The purpose of this document is to help answer the Minimum Security Standards for a Managed Windows server. The answers provided below describe an environment which the "Managed Servers - Windows" team can fully support.

Green - ITS Windows in compliance.

Orange - Shared responsibility.

Red - Not the responsibility of ITS Windows.

RedCell - ITS Windows NOT in compliance.

Prerequisites

The Minimum Security Standard can be found here: https://cybersecurity.yale.edu/mss/list

MSS 1

^{YALE-MSS-1: System Classification}

YALE-MSS-1.1: Classify the IT System and Meet the Minimum Security Standards

The ITS Windows team offers managed support for IT systems classified as servers, which we ensure to be suitable for all levels of risk classification.

MSS Details	ITS Windows Implementation
1.1.1 Classify the IT System as high, moderate, or low risk based on data classification, availability requirements, and external obligations	The Windows Team works with the server and application owners to determine the risk classification based on the risk level of the data and the outcome of the risk calculator.
1.1.2 Determine your system type	The System type will be Server in 99% of cases involving the Windows Services Team.
1.1.3 Determine if your system is Internet Accessible	The Windows Team works with the system owner to determine if the server is internet accessible.
1.1.4 Define roles and responsibilities for meeting and maintaining the Minimum Security Standards and any external security requirements throughout the lifespan of the system	The ITS Windows Team works with the system owner to determine the roles and responsibilities.
1.1.5 Ensure roles and responsibilities for meeting and maintaining all security requirements throughout the life cycle of the system are accepted by all parties	The ITS Windows team works with the system owner to ensure that roles and responsibilities are accepted by all parties.
1.1.6 Provide appropriate level of staffing to manage your systems in accordance with their security requirements	The ITS Windows Manager will ensure that there is appropriate level of staffing.
1.1.7 Budget for maintaining the ongoing support and maintenance of the system to meet its security requirements throughout the lifespan of the system	The ITS Windows team works with the system owner to provide the overall cost of maintaining the server. It is the responsibility of the system owner to budget for these costs.
1.1.8 Ensure a valid policy exception request is filed when a Minimum Security Standard cannot be met	It is the responsibility of the system owner to ensure a valid policy exception is filed.

YALE-MSS-1.2: Apply any additional security requirements required by external obligations

The ITS Windows team supports managed servers that are required to comply with external requirements. External obligations (such as FERPA, HIPAA, and the like) inform decisions at build time, such as network placement, access limitations, system architecture, etc, and during run time, such as response SLAs, patching cadences, etc.

It is the system owner's responsibility to understand their external obligations and make the ITS Windows team aware of the constraints the system must run under.

MSS Details	ITS Windows Implementation
1.2.1 Ensure you can meet any obligations in the event of a security incident or data breach	The system owner is responsible for identifying external obligations. Windows Services will implement appropriate controls based on those obligations where applicable.

YALE-MSS-1.3: Ensure appropriate contracts for all third-party relationships are in place

The ITS Windows team is not responsible for entering into contract negotiations with vendors, nor for maintaining those contracts. It is the responsibility of the system owner to ensure appropriate contracts are in place for their system and application software.

MSS Details	ITS Windows Implementation
1.3.1 Ensure the Data Addendum process is followed when storing data in a vendor's cloud	The system owner is responsible for ensuring cloud vendors sign appropriate contracts. The ITS Cloud team is responsible for broad data agreements with Amazon, Azure, and other cloud vendors with whom we contract.
1.3.2 A Business Associate Agreement (BAA) is in place	The system owner is responsible for all BAAs with vendors.

YALE-MSS-1.4: Designate and protect Critical IT Infrastructure

Most or all Critical IT Infrastructure is managed by the ITS Windows team or their peers (The Network team, the Linux team, the Data Center Operations team, etc.) For those components managed by the Windows team, we attest that those systems adhere to the MSS.

