South Plains College
Information Services (SPC-IS)
Access Control Policy: I-D
Purpose
Ensure access controls are implemented and comply with IT security policies, standards,
and procedures.
Policy
This policy applies to all users of South Plains College resources and assets, including Faculty,
Staff, Students, and guests.
Account Management
SPC-IS Designated Account Administrators:
- Identify and select the following information system accounts to support organizational missions and business functions: Individual, Privileged, Service, Shared, Default Non-Privileged (e.g., Guest, Anonymous), Emergency, and Temporary. Defined in the Account Management Access Control Standard: I-D(a)
- Assign account managers for information system accounts.
- Establish conditions for group and role membership.
- Specify authorized users of the information system, group and role membership, access authorizations (e.g., least privileges), and other attributes (as required) for each account.
- Acquire Information owners' approval for requests to create information system accounts.
- Create, enable, modify, disable, and remove information system accounts per approved procedures.
- Monitor the use of information system accounts.
- Authorize access to the information system based on a valid access authorization or intended system usage.
- Review accounts for compliance with information owners' requirements.
- Establish a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.
- Employ automated mechanisms to support the management of information system accounts.
- Ensure the information system automatically disables temporary and emergency accounts after usage.
- Ensure that the information system automatically disables inactive accounts after 60 days.
- Ensure that the information system automatically audits account creation, modification, enabling, disabling, and removal actions and notifies appropriate IT personnel.
Access Enforcement
SPC-IS Designated Account Administrators:
- Ensure the information system enforces approved authorizations for logical access to information and system resources per the Account Management and Access Control Standard: I-D(a).
Information Flow Enforcement
SPC-IS Designated Account Administrators:
- Ensure that the information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on applicable policy.
Separation Of Duties
SPC-IS Designated Account Administrators:
- Separate duties of individuals as necessary to prevent malicious activity without collusion.
- Document the separation of duties of individuals.
- Define information system access authorizations to support separation of duties.
Least Privilege
SPC-IS Designated Account Administrators:
- Employ the principle of least privilege, allowing only authorized access for users (or processes acting on behalf of users) that are necessary to accomplish assigned tasks under organizational missions and business functions.
- Authorize explicit access to hardware and software controlling access to systems and filtering rules for routers/firewalls, cryptographic key management information, configuration parameters for security services, and access control lists.
- Require that users of information system accounts or roles with access to administrative functions use non-privileged accounts or roles when accessing non-security functions.
- Restrict privileged accounts on the information system to administrative users on an as-needed basis using the principle of least privilege access.
- Ensure that the information system audits the execution of privileged functions.
- Ensure that the information system prevents non-privileged users from executing privileged functions, including disabling, circumventing, or altering implemented security safeguards/countermeasures.
Unsuccessful Logon Attempts
SPC-IS Department shall ensure that the information system:
- Enforces a limit of consecutive invalid logon attempts by a user during a single login attempt.
- Locks the account/node automatically for 30 minutes or until released by an administrator when the maximum number of unsuccessful attempts is exceeded.
Acceptable Use Notification
SPC-IS Department shall ensure that the information system:
- Displays to users an acceptable use notification message or banner before granting
access to the system that provides privacy and security notices consistent with applicable
state and federal laws, directives, policies, regulations, standards, and guidance
and states informing that:
- Users are accessing an SPC information system.
- Information system usage may be monitored, recorded, and subject to audit.
- Unauthorized use of the information system is prohibited and subject to criminal and civil penalties.
- Use of the information system indicates consent to monitoring and recording.
- There are no rights to privacy.
- The notification message or banner remains on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system.
- For publicly accessible systems, the IT Department shall ensure that the information
system:
- Displays acceptable use information before granting further access.
- Displays references to monitoring, recording, or auditing consistent with privacy accommodations for such systems that generally prohibit those activities.
- Includes a description of the authorized uses of the system.
Session Lock
SPC-IS Department shall ensure that the information system:
- Prevent further access to the system by initiating a session lock after 15 minutes of inactivity or upon receiving a user's request.
- Retain the session lock until the user re-establishes access using established identification and authentication procedures.
- Conceal, via the session lock, information previously visible on the display with a publicly viewable image.
Session Termination
SPC-IS Department shall:
- Ensure the information system automatically terminates a user session after 30 minutes.
