Lab Security Policy
1.0 Purpose
Laboratory environments (labs) often require configurations and network access distinct from the standard corporate production environment, potentially introducing unique security risks. This policy establishes the information security requirements necessary to help manage and safeguard lab resourcesresources, and <Company Name> networks by minimizingminimize the exposure of critical infrastructure and information assetsassets, and protect the organization's networks from threats originating from or traversing lab environments. Its purpose is to threatsensure thatlabs mayare resultoperated fromsecurely, unprotectedbalancing hostsoperational andneeds unauthorizedwith access.essential security controls.
2.0 Scope
This policy applies to all employees, contractors, consultants, temporary staff, and other workers atinvolved <Companyin Name>the andmanagement, itsoperation, subsidiariesor mustuse adhereof toorganizational thislabs. policy.It Thiscovers policyall applies to <Company Name> organization-owned and managed labs, including labsthose outsidelocated theinternally, corporateexternally, firewallor within a Demilitarized Zone (DMZ).
General Requirements
Lab owning organizations are responsible for assigning lab managers, a point of contact (POC), and applies to all associated systems, networks, equipment, hardware, software, and firmware within these lab environments.
3.0 Policy Statements
3.1 General Lab Management & Responsibility
* **Ownership and Points of Contact (POC):** Each lab must have a back-updesignated POCowning fororganization/department, eacha lab.primary Lab Manager, and at least one designated backup POC. Lab owners must register and maintain up-to-date POC information with the designated IT authority (e.g., Precision ComputerComputer) and therelevant Corporatenetwork/asset Enterprisemanagement Managementteams. Team.POCs Lab managers(manager or their backupbackup) must be available around-the-clockreachable for emergencies,emergencies; otherwiseotherwise, necessary security actions willmay be taken without their direct involvement.
*
**Lab managersManager Accountability:** Lab Managers are responsibleaccountable for the overall security posture of their labslab, and the lab's impact on the corporate production network and any other networks. Lab managers are responsible for adherence to this policy and associated processes. Where policies and procedures are undefined lab managers must do their best to safeguard <Company Name> from security vulnerabilities.
Lab managers are responsible for the lab'sits compliance with all <Companyrelevant Name>organizational security policies.policies
Thethis Labone), Managerand isits responsiblepotential forimpact controllingon labother access.networks Access(corporate or external). They must implement procedures to anyensure givenpolicy labadherence willand onlysafeguard beagainst grantedvulnerabilities.
* by**Policy theCompliance:** labAll manager or designee, to those individuals with an immediate business needactivities within the lab, either short-term or as defined by their ongoing job function. This includes continually monitoring the access list to ensure that those who no longer require access to the lab have their access terminated.
All user passwords must comply with <Companyapplicable Name>'sorganizational Passwordpolicies, Policy.including
Individualnot userlimited accountsto onAcceptable anyUse, Data Classification, Password, and Audit Logging policies.
* **Immediate Access for Security/Support:** Lab Managers must grant immediate access to lab deviceequipment mustand besystem deletedlogs whenupon norequest longerto authorized within three (3) days. Group account passwords on lab computers (Unix, windows, etc) must be changed quarterly (once every 3 months).
PC-based lab computers must have <Company Name>'s standard, supported anti-virus software installed and scheduled to run at regular intervals. In addition, the anti-virus software and the virus pattern files must be kept up-to-date. Virus-infected computers must be removedpersonnel from the networkdesignated untilIT theyauthority are(e.g., verifiedPrecision asComputer) virus-free.or LabNetwork Admins/Support Organization for security investigations or operational support.
3.2 Access Control
* **Physical Access:** Lab Managers are responsible for creating procedures that ensure anti-virus software is run at regular intervals,controlling and computersmanaging arephysical verifiedaccess asto virus-free.
Anylabs. activitiesAccess shall only be granted to individuals with a documented, immediate business need. Access lists must be reviewed regularly, and access promptly terminated when no longer required.
* **Logical Access:**
* Individual user accounts on lab devices must comply with the intentionorganization's Password Policy.
* Individual user accounts must be disabled or deleted within three (3) days of authorization removal.
* Passwords for shared or group accounts on lab systems must be changed at least quarterly and meet complexity requirements defined in the Password Policy.
3.3 Host and System Security
* **Anti-Virus/Malware:** All PC-based lab computers capable of running such software must have organization-standard, supported anti-virus/anti-malware protection installed, configured for regular scans, and kept up-to-date (software and definitions). Infected systems must be immediately isolated from all networks until verified clean. Lab Managers must implement procedures to createensure and/this.
* **Malicious Activity:** Intentionally creating or distributedistributing malicious programs into <Company Name>'s networks (e.g., viruses, worms, Trojanmalware) horses,is e-mail bombs, etc.) arestrictly prohibited, in accordance withper the Acceptable Use Policy.
* **Patching:** Systems within labs should be patched according to organizational vulnerability management standards, especially if connected to other networks. Systems that cannot be patched require compensating controls and potential isolation.