MSS Details	ITS Windows Implementation
1.4.1 Maintain a tailored security plan that matches the security best practices for that specific system/technology	The ITS Windows team applies best security practices on all managed servers. This includes but is not limited to: limiting access only running necessary services properly configuring running services Monthly patching Securing servers with Group Policy
1.4.2 Ensure the tailored security plan is periodically reviewed and advanced, at least on an every other year basis	The ITS Windows team usies the Microsoft RAP (Risk Assessment Program).
1.4.3 Physically secure the Critical IT System in accordance with the Minimum Physical Security Standards for Critical IT Spaces	All systems managed by the ITS Windows team are located in one of the following: a physically secured Yale data center a locked rack in a colocated facility (CyrusOne; Equinix) a cloud vendor's secure site (AWS; Azure)

YALE-MSS-1.5: Plan for data recovery requirements

Recovery of data is ensured by the ITS Windows team for all managed servers. By default, our systems are recoverable as full system images; file level backups can be implemented if required by the system owner at (potentially) additional cost. The default backup schedule (which determines how much data could be lost) should be understood by the system owner.

MSS Details	ITS Windows Implementation
1.5.1 Determine the maximum amount of data that can be lost during a disruption before incurring significant impact to operations	The system owner is responsible for understanding the maximum acceptable data loss on the platform - often described as the Recovery Point Objective (RPO.) The RPO for the VMware environment is guaranteed by the ITS Storage Team. VM image snapshots are taken nightly, and volumes are replicated off-site. The RPO of Cloud platforms (AWS; Azure) is guaranteed by the ITS Cloud Team.

YALE-MSS-1.6: Plan for meeting and maintaining the security requirements for the IT System

The ITS Windows team, for all managed servers, understand our responsibility to the security of the systems we manage. We work closely with system owners to ensure appropriate, timely response and attention for all managed servers. Despite that, the system owner cannot cede all security responsibilities to the Windows team. As noted below, there are a number of security requirements that are the sole responsibility of the system owner.

YALE-MSS-1.7: Complete a Security Planning Assessment (SPA)

The system owner is responsible for completing the SPA. The ITS Windows team will answer questions pertaining to the SPA, and this document lists what the ITS Windows team guarantees as part of our managed server offering.

YALE-MSS-2

YALE-MSS-2: System Inventory

Automation controls the configuration management of all Windows systems. Additional measures can be performed if necessary, as per requirements provided by Information Security Team.

YALE-MSS-2.1: Establish the scope of the IT System

MSS Guidelines	ITS Windows Planning
2.1.1: Identify and maintain a current inventory of all components and dependencies	In the process of implementing the CMDB for inventory of components.
2.1.2: Document and maintain your inventory and dependencies	The Windows Team is responsible for the security of the OS. VMware for the Infrastructure, application owner for the security of the application.

YALE-MSS-2.2: Use a private IP address if direct internet access is not required

All servers are placed on appropriate networks in coordination with the system owner. The ITS Windows team maintains that it is best practice to keep servers on private IP networks, and we encourage the use of those networks. All servers are assigned private IPs. VIPs and public IPs are assigned as needed for public access. If the system owner determines that their server(s) cannot live on private networks, we require them to seek an exception from Information Security.

YALE-MSS-3

YALE-MSS-3: Disaster Recovery (DR)

YALE-MSS-3.1: Create a Disaster Recovery Plan

ITS Windows has a documentation for VMware Disaster Recovery Test Plan.

Please follow the below link to visit the plan of recovery.

/wiki/spaces/SLO/pages/993592360

MSS Guidelines	ITS Windows Implementation
3.1.1: Identify roles and responsibilities for your DR Plan	The system owner is responsible for identifying roles and responsibilities for DR.
3.1.2: Identify components, dependencies, and their relationships using architectural diagrams	The ITS Windows team, in collaboration with other IT teams and the system owner, will help identify all of the components of the system, and help draft/audit architectural diagrams. The ITS Windows team works with application owners to provide architectural diagrams for all new servers.
3.1.3: Identify procedures for recovering each component of the IT System	The ITS Windows team is responsible for the general procedures for any Windows Managed Server recovery. With Full Stack support, the ITS Windows team works with the service owners and other IT teams to create the specific procedures required to restore the application to service.
3.1.4: Ensure the up-to-date DR Plan is available to any staff that could be required to execute it in the event of a disaster.
3.1.5: Keep the DR plan up to date

YALE-MSS-3.2: Test the Disaster Recovery Plan

Central IT is creating a formalized DR plan.

