ML20053B112
| ML20053B112 | |
| Person / Time | |
|---|---|
| Issue date: | 12/01/1980 |
| From: | Harris M NRC OFFICE OF ADMINISTRATION (ADM) |
| To: | Anne Frost NRC OFFICE OF ADMINISTRATION (ADM) |
| Shared Package | |
| ML20053B111 | List: |
| References | |
| FOIA-81-409 NUDOCS 8205280061 | |
| Download: ML20053B112 (5) | |
Text
T
.\\
(
D
- 7. 2 DEC1 1980 ME!10RANDUM FOR: Asa R. Frost, Jr., Chief ADP Management Systems Branch Division of ADP Support i
Office of Administration FROM:
M. Richdrd Harris," Acting Chief Facilities and Systems Security Branch Division of Security Office of Administration
SUBJECT:
PAYROLL SYSTEM SECURITY S'TUDY
REFERENCE:
Your memorandum, dated November 13, 1980; same as above.
This memorandum describes the status of the five recommended actions assigned to the Division of Security and noted in the referenced memorandum.
In addition, a recomendation for the security training program, No. 5, is in-cluded (see enclosure).
1.
Guard Awareness: The guards at Lugenbeel have been briefed.as to the sensitive nature of infomation being processed there.
FSSB will reinforce this awareness by re-briefing the guards during the week en. ding December 5,1980.
2.
Badges / Passes: The lack of a requirement for badges to be displayed in NRC buildings is a long standing Commission decision. Although FSSB is not currently pressing to change that decision generally, FSSB is in the process of defining requirements for badges to be dis-played inside NRC computer centers as part of the implementation of the requirements for A-71. TM-1.
3.
Window Alams: No action is currently in progress; however, FSSB l
will review this recomendation during the week of December 5,1980.
1 4.
Phillips Alam: The alam system at Lugenbeel is currently connected to the alam console at Phillips.
FSSB will review the rpocedures with the Lugenbeel guard force during the week of December 5,1980.
5.
Security Training Program: The Division of Security should be involved in setting up such a security training program.
In prior instances involving security training related to the Privacy Act of 1974, the ELD tias also been heavily involved.
820528Oe,M 6.
Property Slips:
FSSB will review the property pass procedures during the yeek of-Dicembei 5,1900--The prutylmn-tr that an adequate inspection omee >.'
suwavtY.
DATE
(
(
.n Asa R. Frost, Jr.
.- 2 --
DEC1 1980 program is necessary for an adequate property. pass system. An inspection program may require Comission approval and will, at least, require EDO approval.
~
5 M. Richard !!arris, Acting Chief Facilities and Systms Security Branch Division of Security Office of Administration
Enclosure:
As stated cc:
R. J. Brady, SEC SEC CEN FILE: '7.20 M
(
i i
I or r ect >l FSSB...
sunnar.*r p!.......y.G.. Harris:gw I
oc c );,. 11./..M.......
./. 80
.[*
h RESPONSIBLE 4
RECOMMENDED ACTION DIVISION STATUS / COMMENTS 1.
Making guard personnel aware of the sensitive nature of the information being processed on Security
_l the Lugenbeel Division of Accounting computer facility.
Badges / Passes should be displayed by all-personnel upon entry and exit from the building.
Since the facility and the complement of personnel are small in the 2.
Lugenbeel facility, the guards Security recognize'most people by sight.
However since badges were not always required to be shown, it would be fairly easy for a dis-gruntled former employee to gain entrance to the building.
Smoke and/or thermal detectors should be placed_in the computer room.
In the event that a fire started in the room when it was ADP Support unoccupied, a very good prob-ability exists' for the computer equipment to be completely destroyed before the fire was detected.
3.
A security alarm system should be installed on all windows on Security-the second and third floor levels.
4.
The alarm system should be act-iviated at the Phillips building.
when guard personnel are not Security physically at the Lugenbeel building.
Program listings should be kept in locked file cabinets located ADP Support outside o,f the computer room.
Payroll tapes at both the Lugenbeel and Phillips building should be kept in a combination
~
lock-type fire resistant safe.
ADP Support These safes should be locked at all. times when the tapes are not in use.
b
,-------r
,-n,
--v---
~
o 9
. ~
RESP 0:!SIBLE RECOMMEllDED ACTION DIVISION STATUS /COMMErlTS Lockable tape transport cases should be provided for movement ADP Support of tapes off-site.
Handcarts should be available to remove essential listings and Accounting tapes in the event of fire or other emergencies.
Locks on all computer room doors should be of the tamperproof dead-bolt type.
Broken locks ADP Support
~
(Landow Building computer room door) should be replaced.
All persons not known to office or computer room personnel should be challenged.
This is part-icularly applicable to the Landow facility. Test team mem-Accounting bers twice entered this facility, once with Division of Security Personnel, without challenge or obstruction.
5.
A security training program should be instituted for all personnel in the, Division of Accounting. This program could be a half-day course wherein the provisions of the Accounting Privacy Act of 1974 and the attendent penalities for un-lawful disclosures of personal data (sensitive) would be explained to the personnel-who handle such information.
A safety training program be instituted for all personnel in both the Division of Accounting and Division,of ADP ADP Support Support in regards to fire evacuation routes, proper handling of fire extinguishers, etc.
Fire evacuation routes and the cor_ rect locations of all fire ADP Support suppression equipment be clearly __.
h th RESPONSIBLE RECOMMENDED ACTION DIVISION STATUS / COMMENTS
^
marked on charts and prominently displayed.
(The charts now displayed do not show all locations of fire extinguishers nor the type.)
Emergency fire,. local police and building guards telephone numbers should be prominently displayed in all work areas, preferably a sticker ADP Support with these numbers could be printed and displayed on each telephone device.
Keys to the computer room, the payroll section and other areas which'contain any sensitive information or listings shoulc be kept in a locked wall-mounted Accounting key cabinet.
The key to the cabinet should be strictly controlled by the 4
Director, Division of Accounting.
6.
A system of property slips for the removal of materials (tapes, disk packs, etc.) should be established.
These property slips should be authorized and signed by the Director, Division of Accounting. At the present time anyone can remove these properties'from the building Security unchallenged by the guard personnel.
A sign should be posted in the
-~
lobby area informing all URC personnel and visitors that packages and briefcases of persons entering and le'aving the building are subject to search by the security guards.
I l
l C
--