1.1 Purpose

The purpose of this policy is to protect, from all threats—whether internal or external, deliberate or accidental—the information assets of Vancouver Firefighters’ Credit Union.

1.2 Objectives

The implementation of this policy is important to maintain and demonstrate CU integrity in dealing with members and vendors. It is the policy of Vancouver Firefighters’ Credit Union to ensure:

• Information is protected against unauthorized access.
• Confidentiality of information is maintained.
• Information is not disclosed to unauthorized persons through deliberate or careless action.
• Integrity of information is maintained through protection from unauthorized modification.
• Availability of information to only authorized users when needed.
• Regulatory and legislative requirements are met.
• Business continuity plans are produced, maintained and tested as far as practicable.
• Information security training is given to all employees.
• All breaches of information security and suspected weaknesses are reported and investigated.

1.3 Applicability

All VFFCU staff and vendors, employed under contract, who have any involvement with information assets covered by the scope of the Information Security Management System, are responsible for implementing this policy and shall have the support of the VFFCU Management who have approved the policy.

1.4 Compliance

Failure to comply with this policy may result in breaches of security, leading to the exposure of data of a confidential or sensitive nature. Lack of compliance may result in disciplinary action, as circumstances dictate.

2. Asset Management

Information and information systems constitute valuable VFFCU resources. The asset management policy identifies rules of acceptable use and protection: what assets to protect, who protects them, and how much protection is adequate.

2.1 Identification of Assets

VFFCU must identify assets under its control, including software; hardware; services (computer, communications, and utilities); and information assets such as databases, data files, contracts and agreements, system documentation, research information, user manuals, operational or support procedures, continuity plans, fall-back arrangements, and archived information.

2.2 Documenting and Maintaining Asset Inventories

An inventory of all important assets associated with information systems must be documented and maintained. The loss, theft or misappropriation of assets must be reported immediately to the IT Service Desk. Where the loss, theft or misappropriation involves information, the incident response plan must be initiated.

2.3 Acceptable Use of Assets

Rules for the acceptable use of information systems must be identified, documented and implemented.

3. Human Resources Security

These are the information security requirements for employees, external consultants and contractors that have an employment relationship with VFFCU.

• Reference, credit and criminal records checks must be completed prior to hire or engagement.
• Responsibilities for information and systems security documented in the End User Technology Agreement must be signed off upon hire.
• Security breaches or policy violations must be reported and investigated and appropriate disciplinary action taken where warranted.
• All CU assets must be returned on termination of employment.
• Access rights to information systems must be terminated on termination of employment.

3.1 Security Roles and Responsibilities

Security roles and responsibilities must be documented and communicated to all personnel. These are documented in the End User Technology Agreement.

3.2 Screening of Employees, External Consultants and Contractors

All staff must undergo reference, credit and criminal records checks prior to entering a working relationship with VFFCU.

Disciplinary Process

Security breaches or policy violations caused by employees, external consultants and contractors must be reviewed by Management. Managers are responsible for informing the Information Systems team, assisting in investigations, determining appropriate disciplinary action, and arranging for removal of access privileges when appropriate.

3.3 Termination Responsibilities

Managers must advise employees, external consultants and contractors of ongoing confidentiality responsibilities that continue to apply after termination of employment.

3.4 Return of Assets

Employees, external consultants and contractors must return VFFCU assets upon termination or change of employment.

3.5 Removal of Access Rights

Access rights to information systems must be removed upon termination of employment and reviewed upon change of employment.

4. Physical and Environmental Security

Requirements for the installation, operation, protection and maintenance of computer equipment are identified to preserve the confidentiality, integrity and availability of VFFCU information and information systems.

4.1 Physical Security

Information processing facilities must be appropriately protected, taking into account personnel safety and the protection of sensitive or valuable information and assets.

4.2 Physical Entry Controls

Secure areas must be protected by appropriate entry controls to ensure only authorized personnel are allowed access. Entry controls should identify, authenticate and monitor access attempts. Visitors must be accompanied by an authorized person. Access rights to secure areas must be reviewed and updated regularly.

4.3 Equipment Security

Equipment must be protected to reduce the risks from unauthorized access, environmental threats and hazards. Servers and other centralized computing equipment must be located in a secure information processing facility, and equipment must be protected from observation by unauthorized persons.

4.4 Off-Site Use of Equipment

Off-site use of equipment must be authorized. VFFCU equipment used off-site must be protected commensurate with the sensitivity of the information it contains and the value of the equipment.

5. Operations Security

Controls for operations include documented processes, staff duties and formal methods to implement changes to facilities. This includes methods to protect information, create copies for backup and to manage the media where those copies are stored. Network protection requirements from threats such as viruses or unauthorized disclosure are also described.

5.1 Change Management

Changes to information systems and information processing facilities must be controlled via a documented change management process that records significant changes, assesses impacts (including security), obtains approvals, plans/tests with fallback procedures, and communicates details to relevant personnel.

5.5 Protection Against Malicious and Mobile Code

Security awareness, prevention and detection controls must be utilized to protect information systems against malicious code. The Information Security Officer develops user awareness programs, and the Information Security team communicates technical advice and awareness activities.

6. Network Security Controls

A range of controls must be implemented to achieve and maintain security within the VFFCU network. Secured paths for information transmission must use controls such as encryption (e.g., SSH, SSL, VPN) and systems to detect tampering.

