Policy 7230A - Department of Administration

4.3.1.5 Ensure Cryptographic Authentication Meets Standards
Cryptography is a valuable tool in the protection of authentication
information. However, to ensure the utmost functionality, selected
tools must meet set standards:
• Where authentication is performed against a cryptographic
module, review the cryptographic module to ensure it meets
FIPS 140-2 standards.
4.3.1.6 Initiate Session Lock and Termination
After a pre-defined period of inactivity internally initiated system
sessions must be locked and require re-authentication should further
work in the system be required. Further, after a pre-defined period of
inactivity externally initiated system sessions must be terminated and
require re-establishing should further work within the system be
required:
• Internally initiated system sessions are those that are initiated
from within the network of the host system.
• Externally initiated system sessions are those that are initiated
from outside of the network of the host system.
• Session lock maintains an active session such that information
in the process of being entered is not lost.
• Session termination closes an active session and any
information that is in the process of being entered may be
lost.
4.3.2. Configure Systems for Secure Communication
Agencies should limit the potential of security threats bridging systems and of
data leaking inadvertently by restricting inter-system communications:
4.3.2.1 Restrict Intra and Inter-System Communication by Authorization
To ensure that information is not shared inappropriately, intra and
inter-system communications must be fully authorized before being
established:
• Define the specific communication paths and communications
that will occur intra and inter-system.
• Identify system owners for all involved systems and data
owners for all involved data.
• Obtain written sign-off on all communications by system and
data owners per system.
10