Page History

BRIEF

Policy Summary

This policy describes security responsibilities and requirements for Laboratory Information Technology (IT).

This

includes

responsibilities

and

requirements

for:

• Individuals

• and

• supervisors

• Certain

• roles

• such

• as

• system

• administrator,

• web

• server

• owner,

• and

• application

• developer

• Divisions,

• including

• division

• security

• liaisons

• The

• Cyber

• Security

• Program

• (CSP)

Who

Should

Read

This

Policy

• Employees

• and

• affiliates

• who

• use

• or

• manage

• Laboratory

• IT

• or

• Laboratory

• Information

• Employees

• with

• additional

• security

• responsibilities

• for

• Laboratory

• IT,

• such

• as

• computer

• security

• liaisons

• or

• members

• of

• the

• CSP

To

Read

the

Full

Policy,

Go

To:

The

POLICY

tab

on

this

wiki

page

Contact

Information

Information

Technology

Policy

Manager

Information

Technology

Division

[email protected]

POLICY

A.

Purpose

The

purpose

of

this

policy

is

to

enable

a

computing

environment

for

Lawrence

Berkeley

National

Laboratory

(Berkeley

Lab)

that

is

both

open

and

appropriately

secure.

B.

Persons

Affected

This

policy

applies

to

employees

and

affiliates

as

well

as

individuals

with

additional

security

responsibilities

for

Laboratory

Information

Technology

(IT).

C.

Exceptions

The

Berkeley

Lab

Chief

Information

Officer,

the

Cyber

Security

Manager

(CSM),

and

the

Cyber

Security

Program

(CSP)

may

approve

exceptions

to

this

policy.

D.

Policy

Statement

D.1

Employees

and

Affiliates

1. Everyone

1. Is

1. Responsible

1. for

1. Security.

1. Laboratory

1. IT

1. Security

1. is

1. a

1. line-management

1. function

1. at

1. Berkeley

1. Lab.

1. Employees

1. and

1. affiliates

1. are

1. responsible

1. for

1. the

1. security

1. of

1. computers

1. and

1. devices

1. that

1. they

1. use

1. or

1. manage.

1. They

1. must

1. take

1. appropriate

1. steps

1. to

1. secure

1. Laboratory

1. IT

1. and

1. Information

1. that

1. they

1. create,

1. possess,

1. manage,

1. or

1. have

1. access

1. to

1. in

1. connection

1. with

1. their

1. Laboratory

1. employment

1. or

1. research.

1. 1. Authorizing

1. 1. Access

1. 1. to

1. 1. IT

1. 1. Resources.

1. 1. Employees

1. 1. and

1. 1. affiliates

1. 1. may

1. 1. authorize

1. 1. the

1. 1. use

1. 1. of

1. 1. Laboratory

1. 1. IT

1. 1. that

1. 1. they

1. 1. manage.

1. 1. When

1. 1. authorizing

1. 1. use,

1. 1. employees

1. 1. and

1. 1. affiliates

1. 1. assume

1. 1. security

1. 1. responsibility

1. 1. for

1. 1. the

1. 1. use

1. 1. and/or

1. 1. user

1. 1. and

1. 1. must

1. 1. ensure

1. 1. that

1. 1. Berkeley

1. 1. Lab

1. 1. IT

1. 1. policies

1. 1. are

1. 1. communicated

1. 1. to

1. 1. the

1. 1. user

1. 1. and

1. 1. followed

1. 1. in

1. 1. the

1. 1. course

1. 1. of

1. 1. granting

1. 1. access.

1. 2. Reviewing

1. 1. Authorization.

1. 1. After

1. 1. authorization,

1. 1. employees

1. 1. and

1. 1. affiliates

1. 1. must

1. 1. review

1. 1. access

1. 1. on

1. 1. a

1. 1. schedule

1. 1. appropriate

1. 1. to

1. 1. the

1. 1. risks

1. 1. presented

1. 1. by

1. 1. the

1. 1. service

1. 1. or

1. 1. system.

2. Security

1. Requirements.

1. Employees

1. and

1. affiliates

1. must

1. ensure

1. that

1. computers

1. and

1. devices

1. they

1. use

1. or

1. manage

1. meet

1. the

1. Minimum

1. Security

1. Requirements

1. . Employees with specific roles must meet the Role-Based Security Requirements. Employees and affiliates must meet any additional requirements and procedures that CSP determines are necessary to secure the Laboratory.
   1. Minimum Security Requirements. Minimum security requirements protect both the integrity of Laboratory Information and our network by providing a baseline level of protection for devices. Requirements may include training, security patches, passwords, media protection, anti-virus protection, physical protections, and network access.
   2. Role-based Security Requirements. Certain roles require additional security requirements to protect Laboratory IT and Information. Roles include system administrators, web server owners, and application developers.
   3. Other Requirements. Employees and affiliates must adhere to additional requirements, standards, and procedures that the Cyber Security Program (CSP) determines are necessary to protect Laboratory IT and Information. Additional requirements are available on the CSP's Security Requirements page.
2. Reporting Security Incidents. Employees and affiliates must follow the appropriate procedures to report cyber security incidents, including the loss or theft of Laboratory IT or Information.

D.2 Laboratory Management

1. Supervisors and managers must provide adequate oversight to ensure that employees and affiliates under their management are taking appropriate steps to secure Laboratory IT and Information throughout its lifecycle.
2. The division or department director must ensure that the division adheres to policies, requirements, and procedures related to securing Laboratory IT and Information.
3. The division or department director must designate a Computer Security Liaison who has authority and responsibility for coordination of computer security activities.

D.3 Exceptions and Enforcement

1. Exceptions to Security Requirements
   1. Some systems, most commonly scientific ones, are unable to meet the security requirements. Possible reasons include:
      1. Technical. For example, a legacy operating system that does not have patches for some vulnerability.
      2. Operational. For example, a device that performs experiments, such as genome sequencing or systems used in the Advanced Light Source (ALS) control, may have uptime requirements such that they cannot be patched or rebooted.
      3. Cost-efficiency. For example, the cost, either monetarily or for mission reasons, of upgrading a device to meet requirements exceeds the security benefit.
   2. Exceptions. Employees and affiliates should take a risk-based approach to using exceptions and seek guidance from CSP as appropriate. CSP may refuse exceptions based on institutional risk or require compensating controls.
2. Enforcement. Employees and affiliates who do not comply with this policy may temporarily be denied access to Laboratory IT and may be subject to other penalties and disciplinary action up to and including termination. Non-compliant devices may be disconnected from the Laboratory network until the device is compliant.

D.4 Cyber Security Program

The CSP has the authority and responsibility to support the security of Laboratory IT and Information. The program must:

1. Provide general protection for Laboratory IT and Information that is risk-based, cost-effective, and supports the mission of the Laboratory
2. Establish requirements, standards, procedures, and guidelines to help secure Laboratory IT and Information and comply with applicable regulations and requirements
3. Provide information and resources to help Laboratory divisions and employees meet their security responsibilities
4. Elicit input from divisions and programs on security policies and procedures

Although CSP supports the security of Laboratory IT and Information, ultimate responsibility for security and its implementation rests with each employee and affiliate.

E. Roles and Responsibilities

Employees and affiliates must adhere to this policy. The table below describes specific responsibilities, authorities, and accountabilities by role:

F. Definitions/Acronyms

G. Recordkeeping Requirements

None

H. Implementing Documents

I. Contact Information

Information Technology Policy Manager
Information Technology Division
[email protected]

J. Revision History