Part 2 - Risk Assessment for Dual ISP – Bypass Proxy Feature In understanding and assessing the level of risk that exists in relation to Department information assets, school management needs to consider the potential impact should any identified risks arise, as well as the likelihood of such an event. This will provide the basis for the overall assessment of the level of risk that is faced. The process and documentation outlined in this section is required under the SA Government’s mandated Information Security Management Framework (ISMF). Most risks introduced by bypassing features are common to all schools considering this approach. To aid schools in understanding these risks, this document outlines these common risks. It is important to acknowledge that every school environment is different, and it is the Principal’s responsibility to review these risks and consider their environment for any additional risks that may be present. In assessing the Consequence, Likelihood and Overall Risk rating, the site should follow the Risk Ratings within the matrix in Appendix A. RISK DESCRIPTION SUMMARY OF RISK CONSEQUENCE LIKELIHOOD OVERALL RISK RISK TREATMENT MANAGEMENT PRACTICES (1—5) (1—5) RATING Further actions required to monitor risk or improve controls, or comment on acceptance (CONTROLS) ALREADY of risk. IMPLEMENTED These actions will contribute to minimising identified risks Activity associated with client devices The McAfee Web Gateway solution 3 5 H This risk is inherent to the bypass request. cannot be attributed to the exact provides for the logging of IP addresses Technical controls the site could possibly individual user at the time of client and the web activity. Reports can be implement that will assist in associating the asset use. produced that can attribute activity to activity to a device and/or user include; an IP address. Retain DHCP logs (when combined with the available reporting) Register of Device/MAC Address and allocated user/owner (when combined with the available reporting) Force static based IP addresses on MAC address Implement an alternative form of authentication that integrates with the school network Access to inappropriate content by ICT Assurance release communications 3 3 M School to ensure user acceptance policy is users when accessing the Internet on signed-off by student/parent/guardian. to assist site leaders to evaluate and devices in bypass list. Client assets that are configured in the review access rights and risk bypass list are generally used by students minimisation strategies that provide when under staff supervision. Staff will need confidence that policy and procedures to ensure that this is adhered to. are understood and complied with to assure ongoing improvement in this area.
Part 2 - Risk Assessment for Dual ISP – Bypass Proxy Feature In understanding and assessing the level of risk that exists in relation to Department information assets, school management needs to consider the potential impact should any identified risks arise, as well as the likelihood of such an event. This will provide the basis for the overall assessment of the level of risk that is faced. The process and documentation outlined in this section is required under the SA Government’s mandated Information Security Management Framework (ISMF). Most risks introduced by bypassing features are common to all schools considering this approach. To aid schools in understanding these risks, this document outlines these common risks. It is important to acknowledge that every school environment is different, and it is the Principal’s responsibility to review these risks and consider their environment for any additional risks that may be present. In assessing the Consequence, Likelihood and Overall Risk rating, the site should follow the Risk Ratings within the matrix in Appendix A. RISK DESCRIPTION SUMMARY OF RISK MANAGEMENT PRACTICES (CONTROLS) ALREADY IMPLEMENTED CONSEQUENCE (1—5) LIKELIHOOD (1—5) OVERALL RISK RATING RISK TREATMENT Further actions required to monitor risk or improve controls, or comment on acceptance of risk. These actions will contribute to minimising identified risks Activity associated with client devices cannot be attributed to the exact individual user at the time of client asset use. The McAfee Web Gateway solution provides for the logging of IP addresses and the web activity. Reports can be produced that can attribute activity to an IP address. 3 5 H This risk is inherent to the bypass request. Technical controls the site could possibly implement that will assist in associating the activity to a device and/or user include; Retain DHCP logs (when combined with the available reporting) Register of Device/MAC Address and allocated user/owner (when combined with the available reporting) Force static based IP addresses on MAC address Implement an alternative form of authentication that integrates with the school network Access to inappropriate content by users when accessing the Internet on devices in bypass list. ICT Assurance release communications to assist site leaders to evaluate and review access rights and risk minimisation strategies that provide confidence that policy and procedures are understood and complied with to assure ongoing improvement in this area. 3 3 M School to ensure user acceptance policy is signed-off by student/parent/guardian. Client assets that are configured in the bypass list are generally used by students when under staff supervision. Staff will need to ensure that this is adhered to.
GoToWebinar-Dual-ISP-Bypass-Proxy-Feature-Request.docx