Policy 7230A - Department of Administration

Collaborative computing infrastructure, such as video and teleconferencing
systems, will be configured so that they prohibit remote activation. Further, when
these systems are in an active state (capable of receiving or transmitting
information) they must provide explicit indication of that active state to local
users. Examples of explicit indication include audible tones or visible “on” lights.
D. Change Control
Any changes to an information system must be authorized, documented and
performed in a controlled manner. They may only be made by appropriate
administrative personnel that have approved access privileges.
Configuration change control involves the systematic proposal, justification,
implementation, test/evaluation, review, and disposition of changes to
information systems, including upgrades and modifications.
All proposed information system changes will be assessed for their potential
security impact prior to being made. If the security impact increases the risk that
must be accepted by the State, the changes must be revised or alternate security
mitigation controls put in place prior to the change being made. After the change
has been made the information system that was changed will be actively
monitored for a pre-defined period of time to ensure that security has not been
compromised.
5.2 Systems Protection
The State of Kansas requires that all information systems and all components of
information systems, whether they be for the exclusive internal use of the State of
Kansas or be publicly available, be protected by dedicated protection mechanisms.
These requirements are equally applicable to information systems owned by the State
of Kansas as well as those owned by third parties through which services are provided
to the State of Kansas.
Dedicated protection mechanisms allow information systems to be provided a greater
level of security than can be achieved through configuration control alone by
delivering enhanced security capabilities. Without dedicated protection mechanisms
the potential exists that security vulnerabilities that cannot be mitigated by the
capabilities inherent in the State’s information systems will be exploited leading to
compromise of information system confidentiality, integrity and availability.
A. Gateway/Boundary Protection Systems
As limited a number of network access points as possible will be used to connect
to external networks such as the Internet. Each of these network access points will
be protected by boundary protection systems (generally a firewall) that monitor
and control communications. These systems will be configured to deny
communications by rule and allow by exception, to prevent public access to
internal networks and to place controls on publicly accessible systems.
17