Washington State Patrol 7/30/2018

WSP Contract No. CRD00021 WSP recognizes that the FBI CJIS Security Policy is a minimum standard and that circumstances are encountered that create a need for additional security measures. These standards are in addition to the current CJIS Security Policy. a. Livescan devices will comply with the following security requirements: i. Unauthorized unescorted physical and logical access to Livescan devices will be restricted. In some environments, it might not be realistic to expect absolute control over a Livescan device 100% of the time. In these environments, acceptable risk mitigations will be provided in lieu of 100% control through escorted access. The WSP reserves the right to object to equipment security measures and to suspend or withhold service until such matters are corrected to the reasonable satisfaction of WSP. ii. Livescan devices will be single purpose workstations. That is, applications used on the workstation will be used only for functions involving Livescans. iii. Livescan devices will have restricted internet access (i.e. authorized vendor support). iv. Livescan devices will not host email clients that can receive email from the internet. v. Livescan devices will not be used to display or edit documents except for reports produced by the Livescan device (word processing, spreadsheets, PDF's, etc.), vi. Livescan devices will not be connected to any external media, except for the purpose of performing software and application upgrades. The media should be used only on Livescan devices. If the media is used on a non-Livescan device, it will be erased and a new image will be placed on the media before it is used with a Livescan device. vii. Livescan devices will be protected from workstations that do have general workstation functions by firewalls that prohibit external access to Livescan devices. viii. The Livescan will be located in an area that is physically restricted to the public or other unauthorized users. When the Livescan is not in use and left unattended, it must be logged off and password protected. In the cases of portable Livescans, the Livescan will not be left unattended in a non-secure area. b. All security exceptions must be documented in writing and approved by WSP and WIN. c. The threat vectors currently addressed are: i. Physical access issues ii. Multiple/shared function (due to security issues raised by co-resident applications) iii. Unrestricted internet access iv. Email access v. Accessing documents that could have been maliciously crafted vi. External media vii. Contact with other workstations over the local network segment that are at higher risk for infection/compromise viii. Lack of firewall separation/overly permissive firewall configuration Approved as to Form by the Washington Attorney General 2018 Livescan to WIN ABIS User Agreement 05/08/2018 Page 2 of 7