Policy 12 - Server Security Policy

1.0 Purpose

The purpose of this policy is to establish standards for the base configuration of internal server equipment that is owned and/or operated by Murray State University. Effective implementation of this policy will minimize unauthorized access to Murray State University proprietary information and technology. Any questions or comments about this policy should be directed to Information Systems.

2.0 Scope

This policy applies to server equipment owned and/or operated by Murray State University and to servers registered under any internal network owned by Murray State University. It is specific for equipment on the internal Murray State University network and does not apply to servers set up in a classroom or lab environment for instructional purposes.

3.0 Policy

The following are general configuration guidelines that must be followed on all Murray State University servers. While these guidelines are non-operating system specific, all servers must also abide by the more detailed guidelines outlined in either the Windows Configuration Standards or the Linux Configuration Standards.

3.1 Ownership and Responsibilities

• Approved server configuration guides must be established and maintained based on university needs and approved by Murray State University Information Systems. Operational groups should monitor configuration compliance and implement an exception policy tailored to their environment. 
• If a server will be supported by Information Systems then a Server Hosting ticket should be filled out prior to installation.
• Prior to hosting a server or purchasing server hardware the responsible party should work with Procurement and Information Systems to make sure that all standards are met.
• Information Systems should be informed of any major changes to a server’s purpose, configuration, location, etc.

3.2 General Configuration Guidelines

• Operating System configuration should be in accordance with approved Murray State University Information Systems standards. 
• Services and applications that will not be used must be disabled where practical. 
• The most recent security patches must be installed on the system as soon as is practical, the only exception being when immediate application would interfere with normal operations. 
• Always use the standard security principle of least required access to perform a function. 
• Use a non-privileged account when possible. 
• Privileged access must be performed over secure channels, (e.g., encrypted network connections using SSH or IPSec). 
• Servers should be housed in a University Data Center, allowing for proper access controls, environmental and security monitoring, unless otherwise authorized by the CIO.
• Servers are specifically prohibited from operating from uncontrolled cubicle/office areas. 
• At the direction of Information Systems, appropriate endpoint protection must be installed and kept up to date.
• New servers should be configured to automatically restart and run updates on a schedule or if deemed necessary should be set to update manually on a similar schedule.
• Confirm with Information Security Personnel that the new server is appropriately supplying logs and can properly scan for vulnerabilities.

3.3 Monitoring

• All security-related events on critical or sensitive systems must be logged and audit trails saved as follows:
  • All security related logs will be kept online for a minimum of 2 weeks. 
• Security-related events will be reported to the appropriate system administrator, who will review logs and report incidents according to the Incident Response Policy. Corrective measures will be prescribed as needed. Security-related events include, but are not limited to:
  • Evidence of unauthorized access to privileged accounts
  • Anomalous occurrences that are not related to specific applications on the host.
  • Loss or breach of sensitive data.

3.4 Compliance

• Audits will be performed on a regular basis by Information Security Personnel within Murray State University. 
• Audits will be managed by the Murray State University Information Security Personnel, in accordance with the Audit Policy. Murray State University Information Security Personnel will filter findings not related to a specific operational group and then present the findings to the appropriate support staff for remediation or justification. 
• Vulnerabilities found on servers will be addressed by the appropriate operational group in a timely fashion. If a vulnerability cannot be patched, this will be communicated to the Information Security Personnel. 

4.0 Enforcement

Anyone found to have violated this policy may be subject to disciplinary action according to personnel policies and procedures. A violation of this policy by a temporary worker, contractor or vendor may result in action up to and including termination of their contract or assignment with Murray State University. Servers posing a long term or critical security risk may require a Risk Acceptance Form or emergency disconnection.

5.0 Definitions

Server

For purposes of this policy, a Server is defined as an internal Murray State University Server. Desktop machines and Lab equipment are not relevant to the scope of this policy.

SSH (Secure Shell)

SSH is a network protocol that allows data to be exchanged using a secure channel between two networked devices.

IPSec (Internet Protocol Security)

IPSec is a suite of protocols for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a data stream.

Murray State University Network

Being connected to a Murray State University network includes the following:

• If you have a network capable device (ex. laptop) plugged into a Murray State University owned building, then you are connected to the MSU LAN (local area network).
• If you have a wireless capable device (ex. laptop, iPhone) and connect to one of the approved SSIDs, then you are connected to the MSU WLAN (wireless local area network).
• If you connect from a computer through the Murray State University VPN (virtual private network) or approved remote access software, you are then connected to the MSU LAN (local area network).

---

Policy adopted:  02-25-2011
Revision adopted: 08-24-2026
Policy approval and adoption: Murray State University President's Office and Information Systems Security