6.1 Portable Storage Devices

The use of portable storage devices to store or transport information increases risk. Users must ensure devices are encrypted and physically secure, understand added risks and responsibilities, and follow reporting procedures. Minimum safeguards include disabling unused ports, avoiding sole copies on portable devices, documented authorization, encryption of confidential data, contractual requirements for third parties, and secure erasure/disposal.

6.2 Secure Disposal of Media

Media must be disposed of securely and in a manner appropriate for the sensitivity of the data contained on the media.

6.3 Information Handling

Media must be handled and stored to prevent unauthorized disclosure or misuse.

6.4 Security of System Documentation

Systems documentation must be protected from unauthorized access by access controls, passwords, and encryption or digital signatures appropriate to the information classification.

6.5 Physical Media in Transit

Media being physically transported must be appropriately protected. Minimum requirements include verifying courier credentials, retaining receipts, protective packaging, and avoiding visible classification labels. Any media sent by courier must be encrypted and classified.

7. Business Information Systems

Security controls must be implemented to mitigate business and security risks associated with interconnection of business information systems.

7.1 Online Transaction Security

Information systems containing online transactions must have controls to prevent incomplete transmission, mis-routing, unauthorized alteration, disclosure, duplication and replay. Controls include validating user credentials, digital signatures, cryptography, secure protocols, and storing transaction details on servers within the appropriate network security zone.

7.2 Publicly Available Information

Management must pre-authorize publication of information on publicly accessible systems and implement processes to prevent unauthorized modification. Controls include change records, integrity checks, prevention of inappropriate release of sensitive or personal information, monitoring for unauthorized changes, and preventing unauthorized access.

7.3 Audit Logging

Audit logs recording user activities, exceptions and information security events must be produced and retained to assist with monitoring and investigations.

8. Access Control Policy

Access restrictions protect the organization from threats such as internal and external intrusions and are guided by regulations and business requirements.

8.1 Access Control

Access must be consistent with business needs and security requirements, considering both physical and logical access, applying “need to know” and “least privilege,” defaulting to deny-all, requiring unique user identifiers, and assigning permissions to roles.

8.2 Access Management

Formal user registration and de-registration processes must be in place, including verified approvals, records of approvals, acknowledgement of conditions of access, unique IDs, segregation of authorization and granting, role-based permissions, secure delivery of credentials, and timely deregistration/reviews (e.g., upon role changes, reorgs, extended absence, or termination).

8.3 Password Management

Issuance and reset of authentication credentials must be controlled. Passwords are issued after identity confirmation, delivered securely, temporary passwords must be unique and not easily guessable where possible, never stored unprotected, and vendor defaults must be changed to VFFCU-compliant passwords during installation.

8.4 Review of Access Rights

User access rights must be reviewed at regular intervals via a formal process.

8.5 Password Use

Users must follow good security practices in the selection and use of passwords as documented in the Electronic Services Policies and Procedures.

8.6 Clear Desk and Clear Screen

Users must secure sensitive information when workspaces are unattended (e.g., clear desktops, lock documents and devices, secure mail, lock computers, lock doors/windows, and check printers/faxes for sensitive output).

8.7 Network Access Control

Only required network services should be enabled. Access will be controlled at perimeters, routers, gateways, workstations and servers, and restricted to authorized users/systems using least privilege.

8.8 Remote Access

Remote access must be authenticated and use designated gateways/services (e.g., VPN, DTS, OWA). Security Threat and Risk Assessments determine authentication methods; prior approvals are required for interconnections; identification and authorization are required before permitting remote connections.

8.9 Authentication for External Connections

Automatic equipment identification should be used, as appropriate, to authenticate connections from specific locations and equipment.

8.10 Protection of Diagnostic Ports

Physical and logical access to diagnostic ports must be securely controlled, kept inactive until needed and active only for the minimum required time. Use should be logged and monitored.

8.11 Network Segregation

Groups of services, users and systems must be segregated on networks. Perimeters and control points (firewalls, routers, switches, gateways, VPNs, proxies) must be implemented to provide the required level of control.

8.12 Network Connection Control

User connection capability must be restricted in shared networks per access control policy. Techniques include cabling protection, control of public ports, segregated networks for unauthenticated devices, authentication prior to issuing addresses, router ACLs, scanning for unauthorized equipment, and VLANs.

8.13 Mobile Computing and Teleworking

Appropriate controls must mitigate risks associated with portable devices. Users must protect information/assets in their custody, secure unattended devices, and receive security awareness training. Threats considered include theft, remote access misuse, interception, credential theft, unauthorized use, destruction, key-logging, and malicious code. Minimum safeguards include encryption of stored/transmitted data, access controls on devices (especially multi-user), regular backups using VFFCU facilities, avoiding sole copies on portable devices, physical security of devices, and user authentication aligned with policy.

9. Information Security Incident Management

This policy establishes requirements for rapid reporting of possible security breaches and clear procedures so personnel understand their roles in reporting and mitigating security events.

9.1 Reporting Information Security Events

Information security events must be immediately reported through appropriate management channels. Employees must report suspected or actual events to the IT Team, and reporting requirements must be included in contracts and service agreements.

9.2 Reporting Security Weaknesses

Employees must note and report observed or suspected security weaknesses. Reports are investigated confidentially, reporters are advised of outcomes, and weaknesses must not be tested or discussed outside approved channels.

9.3 Responsibilities and Procedures

The types, volumes and costs of information security incidents must be quantified and monitored.