Firewall Protection

Download complete service offering 

1. Description of Service

The- Information Technology Division (ITD) provides firewall protection services for the Commonwealth's assets and resources. Remote firewalls support customer hosted applications requiring remote firewall protection utilizing MAGNet services. Secure remote device managed firewalls are used when a customer requires remote vendor access to equipment or devices located at the customer site. By using these protection services, ITD provides customers secure access while protecting the Commonwealth's assets and resources.

 

The Remote Firewall service includes:

• Provision and configure a remote firewall
• Establish a firewall perimeter with failover capability in MAGNet connections to DMZ's and to the internet as a whole
• Monitor and change firewall rules when needed

Remote Device Managed Firewall service includes:

• Provision and configure a firewall edge for remote customer locations
• Provide secure connections for customer vendors to access their devices remotely
• Monitor and change firewall rules when needed

Magnet Security Protection:

Securing MAGNet through managed enterprise firewalls and Internet Gateway services has been a standard service offering (previously included in ITD's Network Services and network rates) that supports resources and infrastructure including:
 

• Managed firewalls that ensure access control and secured authorized use of MAGNet.
• Gateway services that provide a protection layer for all mail passing through the network. All mail is filtered, scanned, and if necessary blocked by reliable and highly available anti-virus, spam and content filtering solutions.

In FY12, ITD has unbundled these services from Network and created a new service offering called MAGNet Security Port Protection. Costs for supporting this service are now included in rate code SU060 as a port charge. This port charge is applied to any device that accesses MAGNet via WAN and Campus connections, XDMZ's and hardware supporting UNIX hosting systems.

PCI Requirements:

The Information Technology Division (ITD) is primarily involved and responsible for ensuring that it is in compliance with the Data Security Standard (DSS). The standard includes 12 requirements for any business that stores, processes or transmits payment cardholder data. These requirements specify the framework for a secure payments environment. For purposes of PCI compliance, there are three steps:

• Assess
• Remediate, and
• Report

ITD as defined by PCI-SSC is a Service Provider. This is a business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data. This also includes companies that provide services that control or could impact the security of cardholder data. ITD acts as a central IT service organization (e.g. network, hardware, and application services and hosting) for Commonwealth state agencies.

Beginning in FY12, ITD will be utilizing the services of a PCI-SSC Qualified Security Assessor (QSA) to provide an on-site PCI-DSS validation. The validation will result in the QSA issuing a Report on Compliance (ROC) to ITD. PCI attestation/validation is not part of ITD's standard service offering and not included in ITD's chargeback rates. Customers requiring these services will be direct charged the costs ITD incurs to meet PCI requirements. Please see (What is PCI)  for additional information on PCI requirements.

Support services include:

• A Service Account Manager to answer any questions or concerns regarding ITD Services.
• Services offered through our Operations Office; including Change Management and customer access to incident management via email, phone (CommonHelp)
• The online COMiT service management portal

2. Service Targets

*Incidents, requests, or changes that are outside the scope of the defined service description or normal service hours will be direct charged to the customer.

3. Service Reporting

Currently, there are no reports available for this service.


 

4. Service Requests

*For new service requests only. To manage existing requests, please log into COMiT.

Request fulfillment happens as part of a process with change control. If an emergency change is needed then an emergency change control ticket is opened and the CAB is convened. Non-emergency tickets are brought before the CAB every Thursday and depending on the ticket, are acted upon during the next window.

5. Customer Responsibilities

The customer is responsible for opening change orders to initiate the changes needed to be made. The ITD Security Office will then open change control tickets, examine the request for policy violations, and then plan and schedule the change needed.

For your convenience, you may also view a detailed list of customer responsibilities.

6. Chargeback Rate Information

For more information on Chargeback, including an overview of the program as well as current and previous fiscal year rates, please visit our Chargeback Services webpage.

Cost Framework: Firewall Protection Services

Direct Costs:

Direct Dedicated Resources:

Indirect Costs:

Allocated Costs:

Adjustments:

Rates pertaining to this service offering include:

Download the cost framework for Security Protection Services 
Download a complete listing of all chargeback rates 

Updated December 13, 2012
Published August 14, 2009
Created April 10, 2009: Information provided by the Security Office