Network Segmentation Standard

Standard Number: 1.1.2.1.9
Category: Information Security
Owner: Information Technology Services
Effective: February 2, 2022
Revision History: None
Review Date: February 1, 2025

1. PURPOSE, SCOPE AND RESPONSIBILITIES

   1. Pursuant to the Information Security Policy, the University will secure the Campus Network. Integral to the security of Campus Network is limiting access privileges to those who need it by splitting it into sub-networks (“Network Segmentation”).
   2. The purpose of this Standard is to establish the guidelines for Network Segmentation across the University to protect the Campus Network from widespread cyber-attacks as well as enable better network performance by reducing the number of users in specific areas. This Standard is based on the NIST 800-171, “Systems & Communications” and “Security Assessment” control guidelines that outline network segmentation frameworks.
   3. This Standard applies to all Virtual Local Area Networks (VLANs) created to segment the Campus Network.
   4. The Chief Information Officer, supported by the Chief Security Officer and Executive Director for Enterprise Infrastructure, is responsible for the implementation and enforcement of this Standard.
   5. WVU Information Technology Services (“ITS”) Network Operations and Health Sciences Center Information Technology Services (“HSCITS”) Network Systems are responsible for approving the creation of new VLANs that control the flow of information into and out of the Campus Network and its segments.
   6. LAN Managers are responsible for identifying creation of new VLANs and requesting approval through Network Operations/Network Systems as well as authorizing any approved changes to ACLs.

2. Network Segments

   1. The University will segment its Campus Network through the use of Virtual Local Area Networks (VLANs) which are logical groupings of hosts in a similar broadcast domain.
   2. VLANs will be created, and membership based on the following purposes:
      1. Physical location. VLANs may be created based on physical requirements such grouping by campus, building, and/or floor.
      2. Function. VLANs may be created based on functional requirements such as to conduct WVU business, to provide guests wireless access, Internet of Things devices, or for gaming in student residence halls.
      3. Compliance. VLANs may be created based on compliance requirements such as grouping by a specific department subject to compliance requirements.
      4. Security. VLANs may be created to protect access to Sensitive Data and to provide privileged access to University Information Systems.
   3. Each VLAN must have an identified LAN Manager responsible for managing and configuring it.
   4. When creating an approved VLAN, LAN Managers must:
      1. Identify each VLAN by a VLAN ID Number;
      2. Set a specific IP Address scope for each VLAN;
      3. Assign each port switch or route to be a member of a VLAN to allow receiving and sending traffic on that VLAN;
      4. Permit only selected, approved, and trusted devices and services to each VLAN based on an Access Control List. See Section 3.; and,
      5. Add VLAN to WVU ITS/HSC ITS DHCP Servers to ensure the VLANs receive the appropriate IP addresses.
   5. External systems authorized to connect to systems transmitting, processing, or storing Sensitive Data should be formally identified/approved.
   6. Static IPs will be allocated and provided when Network Operations/Network Systems or the LAN Manager determines there is a need to do so.

3. Firewall Rules

   1. The University will utilize Firewall Rules (e.g., Access Control Lists, NSX rules, Palo Alto rules) to determine the level of access required to network segments.
   2. Firewall Rules are managed by Network Operations/Network Systems; however, LAN Managers are authorized to approve any changes to VLANs.
   3. Firewall Rules must be based on the principle of Least Privilege.
   4. Users must only be permitted to access network segments that include Sensitive Data using University-Owned Devices.
   5. Firewall Rules must be reviewed regularly and updated. Pursuant to the Campus Network Firewall Review Procedure a comprehensive review must be conducted, at minimum, every six months. This review includes auditing ports to ensure they are only open to necessary areas.

4. DEFINITIONS

   1. Access Control Lists” means a list of permissions associated with an object. The list specifies who or what is allowed to access the object and what operations are allowed to be performed on the object.
   2. “Confidentiality” means preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.
   3. “Dynamic Host Configuration Protocol (DHCP) Server” means a network server that automatically provides and assigns IP addresses, default gateways, and other network parameters to client devices.
   4. “Firewall Rules” means rules used to filter network traffic by either blocking or allowing packets based on defined rules that are assigned directly to a firewall.
   5. “Integrity” means guarding against improper information modification or destruction, including ensuring information non-repudiation and authenticity.
   6. “Internet of Things” means objects or devices not traditionally connected to the network that contain electronics, software, sensors, and actuators which allow them to connect, interact, and exchange data with the Campus Network such as appliances, automobiles, smart TVs, and smart speakers.
   7. "Least Privilege” means granting the minimum system resources and authorizations needed to perform its function or restricting access privileges of authorized personnel to the minimum functions necessary to perform their job.
   8. “Network Segmentation” is the process of splitting a network into sub-networks, for example, by creating separate areas on the network which are protected by firewalls configured to reject unnecessary traffic. Network segmentation minimizes the harm of malware and other threats by isolating it to a limited part of the network.
   9. “Privileged Access” means full rights granted to administrative account or user intended to be used only when performing management tasks such as installing updates, managing user accounts, modifying operating system and application settings.
   10. “University Technology Resource” means the Campus Network, University-owned hardware, software, and communications equipment, technology facilities, and other relevant hardware and software items as well as personnel tasked with the planning, implementation, and support of technology.

5. Related Documents

   1. Information Security Policy
   2. Data Classification Policy
   3. Campus Network Firewall Review Procedure