ACHIEVING COCO COMPLIANCE Warwickshire County Councils experience

1
ACHIEVING COCO COMPLIANCEWarwickshire County
Councils experience

• Linda Scannell
• Technical Development Manager

2
Achieving CoCo compliance

• What the CoCo covers
• The process
• Issues
• What we needed to do
• What weve gained
• Where to next

3
What the CoCo covers

• Physical security
• User education
• Configuration (firewalls, IP addressing, unique
  IDs, PC and server config, etc)
• Mobile working
• Patch management
• Monitoring/incident response

4
The process

• Received the CoCo in April 2007
• Initial CoCo meeting May 2007
• Project manager
• ICT Security Manager
• Technical Architect
• Techies (security, comms, network admin)
• GovC Account Manager
• GovC Consultant from Vega
• Produced an action plan
• 4 submissions later .
• Achieved approval in March 2008

5
Issues

• Obtaining all the documents
• Clarity on what we were required to do e.g.
• definition of hosts
• whether our Aventail/Citrix remote working
  solution was acceptable
• Other priorities on our side

6
What we needed to do

• Liaise with vendors re standards compliance
• Minor reconfiguration
• Review our audit logging procedures
• Formalise some procedures
• Identify our unpatchable software
• Look at implementing intruder detection
• and we havent got ticks in every box.

7
What weve gained

• A happy ICT Security Manager
• Getting individuals to take security seriously
• Getting funding for security improvements
• Helps us towards achieving ISO27001

8
Where next?

• Getting GC Mail working
• Offering an aggregated connection for our
  districts and boroughs
• another CoCo!
• Pilot for the Youth Justice Board on GCSx
• Promoting GC to the rest of the authority
• Working with WMLGA to produce procedures

9
Questions?