone-- each employee and resource user-- to become familiar with good security principles and to put them into practice when working with State-owned information. Did You Know? Based on recent statistics: That the average unprotected computer can be compromised in a matter of minutes. The majority of individuals who thought their computers were safe were wrong. DHS Information Security Policy, Standards & Guidelines on Online Directives Information System (ODIS) HTTP://www.odis.dhr.state.ga.us/ Click Index Click Administration Click Information Technology Click POL1900 for the Information Security Policy Directive Click MAN1900 for the Table of Contents (TOC) Click Open If MAN1900 is chosen, click on desired document in TOC Human Resources Personnel Policy #1205 http://www2.state.ga.us/departments/dhr/ohrmd/policies/1205.pdf Georgia Department of Human Services OIT-Information Security DHS OFFICE OF INFORMATION TECHNOLOGY Security Breaches Page 10 Security breaches can take several forms. The best defense against security breaches are conscientious and alert users. You are the most important person for early detection and prevention. Examples include: Damage to equipment, facilities or utilities. Loss or misplacement of media (e.g. disks, tapes, paper) containing confidential/highly restricted information. Unauthorized access or attempted unauthorized access to information or computing resources. If you discover a security breach, you should report it immediately to the Information Security Team Office at infosec@dhr.state.ga.us. Shred it and Forget it We are required to properly dispose of data that is of no more use, regardless of the media type. Overwrite--DOD Standard 5220.22-M Degauss--Electromagnetic cleansing Destroy--Physical destruction of the media At The End of The Day Perform a perimeter check at the end of the day Lock away papers containing sensitive information Shut down your computer Click Start. . .select shut down Make sure no sensitive information is left unsecured. Georgia Department of Human Services OIT-Information Security DHS OFFICE OF INFORMATION TECHNOLOGY E-mail Etiquette Page 9 Keep your mailbox clean, delete unnecessary e-mail and create folders for the rest. Limit the size of attachments and save attachments off the system. Do not attempt to send files with .exe, .bat, .com, .pif, or .scr these are common methods of virus infection. Possible Symptoms of a Compromised Computer Is your machine: Slow or non-responsive? Experiencing unex- pected behavior? Running programs that you weren't expecting? Showing signs of high level of activity to the hard drive that is not the result of anything you initiated? Displaying messages on your screen that you haven't seen before? Unable to run a program because you don't have enough memory and this hasn't happened before? Program constantly crashing? Rejecting a valid and correctly entered password? Finding there are new or anonymous processes running on the machines? Call the GTA Helpdesk 1-877-482-3233 for immediate assistance. For questions regarding incident reporting, e-mail the Information Security Team at infosec@dhr.state.ga.us. Home users may wish to contact their ISP and/or anti-virus vendor. Georgia Department of Human Services OIT-Information Security DHS OFFICE OF INFORMATION TECHNOLOGY User IDs and Passwords Page 2 Your user ID is your identification, and is what links you to your actions on the system. Your password authenticates your user ID. Protect your ID and password. Remember, you are ultimately responsible for actions taken with your ID and password. Follow these best practices: Your password should be changed every 30 days. Don't reuse your previous passwords. NEVER tell or share your password with ANYONE. NEVER write your password down anywhere--the downfall of a network could be that yellow post it note under your keyboard with your password on it. If your computer prompts you to save your password, click "No." Use DHS Guidelines and choose a strong password: Be sure your password is at least eight characters long. Be sure it contains uppercase & lowercase letters and at least one number or at least one special character (!