MSS Guidelines	ITS Windows Implementation
3.2.1: Test the Disaster Recovery (DR) plan once a year	Central IT is creating a formalized DR plan.
3.2.2: Validate that the contact information is accurate	Contact information for the ITS Windows team is updated and distributed as required. Contact information for the system is the responsibility of the system owner. This should be part of a yearly audit managed outside of the ITS Windows Team
3.2.3: Validate that all steps are identified and in the right order for the restoration of a component or as a result of a facility loss	This is a shared responsibility between the ITS Windows team and the system owner.
3.2.4: Validate that any component or technology, including versions are identified that are required for this IT System to be healthy.	All components and technologies are monitored in Dynatrace. Once a system is recovered, components will be validated with Dynatrace monitors.
3.2.5: Validate that recovery steps and order are correct for any component loss or facility loss	This is a shared responsibility between the ITS Windows team and the system owner.
3.2.6: Validate that any member of the team can access the DR Plan and the supporting documentation required	Central IT is creating a formalized DR plan.
3.2.7: Validate that any member of the team can execute this DR Plan in its entirety without the assistance of the subject matter expert	Central IT is creating a formalized DR plan.
3.2.8: Validate that the IT System can be restored to health within the availability requirements you established	The requirements come from the system owner. The ITS teams responsible for implementation will advise on how to achieve those goals. Without proper implementation we cannot assure RTO and RPO.
3.2.9: Identify and record any gaps found during the testing of this DR Plan	The ITS Windows team will document gaps in our procedures.

YALE-MSS-4

YALE-MSS-4: Physical Security

YALE-MSS-4.1: Physically secure Critical IT Spaces

N/A

MSS Guidelines	ITS Windows Implementation
4.1.1: Implement the Minimum Physical Security Standards for Critical IT Spaces	All Managed Windows systems are sited in either a Yale controlled data center, or a cloud provider's data center. Those data centers are controlled for physical access. For more information, contact either Data Center Support or the ITS Cloud team.

YALE-MSS-4.2: Physically secure the IT System

The systems live in the Datacenter or in the cloud. Server that are hosted in VMWare are in the Datacenter. Physical servers are in the datacenter

MSS Guidelines	ITS Windows Implementation
4.2.1: Limit user access to the secure area to only those who need it	All Managed Windows systems are sited in either a Yale controlled data center, or a cloud provider's data center. Those data centers are controlled for physical access.
4.2.2: Review and re-certify user access to the secure area annually	Auditing physical access to the data centers is the responsibility of Data Center Support. Cloud data centers are outside of scope.
4.2.3: Access to the secure space produces a physical or electronic audit log	Data Center Support is responsible for maintaining logs - physical or electronic - of Yale controlled data center access.
4.2.4: A locking cable or equivalent physical protection for all devices when not in the user's physical custody	This is not applicable for physical rack mounted servers.
4.2.5: Install privacy screen filters on computer screens that display ePHI	N/A

YALE-MSS-4.3: Ensure print jobs are physically secure

The Windows Managed Servers offering does not include printer management. Any servers configured to use PaperCut makes use of private printing, but not all systems that require printing take advantage of this.

YALE-MSS-5

YALE-MSS-5: Software Security

YALE-MSS-5.1: Utilize an industry-standard secure configuration method

CIS Benchmark is used for all server configured since July 2018. Older systems are being brought into this configuration as Operating Systems are being upgraded\migrated.

MSS Guidelines	ITS Windows Implementation
5.1.1: Document your approach to the chosen configuration standard	CIS Benchmark is achieved by applying the recommended settings in Group Policy.
5.1.2: Utilize file integrity and configuration checking tools	90 Min Group Policy Refresh. CrowdStrike.

YALE-MSS-5.2: Utilize endpoint protection

MSS Guidelines	ITS Windows Implementation
5.2.1: Utilize a Next Generation Anti-Virus solution	Yale currently employs the Crowdstrike Falcon Complete. Crowdstrike Falcon is an Endpoint Detection Response (EDR) tool that provides the capabilities of a Next-Generation Antivirus (AV) solution.
5.2.2: Run Endpoint Detection Response (EDR) tool	Yale currently employs the Crowdstrike Falcon Complete. Crowdstrike Falcon is an Endpoint Detection Response (EDR) tool that provides the capabilities of a Next-Generation Antivirus (AV) solution.