Permitted Actions Without Identification or Authentication (Public Website)
SPC-IS Department shall:
- Identify user actions that can be performed on the information system without identification or authentication consistent with organizational missions and business functions.
- Document and provide supporting rationale in the security plan for the information system and user actions that do not require identification or authentication.
Remote Access
SPC-IS Department shall:
Associated Standard: Remote Access Standard: I-G
- Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed (e.g., virtual desktop, VPN)
- Authorize remote access to the information system before allowing such connections.
- Ensure that the information system monitors and controls remote access methods.
- Ensure that the information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
- Ensure that the information system routes all remote access through managed network access control points to reduce the risk of external attacks.
- Authorize the execution of privileged commands and access to security-relevant information via remote access only for administrative needs.
- Document the rationale for such access in the security plan for the information system.
Wireless Access
SPC-IS Department shall:
Associated Standard: 802.11 Wireless Network Security Standard: I-H
- Establish usage restrictions, configuration/connection requirements, and implementation guidance for wireless access.
- Authorize wireless access to the information system before allowing such connections.
- Ensure that the information system protects wireless access by authenticating users and devices and encrypting data.
- Ensure that the Guest's wireless connection restricts access to the internet only. No internal systems are available when using Guest Wireless.
Access Control for Mobile Devices
SPC-IS Department shall:
- Establish usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices.
- Authorize the connection of mobile devices to organizational information systems.
- Employ full-device encryption or container encryption to protect the confidentiality and integrity of information on approved devices.
Use Of Externally Hosted Systems
SPC-IS Department shall:
- Establish terms and conditions consistent with any trust relationships established
with other organizations owning, operating, and maintaining externally hosted systems,
allowing authorized individuals to:
- Access the externally hosted system from SPC systems
- Process, store, or transmit organization-controlled information using external information systems.
- Permit authorized individuals to use an external information system to access the
information system or to process, store, or transmit organization-controlled information
only when the organization:
- Verifies the implementation of required security controls on the external system as specified in the Configuration Management Standard: I-E(a).
- Retains approved information system connection or processing agreements with the organizational entity hosting the external information system.
Information Sharing
SPC-IS Department shall:
- Facilitate information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information.
- Employ system administrative and data owner support to assist users in making information-sharing/collaboration decisions.
Publicly Accessible Content
SPC-IS Department shall:
- Designate individuals authorized to post information onto a publicly accessible information system.
- Train authorized individuals to ensure publicly accessible information does not contain nonpublic information.
- Review the proposed information content before posting it onto the publicly accessible information system to ensure that nonpublic information is not included.
- Review the content on the publicly accessible information system for nonpublic information monthly and remove such information if discovered.
Multi-Factor Authentication
SPC-IS Department has:
- Adopted an MFA policy that defines multi-factor authentication and the scope of the enforcement for the policy MFA Policy: I-D(d)
Compliance
Employees who violate this policy may be subject to appropriate disciplinary action, including discharge and civil and criminal penalties. Non-employees, including, without limitation, contractors, may be subject to termination of contractual agreements, denial of access to IT resources, and other actions, as well as civil and criminal penalties.
Policy Exceptions
Requests for exceptions to this policy shall be reviewed by the Information Security Officer (ISO) and the Chief Information Officer (CIO). Departments requesting exceptions shall make such requests to the CIO. The request should expressly state the scope of the exception along with justification for granting the exception, the potential impact or risk attendant upon granting the exception, risk mitigation measures to be undertaken by the IT Department, initiatives, actions, and a time frame for achieving the minimum compliance level with the policies set forth herein. The CIO shall review such requests and confer with the requesting department.
Related Policies, References and Attachments:
National Institute of Standards and Technology (NIST) Special Publications (SP): NIST SP 800-53a – Access Control (AC), NIST SP 800-12, NIST 800-46, NIST SP 800-48, NIST SP 800-77, NIST SP 800-94, NIST SP 800-97, NIST SP 800-100, NIST SP 800-113, NIST SP 800-114, NIST SP 800-121, NIST SP 800-124, NIST SP 800-164;
NIST Federal Information Processing Standards (FIPS) 199
Texas Security Controls Standards Catalog Control Group: AC-1
NIST Function Groups: ID.AM-1, ID.AM-2. ID.SC-2, PR.AC-1, PR.AC-4, PR.DS-3, PR.IP-1, PR.PT-1
