User Domain:
 Define AUPs for each of IT service or equipment.
• Acceptable Use Policy (AUP) to help you use the products, services and equipment provided by us (Services), and ensure that you understand policies and procedures we have developed to comply with certain laws and regulations. All users of the Service must comply with this AUP. This AUP is made part of our Terms of Service (TOS). Your use and/or continuation of the Service constitutes your acceptance of this AUP. It is your responsibility, and contractual obligation, to ensure that your affiliates, agents, and/or customers (End User(s)) comply with this AUP.
 Establish unique logon credentials for each user and require strong passwords.
• Assign unique login credentials from the very beginning and have generally been very secure because of this. With the increasing demands of system security to ensure, logins have been made even more secure. This additional security is made possible through the use of Strong Passwords. A strong password is a series of words, letters, symbols and numbers which may be easy for a user to remember but difficult for another person to guess. We will review here the way in which you can implement additional login security through the use of strong passwords, and other advanced security settings.
 Grant only the minimum privileges to each user required to accomplish that user’s tasks.
• Identifying and influencing user behaviors that affect security are important to ensuring compliance within the User Domain. Behaviors that support or violate compliance with your security goals get the most attention. The following best practices do not guarantee compliance with all goals. However, they will lay the foundation to develop and maintain a secure environment.
Workstation Domain:
 Require unique user accounts for each person.
• Only a user with administrator privileges can add a user. When you add a new user to a server, you can specify a role for the user, which defines how the user will access data on the server and consumer roles for user accounts.
 Do not allow multiple people to use the same user account.
• A user's account allows a user to authenticate to system services and be granted authorization to access them; however, authentication does not imply authorization. To log in to an account, a user is typically required to authenticate oneself with a password or other credentials for the purposes of accounting, security, logging, and resource management.
 Require strong password and train users on the importance of keeping passwords private. Require users to change passwords at a specified interval, such as every six months.
• You should change your password periodically, ideally at least every six months. There are several reasons for this. First, passwords are often stolen without the knowledge of the victim, and stolen passwords often aren't used immediately. They're collected, sold to organized crime, rebundled and resold, and left unused for some time. Even if you're not aware your password was stolen, if you change it periodically you may change it before a thief has an opportunity to use it. Second, while we are constantly working to strengthen the underlying security of computers are also always getting faster. It's possible to guess your password through sheer persistent computer effort. With current technology, this takes months if you have a strong password. If you change your password every six months, any brute force attack that takes longer is ineffective.
 Use content filtering and antivirus scanning at internet entry and exit.
• Enable workstation auto-scans and auto-quarantine for unknown file types.
LAN Domain:
 Make sure wiring closets, data centers, and computer rooms are secure.
• Provide no access without proper credentials.
 Do not allow anyone access without proper id.
 Use WLAN network keys that require a password for wireless access.
 Define server/desktop/laptop vulnerability window policies, standards, procedures, and guidelines.
Lan-to-WAN Domain:
 Apply domain-name content filtering at the internet entry/access point.
 Apply file transfer monitoring, scanning and alarming for unknown file types from unknown sources.
 Apply and enforce the organization’s data classification standard.
WAN Domain:
 Scan all e-mail attachments for type, antivirus, and malicious software at the LAN-to-WAN Domain.
 Outsource security operations and monitoring.
 Encrypt IP data transmission with VPNs.
 Back up and store data in off-site vaults (online or physical data backup) with tested recovery procedures.
Remote Access Domain:
 Set automatic blocking for attempted logon retries, block user access after three logon attempts have failed.
 Encrypt the data on the hard drive if the user has access to private or confidential data.
 Apply real-time lockout procedures if a token is lost or device is compromised.

System/Application Domain
 Create a system that brings together servers, storage, and networking.
 Convert all data into digital data for long-term storage, Retain backups from off-site data vault on defined RTOs.
 Develop a disaster recovery plan specific to the recovery of mission-critical applications and data to maintain operations.