Information Governance Policies and Procedures 2013
ISMS15
Router Security Policy
ISMS Policy Index
ISMS01 Information Governance Policy Statement
ISMS02 Information Security Policy
ISMS03 Risk Management Policy
ISMS04 Internal Audit Plan
ISMS05 Information Security Risk Assessment Policy
ISMS06 Business Continuity Plan
ISMS07 Clear Desk and Screen Policy
ISMS08 Email Security/Acceptable Use Policy
ISMS09 Laptop and Portable Device Security Policy
ISMS10 Outsourcing Security Policy
ISMS11 Physical Access Policy
ISMS12 Lifecycle Management Policy
ISMS13 Confidentiality Code of Practice
ISMS14 Personal Information Handling Policy
ISMS15 Router Security Policy
ISMS16 Training & Development Policy
ISMS17 Document and Record Control Policy
ISMS18 Record Retention and Disposal Policy
ISMS19 Data Quality Policy
Please Note: Printed copies of this material may be out of date. View the online document for updates
ISMS15
Router Security Policy
ISMS 2013
Current Version
Responsibility of
Information Governance Lead
Reviewed by
IG Group
First Issued
16 March 2011
Last Review Date
December 2012
Next Review Date
December 2013
Version History
Version
Date
Comment
Initials
Draft
16/3/11
Draft ISMS 2011
PE
13/7/11
Draft QA
ASD
2.0
1/10/11
Issued to company for comment
ASD
2.1
Dec 11
Updated for issues arising from company-wide
review
ASD
3.1
25/1/12
Latest version release incorporating changes
from review by all staff October 2011
ASD
4.0
11/03/13
Latest version release incorporating changes
from review by all staff December 2012
PB
Roles and Responsibilities
Information Governance Lead
Chris May
Information Security Lead
Steve Exley
Patient Data Governance
Chris Eldridge
Company and Employee Data Governance
Alison Sturgess-Durden
Assurance Lead
Paula Bullen
Signature
ISMS15
Router Security Policy
ISMS 2013
CONTENTS
1
2
3
Purpose ........................................................................................................................................... 1
Scope ............................................................................................................................................... 1
Definitions ....................................................................................................................................... 1
3.1
Terms and Definitions ............................................................................................................. 1
4
Policy ............................................................................................................................................... 1
ISMS15
Router Security Policy
1
ISMS 2013
Purpose
This document describes a required minimal security configuration for all routers and switches
connecting to a production network or used in a production capacity at or on behalf of Mayden.
2
Scope
All routers and switches connected to Mayden production networks are affected. Routers and
switches within internal, secured labs are not affected.
3
Definitions
3.1
Terms and Definitions
Production Network: The "production network" is the network used in the daily business of
Mayden. Any network connected to the corporate backbone, either directly or indirectly, which lacks
an intervening firewall device. Any network whose impairment would result in direct loss of
functionality to Mayden employees or impact their ability to do work.
Lab Network: A "lab network" is defined as any network used for the purposes of testing,
demonstrations, training, etc. Any network that is stand-alone or firewalled off from the production
network(s) and whose impairment will not cause direct loss to Mayden nor affect the production
network.
4
Policy
Every router must meet the following configuration standards:
1. No local user accounts are configured on the router.
2. The enable password on the router must be kept in a secure encrypted form. The router
must not have the enable password set to the current production router password from the
router's support organisation. The Router Password must be changed periodically (every 4-6
months). All passwords defined on the router should meet the following criteria:
•
Minimum 8 characters in length
•
Should be alphanumeric along with special characters (@#$%)
•
Should not include organisation’s name in it
3. Access rules are to be added as business needs arise.
4. The router must be included in the corporate enterprise management system with a
designated point of contact.
5. All user accounts should be assigned the lowest privilege level that allows them to perform
their duties.
1