Information assurance program manual table of contents

7.

800. 
     Policy. In order to protect DoD computer systems, a virus management program is required. Antivirus software and HBSS will be installed on all IS. N6 Department personnel will oversee and maintain working anti-virus software with the capability of pushing latest virus definitions to domain workstations. In addition TTGL also uses HBSS which is configured to perform regularly scheduled scans of the LAN. External devices (e.g., floppy drives, authorized USB devices, CDs, etc…) will be scanned when they are accessed or introduced to the computer system.
     

8.

900. 
     Purpose. To establish policy for TTGL to set Information Operations Condition (INFOCON) procedures. This instruction recommends actions to uniformly heighten or reduce the information posture to thwart off computer network attacks and mitigate any possible damage to TTGL information infrastructure.
     
901. 
     Background. The INFOCON strategy has shifted from a threat-based, reactive system to a readiness-based, proactive approach. This represents a significant change in how commanders at all levels ensure the security and operation readiness of their information networks. The Commander, Joint Task Force for CJTF-GNO will recommend changes in DoD INFOCON levels to Commander, US Strategic Command. If a change in INFOCON level is decided, it will be disseminated to naval activities by NCDOC.
     
902. 
     Scope. The INFOCON presents a coordinated and structured approach to defend against attacks on Department of Defense (DOD) networks. While all communications systems are vulnerable to some degree factors such as low cost readily available technology and increased reliance on systems, connectivity, and interoperability make Computer Network Attack (CNA) an attractive option for adversaries. CNA is defined as operations to disrupt, deny, degrade, or destroy information resident in computers and computer networks.
     
     1. 
        INFOCON levels as described in reference (c).
        
        1. 
           INFOCON 5 – Characterized as routine Network Operations (NETOPS), normal readiness of IS and networks.
           
        2. 
           INFOCON 4 – Increases NETOPS readiness in preparation for operations or exercises with limited impact to the end user.
           
        3. 
           INFOCON 3 - Describes when a risk has been identified. Security review on important systems is a priority, and the Computer Network Defense (CND) system's alertness is increased. All unclassified dial-up connections are disconnected.
           
        4. 
           INFOCON 2 - Describes when an attack has taken place but the CND system is not at its highest alertness. Non-essential networks may be taken offline, and alternate methods of communication may be implemented
           
        5. 
           INFOCON 1 - Describes when attacks are taking place and the CND system is at maximum alertness. Any compromised systems are isolated from the rest of the network.
           
903. 
     Action. TTGL shall maintain the latest INFOCON message and take all actions as required. IAM shall include INFOCON Compliance status and report any changes to INFOCON to the CO immediately.
     

9.

1000. 
      Server Maintenance and Backup. N6 will direct server backups according to TTGL schedule and as operational requirements permit.
      
      1. 
         Backups shall commence daily, at the end of normal working hours, with a target completion time of 0600. The following apply to performing system backups:
         
         1. 
            Incremental back-ups will be conducted Monday-Thursday.
            
         2. 
            Full back-ups will be conducted on Friday.
            
         3. 
            A set of full backups will be housed at Distributed Training Center Atlantic (DTCL).
            
         4. 
            The set of full back-ups that are conducted on the last Friday of each month will be swapped out with the off-site set at DTCL.
            
         5. 
            In any case where a system locks up, services fail to respond or system failure is evident, SYSADMIN will conduct a reboot to restore services and notify the IAM/IAO.
            
         6. 
            If the system permits, an all hands service advisory will be released.
            
         7. 
            All backups shall be conducted IAW applicable SOP.
            

1101. Policy.

TTGL shall conduct monthly scans for all IS on a monthly basis IAW CTO 09-08 and 11-16a. All security patches shall be loaded and applied using one of two methods:

Pushed to the server or workstation using GPO in conjunction with Windows Server Update Services (WSUS).

Manually as required.

Due to the critical nature of these patches to network security, patches need to be loaded and applied as often as possible, but no less than monthly.

c. No work related data is authorized to pass between command ISs and personal laptops.