No3.4 labData shallSecurity provideand productionService services.Restrictions
* **Prohibition of Production servicesServices:** areLabs definedmust asnot ongoinghost andongoing, sharedshared, business business-critical services that generate revenue streams or provide primary customer capabilities.capabilities These("production shouldservices"). Such services must be managed by aappropriate <properproduction support> organization.
*
In**Data accordanceClassification withRestrictions:** Information classified as Highly Confidential or Restricted (or equivalent high-sensitivity classifications per the Data Classification Policy, information thatPolicy) is marked as <Company Name> Highly Confidential or <Company Name> Restricted isgenerally prohibited on lab equipment.
Immediateunless accessthe tolab equipmenthas specific approvals and systemsecurity logscontrols commensurate with that data sensitivity level.
* **Audit Logging:** Lab systems must be granted to members of Precision Computer and the Network Support Organization upon request, in accordancecomply with the Audit Policy.Logging Policy where applicable, especially for systems connected to corporate networks or handling sensitive test data.
Precision3.5 Computer will address non-compliance waiver requests on a case-by-case basis and approve waivers if justified.
Internal Lab Network Security Requirements(Labs connected behind corporate firewall)
The* Network**Firewall SupportSegregation:** OrganizationAll internal labs must maintainbe asegregated firewall device betweenfrom the corporate production network via a firewall managed by the designated Network Support Organization or IT authority.
* **Network Monitoring and allIntervention:** lab equipment.
The Network Support Organization and/or designated IT authority (e.g., Precision ComputerComputer) reserve the right to monitor traffic and interrupt lab connections that negatively impact the corporate production network negatively or pose a security risk.
*
The**IP NetworkAddress SupportManagement:** Organization must record allAll lab IP addresses, which areaddresses routed within <Companyorganizational Name>networks networks,must be registered in Enterprisethe Addresscentral ManagementIP databaseaddress alongmanagement system with current contact information for that lab.
Any lab thatPOC wantsinformation.
* to**External addConnections:** anAdding direct external connectionnetwork mustconnections provide(e.g., aInternet, diagrampartner andnetworks) documentationrequires to Precision Computer withdocumented business justification, thenetwork equipment,diagrams, and formal review and approval by the IPdesignated addressIT spaceauthority information.(e.g., Precision ComputerComputer) will*before* reviewimplementation.
* for**Prohibition securityof concernsCross-Connections:** andDevices must(wired approveor beforewireless) such connections are implemented.
All traffic between the corporate production andwithin the lab network must go through a Network Support Organization maintained firewall. Lab network devices (including wireless) must not cross-connectcreate unauthorized connections that bypass the designated firewall between the lab and production networks.
*
Original**Firewall Configuration Control:** Initial firewall configurations and anysubsequent changes theretorequire review and approval by the designated IT authority (e.g., Precision Computer).
* **Prohibition of Disruptive Activities:** Labs must benot reviewed and approved by Precision Computer. Precision Computer may require security improvements as needed.
Labs are prohibited from engagingengage in activities like unauthorized port scanning, network auto-discovery, or traffic spamming/flooding, and other similar activitiesflooding/spamming that could negatively impact the corporate network and/or non-<Company Name>external networks. TheseSuch activitiestesting must be restrictedcontained strictly within the lab.
lab environment.
* **Inter-Lab Traffic:** Traffic between productionlab networks and lab networks, as well as trafficor between separatelabs laband networks,production ismay be permitted based on approved business needsneeds, provided it is properly secured (e.g., via firewall rules) and as long as the traffic does not introduce unacceptable risk or negatively impact onnetwork other networks.performance. Labs must not advertise network services that maycould compromiseconflict with production networkservices.
* services**Auditing orRights:** putThe labdesignated confidentialIT informationauthority at(e.g., risk.
Precision ComputerComputer) reserves the right to audit alllab lab-relatednetwork datatraffic, configurations, and administration processesprocesses.
* at**Gateway anyDevice time,Security:** including but not limited to, inbound and outbound packets, firewalls and network peripherals.
Lab Lab-owned gateway devices are(routers, requiredfirewalls) tomust comply with all <Company Name> productrelevant security advisoriesadvisories/patching requirements and mustshould authenticate administrative access against thecentral Corporateauthentication Authenticationservers servers.
Thefeasible. enableEnable/privileged passwordaccess for all lab owned gateway devicespasswords must be differentunique, fromcomply all other equipment passwords inwith the lab.Password ThePolicy, password mustand be inrestricted accordanceto authorized administrators.
3.6 Security for Labs with <CompanyNon-Organizational Name>'sPersonnel PasswordAccess Policy.(e.g., Training The password will only be provided to those who are authorized to administer the lab network.Labs)
In* labsLabs where non-<Company Name>organizational personnel have physical access (e.g.,must training*not* labs),have direct connectivity to the corporate production networknetwork.
* is not allowed. Additionally, no <Company Name>Organizational confidential information canmust not reside on anysystems computer equipment inwithin these labs.
* Connectivity for authorized personnel from*from* these labs can be allowed to*to* the corporate production network onlyfor ifauthorized personnel must use secure, authenticated againstmethods approved by the Corporatedesignated AuthenticationIT servers,authority (e.g., Precision Computer), such as client VPNs, SSH tunnels, or temporary authenticated access lists ('lock and key), SSH, client VPNs, or similar technology approved by Precision Computer.key').
