Monthly reports will be 16. Describe procedures for requesting, Computer access request run and access will be establishing, issuing, and closing user forms are submitted via email denied for any user accounts in the system or application. These to the OAC Security who has not logged into procedures must include the process for Administrator who grants or the system for 6 reviewing and confirming access rights on a revokes user access and months. specified schedule. security template assignments. In addition, the LegalFiles Security Administrator will also review existing access rights periodically for security changes necessary due to staff turnover or role assignment changes. OAC system administrators Develop a plan to 17. Describe the procedures for identifying are responsible for reviewing monitor authentication and reporting security violations. failed authentication reports. reports and unusual Additionally, system usage system activity and reports are reviewed for report to OAC and OIT identifying unusual system in the event a security activity. In the event that a violation is detected. security violation is detected, the Security Administrator is informed, who then initiates DPA security violation incident handling procedure through notification to the OIT Service Desk. Vulnerability/penetration test 18. Vulnerability/Penetration testing results documents will only be documents available? available to state personnel as provisioned by the DPA Information Security Officer. The LegalFiles interface uses 19. Interface Security (transmission security, 2048 bit SSL. All sessions access control) require credential validation. LegalFiles support staff may 20. Vendor Access be granted application and data access to the extent required to carry out end user application support according to the annual maintenance contract. Login tracking and application Application 21. User Access activity logging is achieved configurations must be through the application, and is enhanced to enforce stored in the back-end strong password supporting database. settings including length, complexity, and expiration
16. Describe procedures for requesting, establishing, issuing, and closing user accounts in the system or application. These procedures must include the process for reviewing and confirming access rights on a specified schedule. Computer access request forms are submitted via email to the OAC Security Administrator who grants or revokes user access and security template assignments. In addition, the LegalFiles Security Administrator will also review existing access rights periodically for security changes necessary due to staff turnover or role assignment changes. Monthly reports will be run and access will be denied for any user who has not logged into the system for 6 months. 17. Describe the procedures for identifying and reporting security violations. OAC system administrators are responsible for reviewing failed authentication reports. Additionally, system usage reports are reviewed for identifying unusual system activity. In the event that a security violation is detected, the Security Administrator is informed, who then initiates DPA security violation incident handling procedure through notification to the OIT Service Desk. Develop a plan to monitor authentication reports and unusual system activity and report to OAC and OIT in the event a security violation is detected. 18. Vulnerability/Penetration testing documents available? Vulnerability/penetration test results documents will only be available to state personnel as provisioned by the DPA Information Security Officer. 19. Interface Security (transmission security, access control) The LegalFiles interface uses 2048 bit SSL. All sessions require credential validation. 20. Vendor Access LegalFiles support staff may be granted application and data access to the extent required to carry out end user application support according to the annual maintenance contract. 21. User Access Login tracking and application activity logging is achieved through the application, and is stored in the back-end supporting database. Application configurations must be enhanced to enforce strong password settings including length, complexity, and expiration
388929915.docx