1. Security Guide for Interconnecting Information Technology Systems
ANUSHA KAMINENI
SECURITY MANAGEMENT

2. AGENDA
Introduction
Background
Lifecycle of System Interconnection

3. EXECUTIVE SUMMARY Security guide for Interconnecting systems
Life-Cycle Management
Planning a system interconnection
Establishing a system interconnection
Maintaining a system interconnection
Disconnecting a system interconnection
ISA and MOU/A
System Interconnection Implementation plan

4. INTRODUCTION
Authority
Purpose
Scope
Audience
Document Structure

5. Figure 1: Interconnection Components
BACKGROUND
Figure 1: Interconnection Components

6. Why to interconnect IT systems?
Exchange data & information
Provide customized levels
Collaborate on Joint projects
Provide full time communications
Provide online training
Provide secure storage of data

7. PLANNING A SYSTEM INTERCONNECTION
Figure 2. Steps to plan a system interconnection

8. PLANNING A SYSTEM INTERCONNECTION
Establish a Joint planning team
Define the Business case
Perform C & A
Determine Interconnection Requirements
Document Interconnection Agreement
Approve or Reject Interconnection

9. Determine Interconnection Requirements
Level and method of interconnection
Impact on existing Infrastructure and Operations
Hardware Requirements
Software Requirements
Data Sensitivity
User Community
Services and Applications
Security controls
Segregation of Duties
Incident Reporting and Response
Contingency Planning

10. …..continued Determine Interconnection Requirements
Data element naming and ownership
Data Backup
Change Management
Rules of Behavior
Security Training and Awareness
Roles and Responsibilities
Scheduling
Costs and Budgeting

11. Document Interconnection Agreement
Develop an interconnection security agreement
Establish a memorandum of Understanding

12. Approve or Reject Interconnection
Approve the interconnection
Grant interim approval
Reject the interconnection

13. ESTABLISHING A SYSTEM INTERCONNECTION
Fig 3. Steps to Establish a system Interconnection

14. ESTABLISHING A SYSTEM INTERCONNECTION
Develop Implementation Plan
Execute Implementation Plan
Activate Interconnection

15. Execute Implementation Plan
Implement or configure security controls
Firewalls
Intrusion Detection
Auditing
Identification and Authentication
Logical Access controls
Virus scanning
Encryption
Physical and Environmental security

16. …. continued Execute Implementation Plan
Install or configure hardware and software
Communications line
VPN
Routers and switches
Hubs
Servers
Computer Workstations
Integrate Applications
Conduct operational and security testing
Conduct security Training and awareness
Update systems security plans
Perform Recertification and Reaccreditation

17. MAINTAINING A SYSTEM INTERCONNECTION
Maintain clear lines of communication
Maintain equipment
Manage user Profiles
Conduct security reviews
Analyze audit logs
Report & respond to security incidents
Coordinate contingency planning activities
Perform Change management
Maintain system security plans

18. DISCONNECTING A SYSTEM INTERCONNECTION
Planned disconnection
Emergency disconnection
Restoration of interconnection

19. EXECUTIVE SUMMARY Security guide for Interconnecting systems
Life-Cycle Management
Planning a system interconnection
Establishing a system interconnection
Maintaining a system interconnection
Disconnecting a system interconnection
ISA and MOU/A
System Interconnection Implementation plan

20. IMPORTANT TERMS Audit Trail Integrated Services Digital Network(ISDN)
Interconnection Security Agreement(ISA)
Intrusion Detection System (IDS)
Memorandum of Understanding/Agreement(MOU/A)
RADIUS (Remote Authentication Dial-In User Service)
Security Controls
System interconnection
Virtual Private Network(VPN)

21. QUESTIONS?