ÌÇÐÄVlog¹Ù·½

Consolidated View — Minimum Security Standards

Last Updated 2022-07-15

When working with Regulated Data, please refer to the applicable Standard, Act, or Policy (e.g., CMMC, PCI DSS, HIPAA, FERPA, NIST SP800-171, etc.) for specific details on any additional controls needed.

The table below provides a consolidated view of the Minimum Security Standards for each device type. A checkmark indicates that a standard is included in the corresponding device types standard listing (endpoints, servers, multi-function devices & internet-of-things). Standards may differ between each device type, please refer to each respective document for implementation details.

The standards listed in the table below are adapted from a subset of the CIS Controls based on its applicability to the University of Hawaiʻi. The Center for Internet Security's (CIS) Controls, are a prioritized set of actions that collectively form a defense-in-depth set of best practices that mitigate the most common attacks against systems and networks.

Quick Reference

• 1.0 - Patching
• 2.0 - Firewall Configuration
• 3.0 - Password Security
• 4.0 - Data Management
• 5.0 - Encryption
• 6.0 - Asset Management
• 7.0 - Data Inventory
• 8.0 - Removable Media
• 9.0 - Malware Protection
• 10.0 - Session Timeout
• 11.0 - Backups
• 12.0 - Multi-Factor Authentication (MFA)
• 13.0 - Centralized Logging
• 14.0 - Secure Access
• 15.0 - Secure Configuration
• 16.0 - Event Logging
• 17.0 - Network Security
• 18.0 - Access Control
• 19.0 - Account Management
• 20.0 - Vulnerability Scanning

#	Standards	Device Types
1.0	Automatic Updates / Patching	Endpoints	Servers	MFD / IoT
1.1	Enable automatic updates for operating systems and software if possible.
1.2	Install standard operating system and software security patches on a monthly basis for servers and networking devices.
1.3	Ensure operating systems and software including email clients and browsers are fully supported by their vendors. End-of-life software and operating systems do not receive security updates.
2.0	Firewall	Endpoints	Servers	MFD / IoT
2.1	Configure and manage a host based firewall or a network firewall device with a default deny-all policy. Only necessary services should be allowed through the firewall.
3.0	Password Security	Endpoints	Servers	MFD / IoT
3.1	Ensure that all devices have strong and unique password protected individual logins for all local and remote accounts.
3.2	Ensure that all web applications have strong and unique password protected individual logins for administrative accounts.
4.0	Data Management	Endpoints	Servers	MFD / IoT
4.1	Utilize the University's records management process for .
4.2	Securely dispose of Institutional Data following our Disposal Guidelines.
4.3	Use Spirion to scan for sensitive and regulated information on a monthly basis.
5.0	Encryption	Endpoints	Servers	MFD / IoT
5.1	Ensure that data is encrypted with a secure encryption algorithm while in transit.
5.2	Utilize Windows BitLocker or Apple FileVault to enable whole disk encryption on endpoints and removable devices. Ensure that files containing Sensitive and Regulated data stored on servers, applications, databases, and removable media are encrypted or stored in an encrypted file container such as Veracrypt.
5.3	Utilize ÌÇÐÄVlog¹Ù·½ Enterprise Dropbox to store Sensitive and Regulated data online.
6.0	Asset Management	Endpoints	Servers	MFD / IoT
6.1	Complete the Annual Device Registration.
6.2	Maintain an updated inventory of all software and hardware assets.
6.3	Ensure that hardware and software assets are fully supported by their vendors.
6.4	Review asset lists on a monthly basis. Remove any unauthorized or End-of-Life assets.
7.0	Data Inventory	Endpoints	Servers	MFD / IoT
7.1	Complete the annual Personal Information Survey (PIS).
8.0	Removable Media	Endpoints	Servers	MFD / IoT
8.1	Disable autorun / autoplay for removable media.
9.0	Malware Protection	Endpoints	Servers	MFD / IoT
9.1	Install and enable an anti-malware solution.
9.2	Ensure automatic anti-malware signature updates are enabled.
9.3	Enable anti-exploitation features.
10.0	Session Locking / Session Timeout	Endpoints	Servers	MFD / IoT
10.1	Configure a maximum 15 minute session timeout for system access and remote access protocols (SSH, RDP, etc.).
11.0	Backups	Endpoints	Servers	MFD / IoT
11.1	Maintain an offline, off-site, or cloud-based backup instance.
11.2	Ensure backups are encrypted.
11.3	Perform automatic backups of systems on at least a weekly basis.
12.0	Multi-Factor Authentication(MFA)	Endpoints	Servers	MFD / IoT
12.1	Enable multi-factor authentication to access externally-exposed applications, remote network access, and administrative access where possible.
12.2	Utilize ÌÇÐÄVlog¹Ù·½ login for public facing web application logins if applicable.
13.0	Centralized Logging	Endpoints	Servers	MFD / IoT
13.1	Deploy a centralized log management system for servers and aggregate logs.
13.2	Retain centralized logs for at least 90 days. Adequate log storage must be accounted for.
13.3	Review centralized audit logs on a weekly basis.
14.0	Secure Access	Endpoints	Servers	MFD / IoT
14.1	Access applications and manage software over a secure encrypted connection (SSH, HTTPS, etc.).
14.2	Limit access to MFDs and IoT devices by authorized IPs if possible.
15.0	Secure Configuration	Endpoints	Servers	MFD / IoT
15.1	Ensure that servers and network devices are configured following industry security best practices. CIS Configuration Guides are recommended. Configuration scripts are available upon request.
15.2	Uninstall or disable unnecessary and unused services on servers and network devices.
16.0	Event Logging	Endpoints	Servers	MFD / IoT
16.1	Enable logging of system, security, and application events.
16.2	Retain logs for at least 90 days. Adequate log storage must be accounted for.
16.3	Review audit logs on a weekly basis.
17.0	Network Security	Endpoints	Servers	MFD / IoT
17.1	Utilize network segmentation to address least privilege by isolating personal, untrusted, and IoT devices from critical services.
17.2	Maintain network architecture diagrams.
17.3	Utilize Wi-Fi Protected Access 2 (WPA2) with AES-128 or greater and a strong password for wireless networks.
18.0	Access Control	Endpoints	Servers	MFD / IoT
18.1	Maintain an updated access control list of user roles, accounts and permissions for local/remote file systems, databases, and applications.
18.2	Grant access and apply access privileges to systems and services on a need to know basis.
18.3	Revoke privileges to systems and services upon employee termination, rights revocation, or role change.
19.0	Account Management	Endpoints	Servers	MFD / IoT
19.1	Restrict administrator privileges to individually dedicated administrator accounts.
19.2	Remove dormant accounts (45 days of inactivity).
19.3	Disable default system and software accounts or make them unusable.
19.4	Review account privileges and permissions quarterly.
20.0	Vulnerability Scanning	Endpoints	Servers	MFD / IoT
20.1	Perform vulnerability scans using or Nessus Agents on a monthly basis.
20.2	Remediate all High and Critical severity vulnerabilities within 7 days.