Perimeter Security Change Request
The University of North Carolina at Greensboro
Policy Reference: Security of Networks and Networked Data
Approved: November 30, 2006
Document Maintainer: Security Officer, ITS - Technology Planning
Purpose
This procedure addresses the following sections of the related policy:
Section III.F
"The perimeter of UNCG's network infrastructure is defined as the electronic border between the UNCG campus network, and the first Internet Service Provider (ISP) networking device supplying wide area network (WAN) connectivity.
- ITS maintains perimeter security for the purposes of general infrastructure protection.
- Only authorized ITS employees may modify perimeter security measures.
- All application servers must be specifically identified to ITS."
Perimeter security is maintained in the common interest of the entire campus community and is considered the first line of defense from external network threats.
Scope
All campus network citizens are impacted by these measures and may need to use this procedure.
Responsible Parties
- Faculty, Staff, and Students
- Others authorized to connect to UNCG network
- ITS-Networks Architecture and Security
Procedure
Criteria
This procedure should be employed if, after consulting with ITS staff, a client believes that perimeter security is preventing the correct operation of a network application.
Process
The client should initially try to have the application problem diagnosed through the Service Deck via 6-TECH . ITS staff will confirm for the client if perimeter security is preventing the application from operating normally.
If the issue is not resolved through the normal diagnostic channels, the client must provide a written business case to the Service Desk explaining why their application requires a change in perimeter security. Before submitting the business case the client must review all applicable University policies. Within this business case, the following questions must be addressed:
- What is the purpose of the application under consideration?
- What classification of data will be accessed via this application?
- Who is the client group of the proposed application?
- What other software alternatives, if any, are available?
- What is your contingency plan if your request is denied?
The business case will be reviewed with the following considerations:
- What known and immediate risks are posed to the campus?
- Does granting the request violate the data classification policy?
- Are the known risks too high?
- How does granting this request compare to best industry practices?
- Is meeting this request in the best interests of the University?