@#$% &*). Do not use personal information like names, birth dates, children's names, etc to create passwords It should not be easily guessed, but easy to remember. If you have difficulty in thinking of a password that you can remember, try using the first letter of each word in a phrase, song, quote or sentence. For example, "The big Red fox jumped over the Fence to get the hen?" becomes TbRfjotF2gth?. If you think your password has been compromised, change it immediately. Employees should notify the information security officer or manager at their organization of any suspected or known compromise. Georgia Department of Human Services OIT-Information Security DHS OFFICE OF INFORMATION TECHNOLOGY Computer Protection Page 3 Properly safeguarding your personal computer (PC) is one of the most important ways of protecting your information from corruption or loss. Lock your computer when you are away from your desk. Press "Control, Alt, & Delete" keys simultaneously, then click "Lock Computer" to lock. You will need your password to sign back in, but doing this several times a day will help you to remember your password and prevent compromise of State data via your computer. Protecting your Information 1. During an emergency or disruption, critical information-- the information necessary to run DHS's systems, record activities or satisfy legal and/or business requirements-- may be damaged. The best way to protect information is to back it up and store it in a secure location. 2. If you are connected to a network, store your files in folders created for you. (For employees, check with your LAN administrator for the schedule of backups). 3. If you are not connected to the network, save your files to appropriate storage media and secure them properly. 4. Ensure that backups reflect the most current information by copying the data on a regular basis, and after any significant changes. The frequency of the backup cycle should be consistent with the frequency with which you modify the information. Internet Usage DHS staff should use the Internet to accomplish job responsibilities more effectively and to enrich their performance skills. Internet access is provided to facilitate State Business. Internet access is monitored and recorded. Each use of the internet must be able to withstand public scrutiny without embarrassment to DHS or the State of Georgia. Users must not access inappropriate sites (i.e. Illegal activi- ties, wagering or betting. receipt, storage or transmission of offensive, racist, sexist, obscene or pornographic information, etc.) Georgia Department of Human Services OIT-Information Security DHS OFFICE OF INFORMATION TECHNOLOGY Wireless Security Wireless networks and laptops are very popular for their ease of use and portability. The Internet can be reached via radio waves without having to plug your machine into a network. It is with the same ease of connecting that malicious individuals connect to unprotected networks. Attackers conduct drive-by eavesdropping, called "war driving" to listen in on unsecured devices in homes and businesses. Page 8 Please follow DHS policy regarding the use of wireless devices on the DHS network. Remote Access Remote access allows users to access data from outside of the DHS network. Because this form of access is designed for off-site use that may extend after normal business hours, extra measures are required to prevent unauthorized access. Remote access to the office via the Internet should use encryption such as Secure Socket Layer (SSL) or Virtual Private Network (VPN). All policies regarding the use of DHS resources extend to remote locations. Georgia Department of Human Services OIT-Information Security DHS OFFICE OF INFORMATION TECHNOLOGY Page 7 Mobile Computing Security Computers are now accessible via a variety of means. A person can even download data from the Internet to a cell phone. While convenient and fun to use, some good practices will help protect your information. Laptops, PDAs, Blackberry's and Cell Phones are more easily stolen or misplaced because of their size. Remember, if your laptop is gone, so is your data. Small computer devices carry information that must be protected. Enabling security features is a recommended practice. If you use a DHS-issued mobile device please remember the following: Secure it with a cable lock or store it in a locked area or locked drawer. Backup your data. Password protect it. Encrypt confidential information stored on it, when possible. Keep it with you during air and vehicle travel until it can be locked away safely. Do not forget to retrieve it after passing through airport security. Personal Equipment Users are prohibited from attaching their personal computers, laptops, handheld devices to the network without written consent. Doing so could potentially infect our environment and cause a disruption of services to the constituents of Georgia. Users are also prohibited from storing State data on personal devices. DHS reserves the right to search personal equipment on DHS premises. Georgia Department of Human Services OIT-Information Security DHS OFFICE OF INFORMATION TECHNOLOGY GroupWise Access via the Internet Page 4 Availability to GroupWise from home or away from the office: Type the following in your browser address line: http://gw.dhr.state.ga.us Please select one of the three GroupWise servers. For additional help with GroupWise, click on Help at the main GroupWise Web Access page or go to http://gw.dhr.state.ga.us/faq/ E-mail Usage E-mail