YALE-MSS-5.3: Run supported software and operating systems

ITS Windows team runs supported software and operating systems. It is the responsibility of application owners to keep their software on current versions.

YALE-MSS-5.4: Ensure all software is actively supported by a vendor or open-source project

All Operating systems and software owned by Windows Services are kept on currently supported versions. Application owners are responsible for their applications.

YALE-MSS-5.5: Manage all changes to the system through a change control process

ITIL and Service Now change control is used by all of ITS. Windows services for their changes and application owners for theirs.

MSS Guidelines	ITS Windows Implementation
5.5.1: All changes to the IT system are analyzed to ensure the security posture is not weakened	All changes to the IT system are vetted by (various ITS groups) to ensure the security posture is not weakened.
5.5.2: An audit trail for changes to the IT system is maintained to account for when changes were made and by whom	All changes to the IT system are made via the Change Request Process in ServiceNow and auditable by system logs.

YALE-MSS-6

YALE-MSS-6: Patching

YALE-MSS-6.1: Apply security patches regularly

The ITS Windows team patches servers within 30 days of release by Microsoft.

MSS Guidelines	ITS Windows Implementation
6.1.1: Apply all security patches to operating systems, software, and firmware based on risk	All systems patched within 30-days of Microsoft patch releases. Express patching is already covered by our condensed patching schedule which is 2 weeks.
6.1.2: Identify maintenance windows for necessary upgrades/patches	Maintenance windows are weekly and are 3 hours.
6.1.3: Implement an emergency patch process	Emergency patches are installed as soon as possible in coordination with ISO and the customer.

YALE-MSS-7

YALE-MSS-7: Data Protection

YALE-MSS-7.1: Back up user-level and system-level data

MSS Guidelines

ITS Windows Implementation

7.1.1: Run a scheduled automated network backup based on data and system recovery requirements

A managed Windows system is backed up nightly. For virtual machines, this done via VMware NetApp plugin. For physical servers, this is achieved with the Veritas NetBackup Client.

7.1.2: Document and test the restore process annually

Restore a VM from a NetApp backup and verify the data.

A ServiceNow ticket is created quarterly with instructions.
Need a cadence for back and restore testing.

7.1.3: Ensure backups are encrypted in transit and at rest

Storage traffic encryption occurs only if data leaves the datacenter or our network. That is only done once a day when all volumes are vaulted off to S3/IA. Data is encrypted then before leaving the AltaVault replication appliance.

YALE-MSS-7.2: Encrypt all electronic storage devices

MSS Guidelines	ITS Windows Implementation
7.2.1: Utilize full disk encryption	VMware disk is encrypted. Physical server disk encryption is utilized where necessary.
7.2.2: Encrypt portable storage devices	This is not applicable.
7.2.3: Be able to provide evidence that an electronic storage device is encrypted	The FTS-Storage team will be able to provide information on the encryption of VMware disk. Evidence of storage device encryption may be provided for a Managed Windows physical server where applicable.

YALE-MSS-7.3: Encrypt data in transit and at rest

TLS is used for data in transit. Disks are encrypted for data at rest.

YALE-MSS-7.4: Recycle IT Systems using Yale's Environmental Health and Safety (EHS) Process

MSS Guidelines	ITS Windows Implementation
7.4.1: Securely dispose of devices using the Yale Environmental Health and safety process	Disposal of devices managed by the Managed Servers - Windows team is handled by the Data Center Facilities group upon request.

YALE-MSS-7.5: Sanitize systems before re-use

MSS Guidelines	ITS Windows Implementation
7.5.1: Fully sanitize devices, by device type	Any physical managed Windows system is fully wiped before reuse using the DOD disk wiping software where applicable. Windows team does not recommend reusing physical systems for high risk data involvement.
7.5.2: Follow the University Chain of Custody process for devices being re-used or disposed of	If any physical system is to be repurposed for use of HIPAA data, the University Chain of Custody process for devices will be followed.

YALE-MSS-7.6: All network traffic must use a strong, industry-standard encryption method

Where possible, ITS Windows:

uses https for web traffic
uses client side VPNs
encrypts data before transmission

YALE-MSS-7.7: Purge data once it is no longer required

Windows has 30 day retention policy when decommission a system. After 30 days, the system data and any application is erased.

Exports of application data are honored by request.