Policy 7230A - Department of Administration

Where possible boundary protection systems will be configured to protect against
or limit the effects of all denial of service attacks.
Boundary protection systems are to be deployed internally to create zones of
security within the network for network segments that host information systems
that are deemed to be of a critical or sensitive nature. These zones will be used
wherever segmented networks are deployed.
B. Malware Protection Systems
All information systems and components of information systems will be protected
by malware protection systems where such solutions exist for the information
system or information system component. At a minimum malware protection will
be performed at the network boundary, on e-mail and other communications
systems, and on all workstations, servers and other endpoints.
The malware protection system must be centrally managed and must have the
ability to perform automated updates to all protected information systems and
information system components.
By definition, malware includes viruses, worms, spyware, adware, Trojan Horses
and any other unwanted and deleterious software that may be installed on an
information system component element as well as spam and other unsolicited
communications.
C. Monitoring and Intrusion Prevention Systems
Each boundary (Internet) network access point will be protected by monitoring
and/or intrusion prevention systems that monitor events, detect attacks and
provide identification of unauthorized information system use. These systems will
be configured to monitor both inbound and outbound communications.
Monitoring and intrusion prevention systems may also be deployed internally to
create zones of security within the network.
5.3 Data/Media Protection
The State of Kansas requires that all privileged information, whether stored in system
or out of system (via information media) be protected by data and media protection
mechanisms to ensure the highest levels of confidentiality, integrity and availability.
Non-privileged information will be protected to ensure the highest levels of integrity
and availability.
Data and media protection mechanisms allow information to be provided a greater
level of security than can be achieved with system based protection mechanisms
alone. Without data and media protection mechanisms the potential exists that the
State’s information assets could be exposed to an unnecessarily high level of risk,
particularly in circumstances where that information is taken out of the information
system.
18