Lab3.7 networks with external connections are prohibited from connecting to the corporate production network or other internal networks through a direct connection, wireless connection, or other computing equipment.
DMZ Lab Security Requirements
New* **Approval:** Establishing new DMZ labs requirerequires astrong business justification and executive (VP-level approvalor fromhigher) theapproval. businessSignificant unit. Changeschanges to theexisting DMZ lab connectivity or purpose ofrequire an existing DMZ lab must be reviewedreview and approvedapproval by the designated IT authority (e.g., Precision Computer Team.Team).
*
Security:** DMZ labs must bereside in awithin physically separatesecure, dedicated spaces (room, cage, or securedlocked lockable rackracks) with limitedstrictly access.controlled Inaccess addition,lists maintained by the Lab ManagerManager.
* must**Network maintainManagement:** a list of who has access to the equipment.
DMZ lab POCspersonnel mustare maintainresponsible for managing network devices deployed inwithin the DMZ lab up to the network support organizationdemarcation point defined by the Network Support Organization.
* **Prohibition of demarcation.
Connections:** DMZ labs mustare notstrictly connectprohibited from having any direct or logical connection (e.g., IPsec tunnel, wireless bridge, multi-homed host) to corporate internal networks,networks.
* either**Internet directly,Firewall:** logically (for example, IPSEC tunnel), through a wireless connection, or multi-homed machine.
An approved networkfirewall, supportmanaged organizationby the Network Support Organization or IT authority, must maintain a firewall deviceexist between the DMZ lab and the Internet. Firewall devicesConfigurations must be configured based on the principle of least privilege access principles and the DMZ lab business requirements. Original firewall configurations and subsequent changes must beprivilege, reviewed and approved by the IT authority (e.g., Precision Computer Team.Team), Alland all Internet traffic betweenmust traverse this firewall. Bypassing the firewall is prohibited.
* **Device Standardization:** Routers and switches within the DMZ lab and the Internet must go through the approved firewall. Cross-connections that bypass the firewall device are strictly prohibited.
All routers and switches (not used for testingtesting) and/or training mustshould conform to theapplicable DMZorganizational Routerstandards.
* and**Secure SwitchHost standardizationConfiguration:** documents.
Operating systems of all hosts internalproviding toservices within the DMZ lab running Internet Services must be configuredadhere to the secure host installation andbaseline configuration standards published by the designated IT authority (e.g., Precision Computer Team.
*
**Secure Administration:** Remote administration must beutilize performedsecure, over secureencrypted channels (fore.g., example,SSH, encryptedIPsec network connections using SSHVPN) or IPSEC)dedicated, orout-of-band console access independent from the DMZmanagement networks.
*
**No Open Proxies:** DMZ lab devices must not be anconfigured as open proxyproxies to the Internet.
*
Intervention:** The Network Support Organization andand/or designated IT authority (e.g., Precision ComputerComputer) reserve the right to interrupt DMZ lab connections if a security concernrisk exists.is identified.
4.0 Compliance
4.1 Compliance Measurement
The designated IT authority (e.g., Precision Computer teamteam) will verify compliance towith this policy through various methods, including butnetwork notscans, limitedvulnerability to,assessments, periodicconfiguration audits, physical inspections (walk-thrus,thrus), videoreview monitoring,of businessaccess tool reports, internallogs and procedures, internal/external audits, and feedbackinvestigation of security incidents.
4.2 Exceptions/Waivers
Requests for waivers or exceptions to the policy owner.
Any exception to thethis policy must be approvedformally documented with business justification, risk assessment, and proposed compensating controls. Exceptions require review and advance approval by the designated IT authority (e.g., Precision Computer TeamTeam) inon advance.a case-by-case basis.
An4.3 employeeEnforcement
Non-compliant labs may face network isolation or disconnection. Failure by Lab Managers or personnel to haveadhere violatedto this policy may beresult subject toin disciplinary action, up to and including termination of employment.employment or contract.
Audit5.0 PolicyDefinitions
* **DMZ (Demilitarized Zone):** A perimeter network segment logically placed between an internal network and an external network (like the Internet), designed to host external-facing services while protecting the internal network.
* **Firewall:** A network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules.
* **Lab Manager:** The individual assigned primary responsibility for the operation, management, and security of a specific laboratory environment.
* **POC (Point of Contact):** An individual designated as a contact person for a specific lab or function.
* **Production Services:** Ongoing, shared, business-critical IT services essential for core operations, revenue, or customer functions, typically managed under stricter change control and support agreements than lab environments.
* Acceptable Use Policy
*
Audit Logging Policy
* Data Classification Policy
*
Password Policy
* Physical Security Policy
* Remote Access Policy
* Change Management Policy
* Vulnerability Management Policy
* Wireless Security Policy
The following definition and terms can be found in the SANS Glossary located at:
https://www.sans.org/security-resources/glossary-of-terms/
DMZ
Firewall