Date Completed: ___________ N6/IAM Review: __________________

CNO WASHINGTON DC//N6/N64//

COMSURFFLTTRANLANT NORFOLK VA
(APPROPRIATE CLASSIFICATION) //N02201//
MSGID/GENADMIN/TTGL DAM NECK VA//
SUBJ/POSSIBLE COMPUTER INTRUSION INCIDENT//
REF/A/DOC/OPNAVINST 2201.2//
AMPN/REF A IS NAVY AND MARINE CORPS COMPUTER NETWORK INCIDENT/RESPONSE INSTRUCTION.
RMKS/
1. Incident date:

2. Physical location of the system attacked:

3. How was the attack identified:

4. How was access obtained:

5. Vulnerability exploited:

6. Actions attempted during session:

7. Highest classification of information involved:

8. Evaluation of attack success:

9. Damage or effects resulting from attack:

10. Hardware configuration:

11. Operating system:

12. Security software installed:

13. Origination point of incident:

14. Indication of additional activity:

15. IP address:

16. Names used:

17. Mission of system attacked (e.g., administration, command

and control, message handling):

18. Point of contact (e.g., name, phone number, addresses):

19. Additional information:

Reference A: COMPUTER TASKING ORDER 2008-08

The following actions should be taken if there is an incident regarding Electronic Media. Electronic media are media that use electronics or electromechanical energy for the end-user to access the content. This is in contrast to static media (mainly print media), which today are most often created electronically, but don't require electronics to be accessed by the end-user in the printed form. The primary electronic media sources familiar to the general public are better known as video recordings, audio recordings, multimedia presentations, slide presentations, CD-ROM and online content. Most new media are in the form of digital media. However, electronic media may be in either analog or digital format. This Exhibit however will focus primarily on removable media such as USB devices, removable hard drives, and CD’s.

1. 
   Incident on any TTGL computer system or network regarding Electronic Media:
   
   1. 
      Inform the IAM or IAO.
      
   2. 
      Contact Computer Network Defense Service Provider/Navy Cyber Defense Operations Command (CNDSP/NCDOC) Naval computer incident response team. The CNDSP/ NCDOC personnel can provide technical assistance and reporting guidance in response to computer security incidents. They do not have legal expertise and cannot offer legal advice or opinions. NCIS agents are available at the CNDSP, if necessary.
      
   3. 
      System Administrator, conduct full virus scan on Network.
      
      1. 
         Determine if the Network has been infected with a virus, or if a spillage has occurred. If either one has occurred inform NCDOC and they will begin Incident Handling procedures right away.
         
   4. 
      Notify other interested elements within your command. In addition to notifying the CO and legal counsel, you may also need to notify others who may be directly affected.
      
   5. 
      Document all of the steps you take in systems or data recovery. The importance of documenting every step taken in recovery cannot be overstated.
      
2. 
   Regain control – Same as above
   

1. 
   Incident Reporting. The preferred method is via the NCDOC webpage.
   

Mailing address:

Commanding Officer

Network Computer Defense Operations Center

2555 Amphibious Drive

Norfolk, VA 23521-3225

Class fax: (757) 417-4064

STU/STE (312) 537-7592/ (757) 417-7952
NIPRNET: https://www.ncdoc.navy.mil

E-mail: ncdoc@ncdoc.navy.mil

E-mail: cndwo@ncdoc.navy.smil.mil

Staff must comply with and agree to the following conditions prior to being approved for the use of TTGL laptops, electronic devices and accessories:

• 
  Prior to being issued one of the TTGL laptop computers, electronic devices or accessories staff sign the Staff Laptop Computer and Electronic Devices Acceptance Use Form (Below) and agrees to all outlined procedures.
  

• 
  Staff must NOT attempt to or install software, hardware or change the system configuration including network settings on any equipment assigned to the staff member without prior consultation with N6 computer specialist or the IAM/IAO.
  

• 
  Staff is expected to prevent damage and theft to all TTGL electronic equipment assigned to them.
  

• 
  Staff must provide access to any electronic, equipment and/or accessories they have been assigned upon N6’s request.