Course Project Milestone 1

4.3.1 Passwords must not be shared with anyone, including Coastal Veterinary Clinic information. Corporate Information Security recognizes that legacy applications do not support proxy systems in place. Please refer to the technical reference for additional details ................... 14 4.3.2 Passwords must not be inserted into email messages, Alliance cases, or other forms of electronic communication, nor revealed over the phone to anyone .............................................. 14 4.3.3 Passwords may be stored only in “password managers” authorized by the organization. 14 4.3.4 Do not use applications' "Remember Password" feature (for example, web browsers).14 4.3.5 Any user suspecting their password may have been compromised must report the incident and change all passwords ................................................................................................. 14 4.4 Application Development ................................................................................................... 14 4.5 Multi-Factor Authentication ............................................................................................... 14 4.5.1 Multi-factor authentication is highly encouraged and should be used whenever possible, not only for work-related and personal accounts ........................................................................... 15 5. Policy Compliance ................................................................................................................. 15 5.5 Exceptions ........................................................................................................................... 15 5.6 Non-Compliance ................................................................................................................. 15 6 Related Standards, Policies, and Processes ............................................................................ 15 Password Construction Guidelines 1. Overview ................................................................................................................................ 16 2. Purpose ................................................................................................................................... 16 3. Scope ...................................................................................................................................... 16 4. Statement of Guidelines ......................................................................................................... 16 5. Policy Compliance ................................................................................................................. 17 6.2 Exceptions ........................................................................................................................... 17 6.3 Non-Compliance ................................................................................................................. 17 Digital Signature Acceptance Policy 1. Overview ................................................................................................................................ 18 2. Purpose ................................................................................................................................... 18 Coastal Veterinary Clinic 2023 – All Rights Reserved Page 3 Coastal Veterinary Clinic

Coastal Veterinary Clinic policies and standards and local laws and regulations. Exceptions to this policy are documented in section 5.2 This policy applies to employees, contractors, consultants, temporaries, and other workers at Coastal Veterinary Clinic, including all personnel affiliated with third parties. This policy applies to all equipment owned or leased by Coastal Veterinary Clinic. 4. Policy 4.1 General Use and Ownership 4.1.1 Coastal Veterinary Clinic proprietary information stored on electronic and computing devices, whether owned or leased by Coastal Veterinary Clinic, the employee, or a third party, remains the sole property of Coastal Veterinary Clinic. You must ensure that the Data Protection Standard protects proprietary information through legal or technical means . 4.1.2 You are responsible for promptly reporting the theft, loss, or unauthorized disclosure of Coastal Veterinary Clinic proprietary information. 4.1.3 You may access, use, or share Coastal Veterinary Clinic proprietary information only to the extent authorized and necessary to fulfill your assigned job duties. 4.1.4 Employees are responsible for exercising good judgment regarding the reasonableness of personal use. Individual departments are responsible for creating guidelines concerning personal use of Internet/Intranet/Extranet systems. In the absence of such policies, employees should be guided by departmental policies on personal use, and if there is any uncertainty, employees should consult their supervisor or manager. 4.1.5 For security and network maintenance purposes, authorized individuals within Infosec may monitor equipment, systems, and network traffic at any time, per Infosec's Audit Policy . 4.1.6 Infosec reserves the right to audit networks and systems periodically to ensure compliance with this policy. 4.2 Security and Proprietary Information 4.2.1 All mobile and computing devices that connect to the internal network must comply with the Minimum Access Policy . Coastal Veterinary Clinic 2023 – All Rights Reserved Page 6 Coastal Veterinary Clinic

