whether Partially appropriate No security settings Service Provider maintains a wireless network with D-14. N/A are enabled. controlled and secure access points. Yes Partially No E-8. Service E. Configuration Controls Provider manages file and directory E-1. All Service Provider's computers and systems are kept N/A permissions for current with security patches and protected from malware. Yes "least privilege" Partially and No accesses. N/A E-2. Service Provider employs encryption for sensitive information (protected health information, student identifiable, Yes personnel information, intellectual property, etc.) for external or Partially N/A Yes Internet transmissions with keys of at least 128 bits in length No Partially for No N/A symmetric encryption and 1024 bits or greater in length for asymmetric encryption. Yes Response: Partially E-3. Service Provider removes unnecessary services from N/A No computers that are used to access target systems. Yes Partially No Service Provider's servers have anti-intrusion programs E-4. N/A installed (e.g., Tripwire, TippingPoint, etc.). Yes Partially No E-5. Service Provider ensures that all vendor-supplied default identifiers and/or passwords or similar "published" access codes for all installed operating systems, database management N/A Yes systems, network devices, application packages, and any Partially commercially produced IT products have been changed or No SAMPLE disabled. to N/A E-6. Service Provider ensures that passwords are never Yes stored in clear text or are easily decipherable. Northwestern University Service Provider Security Assessment Page 7 of 15
D-14. Service Provider maintains a wireless network with controlled and secure access points. E. Configuration Controls E-1. All Service Provider's computers and systems are kept current with security patches and protected from malware. E-2. Service Provider employs encryption for sensitive information (protected health information, student identifiable, personnel information, intellectual property, etc.) for external or Internet transmissions with keys of at least 128 bits in length for symmetric encryption and 1024 bits or greater in length for asymmetric encryption. E-3. Service Provider removes unnecessary services from computers that are used to access target systems. E-4. Service Provider's servers have anti-intrusion programs installed (e.g., Tripwire, TippingPoint, etc.). E-5. Service Provider ensures that all vendor-supplied default identifiers and/or passwords or similar "published" access codes for all installed operating systems, database management systems, network devices, application packages, and any commercially produced IT products have been changed or disabled. E-6. Service Provider ensures that passwords are never stored in clear text or are easily decipherable. to whether appropriate security settings are enabled. E-8. Service Provider manages file and directory permissions for "least privilege" and accesses. N/A Yes Partially No Response: N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No SAMPLE Northwestern University Service Provider Security Assessment Page 7 of 15
Sample_SPSA_Read_Only.docx