(c) All communications in ETGs shall pass through at least one application-level firewall approved by the commission and shall not have a facility that allows for an alternate network path.

1. (1) A firewall application shall:

   1. (i) maintain an audit log of the following information:

      1. (a) all changes to configuration of the firewall;
      2. (b) all successful and unsuccessful connection attempts through the firewall; and
      3. (c) the source and destination IP addresses, port numbers and MAC addresses; and
   2. (ii) disable all communications and generate an error event if the audit log becomes full.
2. (2) The system shall provide for interrogation that enables online comprehensive searching of the significant-event log.
3. (3) The system shall contain an access-level control structure that is capable of limiting access to programs, menu items or other secure areas of the system by means of a user name and login combination, personal identification number or other equivalent means.
4. (4) The system shall not permit the alteration of any significant log information without supervised access control.
5. (5) There shall be a system administrator notification and user lockout or audit trail entry after a set number of unsuccessful login attempts.

6. (6) The system shall record:

   1. (i) date and time of the login attempt;
   2. (ii) username supplied; and
   3. (iii) success or failure.
7. (7) The use of generic user accounts on servers is not permitted.

8. (8) The system shall not permit the alteration of any accounting or significant event log information without supervised access controls. In the event financial data is changed, an audit log shall be capable of being produced to document:

   1. (i) data element altered;
   2. (ii) data element value prior to alteration;
   3. (iii) data element value after alteration;
   4. (iv) time and date of alteration; and
   5. (v) user login.

(d) In addition to the requirements set forth in section 5317.36 of this Part, a gaming facility licensee or a licensed manufacturer shall submit to the commission for review and approval procedures to be established in the use of remote access as set forth in section 5321.10(b) of this Title. Such procedures shall designate, at a minimum, authorized users and authorized settings of the electronic table game or games.

1. (1) Remote access shall authenticate all computer systems based on the authorized settings of the electronic table game and firewall application that establishes a connection with the electronic table game pursuant to the following requirements:

   1. (i) a remote access user activity log is maintained by both the gaming facility and the licensed manufacturer, depicting the following information:

      1. (a) authorizing individual;
      2. (b) purpose;
      3. (c) user login;
      4. (d) time and date; and
      5. (e) duration and activity while logged in;
   2. (ii) unauthorized remote user administration functionality is prohibited;
   3. (iii) unauthorized access to the database is prohibited;
   4. (iv) unauthorized access to the operating system is prohibited; and
   5. (v) if remote access is to be on a continuous basis, then a network filter shall be installed to protect access, as approved by the commission.
2. (2) The system shall implement self-monitoring of all critical interface elements and shall have the ability to notify effectively the system administrator of any error condition, provided the condition is not catastrophic.
3. (3) The system shall be able to perform the operation prescribed in paragraph (2) of this subdivision with a frequency of at least once in every 24-hour period and during each power-up and power reset.