Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around system and communications protection.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.System and Communications Protection controls implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the System and Communications Protection policy and associated controls;
3.1.2.Review and update System and Communications Protection procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional System and Communications Protection procedures related to the controls in this policy.
Component institutions must protect information systems against, or limit the effects of, institution-defined types of denial-of-service attacks by employing institution-defined safeguards.
5.1.Component institutions must:
5.1.1.Monitor and control communications at the external interfaces of each information system and at key internal interfaces within each information system;
5.1.2.Implement subnetworks for publicly accessible system components that are physically or logically separated from internal institutional networks; and
5.1.3.Connect to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an institutional security architecture.
5.2.Each component institution head (or their designated representative) and the institution’s information security officer must establish a security strategy that includes perimeter protection. Perimeter security controls incorporated in the perimeter protection strategy may include and/or affect some or all of the following components:
5.2.1.Demilitarized Zone(s) (DMZ);
5.2.2.Firewall(s);
5.2.3.Intrusion detection system(s);
5.2.4.Intrusion prevention system(s); and
5.2.5.Router(s).
6.1.Component institutions must ensure that each information system protects the confidentiality and/or integrity of transmitted information.
6.2.Component institutions must:
6.2.1.Document in a Standard, based on institutional risk-management decisions, encryption requirements for data transmissions of confidential and non-confidential information and encryption key standards and management; and
6.2.2.Encrypt confidential information with, at minimum, a 128-bit encryption algorithm when the confidential information is transmitted over a public network (e.g., the Internet).
7.1.Component institutions must establish and manage cryptographic keys for required cryptography employed within each information system in accordance with institution-defined requirements for key generation, distribution, storage, access, and destruction.
8.1.Component institutions must:
8.1.1.Determine institution-defined cryptographic uses; and
8.1.2.Implement institution-defined types of cryptography required for each specified cryptographic use.
9.1.Component institutions must:
9.1.1.Prohibit remote activation of collaborative computing devices and applications except for institution-defined devices and applications; and
9.1.2.Provide an explicit indication of use to users physically present at the devices.
10.1.Component institutions must ensure that each information system that provides name resolution services:
10.1.1.Provides additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the information system returns in response to external name/address resolution queries; and
10.1.2.Provides the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.
11.1.Component institutions must ensure that each information system requests and performs data origin authentication and data integrity verification on the name/address resolution responses the information system receives from authoritative sources.
12.1.Component institutions must ensure that information systems that collectively provide name/address resolution service for a component institution are fault-tolerant and implement internal and external role separation.
13.1.Component institutions must protect the confidentiality and/or integrity of institution-defined types of information at rest.
13.2.Component institutions must:
13.2.1.Document in a Standard, based on institutional risk-management decisions, encryption requirements for information storage devices, as well as specific requirements for portable devices, removable media, and encryption key standards and management;
13.2.2.Confidential information stored in a public location that is directly accessible without compensating controls in place (e.g., a webserver or fileserver accessible without authentication or other access controls) must be encrypted;
13.2.3.Discourage the use of portable devices to store confidential information; and
13.2.4.Require that confidential information be encrypted if copied to or stored on:
13.2.4.1.Endpoint computing devices not owned by a state agency;
13.2.4.2.Portable computing devices (regardless of ownership); or
13.2.4.3.Removable media (regardless of ownership).
14.1.Component institutions must ensure that each information system maintains a separate execution domain for each executing process.