4.3.2 Email and Communication Activities Users must realize they represent the company when using company resources to access and use the Internet. Whenever employees state an affiliation to the company, they must also clearly indicate that "the opinions expressed are my own and not necessarily those of the company." Questions may be addressed to the IT Department. 1. Sending unsolicited email messages, including sending "junk mail" or other advertising material to individuals who did not specifically request such material (email spam). 2. Any form of harassment via email, telephone, or paging, whether through language, frequency, or size of messages. 3. Unauthorized use or forging of email header information. 4. Solicitation of email for any other email address other than that of the poster's account with the intent to harass or to collect replies. 5. Creating or forwarding "chain letters," "Ponzi," or other "pyramid" schemes of any type. 6. Use of unsolicited email originating from within Coastal Veterinary Clinic's networks of other Internet/Intranet/Extranet service providers on behalf of, or to advertise, any service hosted by Coastal Veterinary Clinic or connected via Coastal Veterinary Clinic's network. 7. Posting the same or similar non-business-related messages to large numbers of Usenet newsgroups (newsgroup spam). 4.3.3 Blogging and Social Media 1. Blogging by employees, whether using Coastal Veterinary Clinic’s property and systems or personal computer systems, is also subject to the terms and restrictions outlined in this Policy. Limited and occasional use of Coastal Veterinary Clinic’s systems to engage in blogging is acceptable, provided that it is done in a professional and responsible manner, does not otherwise violate Coastal Veterinary Clinic’s policy, is not detrimental to Coastal Veterinary Clinic’s best interests, and does not interfere with an employee's regular work duties. Blogging from Coastal Veterinary Clinic’s systems is also subject to monitoring. 2. Coastal Veterinary Clinic’s Confidential Information policy also applies to blogging. As such, Employees are prohibited from revealing any Coastal Veterinary Clinic confidential or proprietary information, trade secrets, or any other material covered by Coastal Veterinary Clinic’s Confidential Information policy when engaged in blogging. Coastal Veterinary Clinic 2023 – All Rights Reserved Page 9 Coastal Veterinary Clinic

4. Policy 4.1 Contingency Plans The following contingency plans must be created:  Computer Emergency Response Plan: Who will be contacted, when, and how? What immediate actions must be taken in the event of certain occurrences?  Succession Plan: Describe the flow of responsibility when normal staff is unavailable to perform their duties.  Data Study: Detail the data stored on the systems, its criticality, and its confidentiality .  Criticality of Service List: List all the services provided and their order of importance.  It also explains the recovery order in both short-term and long-term timeframes.  Data Backup and Restoration Plan: Detail which data is backed up, the media to which it is saved, where that media is stored, and how often the backup is done. It should also describe how that data could be recovered.  Equipment Replacement Plan: Describe what equipment is required to begin to provide services, list the order in which it is necessary, and note where to purchase the equipment.  Mass Media Management: Who is in charge of giving information to the mass media?  Also provide some guidelines on what data is appropriate to be provided. After creating the plans, practicing them to the extent possible is essential. Management should set aside time to test the implementation of the disaster recovery plan. Tabletop exercises should be conducted annually. During these tests, issues that may cause the plan to fail can be discovered and corrected in an environment with few consequences. The plan, at a minimum, should be reviewed and updated on an annual basis. 5. Policy Compliance 5.1 Compliance Measurement The Infosec team will verify compliance with this policy through various methods, including but not limited to periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner. 5.2 Exceptions The Infosec Team must approve any exception to the policy in advance. Coastal Veterinary Clinic 2023 – All Rights Reserved Page 12 Coastal Veterinary Clinic

electronic communication, nor revealed over the phone to anyone. 4.3.3 Passwords may be stored only in “password managers” authorized by the organization. 4.3.4 Do not use the "Remember Password" feature of applications (for example, web browsers). 4.3.5 Any user suspecting that his/her password may have been compromised must report the incident and change all passwords. 4.4 Application Development Application developers must ensure that their programs contain the following security precautions: 4.4.1 Applications must support the authentication of individual users, not groups. 4.4.2 Applications must not store passwords in clear text or in any easily reversible form. 4.4.3 Applications must not transmit passwords in clear text over the network. 4.4.4 Applications must provide some sort of role management, such that one user can take over the functions of another without having to know the other's password. 4.5 Multi-Factor Authentication 4.5.1 Multi-factor authentication is highly encouraged and should be used whenever possible, not only for work-related accounts but also for personal accounts. 5. Policy Compliance 5.4 Compliance Measurement The Infosec team will verify compliance with this policy through various methods, including but not limited to periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner. 5.5 Exceptions The Infosec Team must approve any exception to the policy in advance. 5.6 Non-Compliance An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment. Coastal Veterinary Clinic 2023 – All Rights Reserved Page 15 Coastal Veterinary Clinic

6.2 Exceptions The Infosec team must approve any exception to the policy in advance. 6.3 Non-Compliance An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment. Digital Signature Acceptance Policy Free Use Disclaimer: This policy was created by or for the SANS Institute for the Internet community. All or parts of this policy can be freely used for your organization. There is no prior approval required. If you would like to contribute a new policy or updated version of this policy, please send an email to policy-resources@sans.org . Last Update Status: Updated October 2023 Coastal Veterinary Clinic 2023 – All Rights Reserved Page 18 Coastal Veterinary Clinic