represents the most common method for the spread of malicious programs. Confidential information can very easily be accidentally and/or purposefully compromised via e-mail. Employees are expected to conduct their use of e-mail with the same integrity as in face -to-face or telephone business operations. Malicious Code Protection Malicious code can take various forms such as a virus, worm or Trojan. It can hide behind an infected web page or disguise itself in a downloadable game, screen saver or e-mail attachment. Don't Open Unexpected E-mail Computer viruses are programs that spread or self-replicate. They usually require interaction from someone to be activated. The virus may arrive in an e-mail message as an attachment or be activated by simply opening a message or visiting a malicious web site. Some viruses consume storage space or simply cause unusual screen displays. Others destroy information. If a virus infects your PC, all the information on your hard drive may be lost and/or compromised. Also, a virus in your PC may easily spread to other machines that share the information you access. Viruses can exhibit many different symptoms. If your computer behaves erratically, employees are advised to contact the GTA Helpdesk at 1-877-482-3233. Georgia Department of Human Services OIT-Information Security DHS OFFICE OF INFORMATION TECHNOLOGY Page 5 Malicious Code Protection (Continued) Anti-virus software is updated regularly on DHS owned machines via automatic updates . New, fast spreading worms and viruses are released every day. Store removable media, such as CDs, thumb drives, and diskettes as "write protected" whenever possible to help prevent infection by viruses. Worms are similar to viruses because they selfreplicate, however, they do not require any user interaction to be activated. Worms spread because of vulnerabilities or "holes" in software. Trojans (also known as backdoors) are malicious code hidden in a legitimate program that, when executed, perform some unauthorized activity or function. This can range from stealing your password and credit card information to allowing someone to take control of your computer. A denial-of-service attack is an assault upon a network or web site that floods it with so many additional requests that regular services are either slow or completely interrupted. In some instances, a group of remotely controlled, compromised desktops are combined to jointly attack a target system. Spyware and related "adware," are software sometimes downloaded from a web page, by clicking on a link in an e-mail. It is also installed with freeware or shareware software without the user's knowledge. Spyware is used to track your Internet activity, redirect your browser to certain web sites or monitor sites you visit. Spyware may also record your passwords and personal information to send to a malicious web site. Choose to "Close" any pop up windows by clicking on the "X." Do not respond to any dialogue boxes that appear unex- pectedly; click on "X", in the upper right corner of the dialog box. Clicking on "No" or "Cancel" inside the dialog box sometimes installs spyware. Beware of web sites that are un-trusted. Georgia Department of Human Services OIT-Information Security DHS OFFICE OF INFORMATION TECHNOLOGY Page 6 Hoaxes are e-mail messages that resemble chain letters, offer free money, or contain dire warnings and offers that seem to be too good to be true. If you receive a hoax via e-mail, delete it. Sharing hoaxes slows down mail servers and may be a cover for a hidden virus or worm. Chain Letters cover any variety of topics including anything from spiders in the toilet to free gift certificates or even getting paid to forward e-mail. Chain letters create a high volume of mail. If one person forwards 1 message to 10 people, by the sixth generation, you will have over 1 million messages. Remember, at DHS alone we have over 25,000 employees. That type of volume could potentially take down the entire mail system here, not to mention the damage it could do outside of DHS. Phishing is a scam in which an e-mail message directs the e-mail recipient to click on a link that takes them to a web site where they are prompted for personal information such as a pin number, social security number, bank account number or credit card number. Both the link and web site may closely resemble an authentic web site however, they are not legitimate. If the phishing scam is successful, personal accounts may be accessed. If you receive one of these e-mails: Do not click on the link. In some cases, doing so may cause malicious software to be downloaded to your computer. Delete the e-mail message. Do not provide any personal information in response to any email if you are not the initiator of the request. Just say NO! Georgia Department of Human Services OIT-Information Security