Desktop Security
Overview
Desktop Security covers the protection of desktops provided by MaineIT and the personnel that use them and/or access State of Maine data.
Included
- Incident response
- Ensure that all State of Maine provided equipment has antivirus/malware protection and that those keep up to date with the latest virus definition files
- Website control – provide the ability to block sites that are not needed for business purposes by category, as a base we block“”
- Drive encryption – ensure that all MaineIT provided workstations have encrypted hard drives
- Vulnerability risk analysis - provide risk analysis of malware and create rules to block
- Audit – assist with desktop audits where needed to ensure that systems have been hardened per regulatory requirements
- Security awareness training - provide yearly security awareness training to all personnel that have access to State of Maine information assets
- Phishing exercises - conduct at least quarterly to train personnel to identify suspicious email and provide reports to agency management
- Desktop DLP – provide data loss prevention to agencies that request this service; implement DLP rules in accordance with the agencies’ requirements
- File and Removeable Media – Provide encryption for removeable devices (usb, cd, etc.). Ensure that users can encrypt devices as needed and block users that do not need the capability of using removeable media
Service Level Targets & Availability
- The standard production published service level agreements can be viewed at the following link: Standard_SLA_CTS_Production Services
- A formal SLA has not been developed specific to this service
Service Rates: This service is covered by the desktop support subscription MaineIT Rate Table
Options Available for Additional Charge
- Desktop Data Loss Prevention (AKA Host DLP)
- Audit/Compliance scans using Nessus
- File and Removeable Media Protection
Customer Expectations
- Proper reporting of issues will ensure that SLAs are met and users are protected
- Providing as much detail at the initial reporting of an incident is paramount for proper risk analysis and the ability to help solve issues
To get help or order this service
- Call MaineIT Service Center at 624-7700
- Create a ticket in the Enterprise Security workspace https://footprints.state.me.us/footprints/security.html
Application Security
Overview
Application Security covers scanning, analysis, and explanation of risks pertaining to application vulnerabilities. As part of this service risk levels are explained to the business to help understand the level of risk is associated with an application being hosted by MaineIT.
Included
- Application vulnerability scans
- Vulnerability risk analysis
- Incident response
- Architecture review for application infrastructure design
Service Level Targets & Availability
- Application scans are run as requested through the application deployment certification process
- Risk analysis is done on an ad hoc basis, generally as a part of the scanning process
Service Rates: Please see the MaineIT Rate Table
Options Available for Additional Charge
- Cyber Security Consulting
- Risk assessment
Customer Expectations
- Application testing - Ensuring that data needed to run a scan is provided in its entirety is important and is the responsibility of the requestor. If there are any questions on what is needed for information, check with the Security Infrastructure team prior to submitting a request
- Risk Analysis – To provide risk analysis, proper detail and requirements need to be provided as variable to this information can change the risk level
To get help or order this service
- Create a ticket in the Enterprise Security workspace: https://footprints.state.me.us/footprints/security.html
- Contact Security.infrastructure@maine.gov
- Call MaineIT Service Center at 624-7700