Last Revision Date: March 16, 2012
Approval Date: November 3, 2007
Approval Authority: Case Chief Information Security Officer
The Case Quarantine Process is defined to inform and instruct network and help desk users in the use of the Quarantine Network in network-based security problem mitigation.
This policy applies to all information technology systems that use the Case network infrastructure.
All hosts (personal computers, servers, printers, etc.) on Case networks are required to be registered in accordance with the II-3 Network Management Policy. When Case ITS staff detect anomalous network activity related to specific hosts on the network, the host in question can be placed in Quarantine Network which provides reduced network communication to the host. This network prevents spread of attacks and malware while permitting end users to communicate with network-based anti-virus and software update services.
The operational model is to place hosts in the quarantine network, notify the end users or their responsible administrators, investigate the root cause, resolve the root cause and potential user practices, and return the host to full network services.
Case End Users: When a registered host is quarantined, contact the Case Help Desk. The Help Desk staff will assist the user in steps to self-assess and correct the security issues.
Case ITS Staff: Monitor the network for potentially malicious activity. Use established procedures and protocols to move hosts into quarantine pro-actively to prevent propagation of infections. Case ITS staff also will perform host registration disable and re-enable tasks. Maintain documented procedures with the Case Help Desk.
Case Help Desk: Contact End Users (as listed in the host registration information) when notified of a quarantine. Notify Case ITS Staff of a host that has been quarantined for more than 30 days without response from the End User.
host: Any network capable device utilizing network services. A host can be a personal computer, a networkable appliance, server resources, printers, scanners, copiers.
network faceplate: The primary network interface for Case users. Many network faceplates have fiber-optic cable connections, and network users will be using a network switch with a fiber-media converter, permitting the host to connect using a standard RJ-45 type CAT-5a or CAT-6 network cable.
This procedure will be reviewed every three years on the anniversary of the policy effective date, at a minimum. The standard may be reviewed on a more frequent basis depending on changes of risk exposure.