Patch Management Procedure. Andrew Marriott PATCH MANAGEMENT PROCEDURE.DOCX Version: 1.1
|
|
|
- Ursula Douglas
- 8 years ago
- Views:
Transcription
1 Title: Patch Management Andrew Marriott PATCH MANAGEMENT PROCEDURE.DOCX Version: 1.1
2 Contents 1. Introduction Objectives Context Responsibility Monitoring Review and Evaluation Risk Assessment and Testing Notification and Scheduling Implementation Auditing, Assessment, and Verification Virtual Desktop Environment User Responsibilities and Practices Violations... 6
3 Document Control Title of Document Patch Management Purpose of Document To provide clear guidance to all employees regarding the installation of software updates. Date of Document August 20 th, 2013 Document Review Date August 2015 Document Author Andrew Marriott Document Version History Date Version Section Description Author 18/07/ All First Draft Andrew Marriott 22/04/ All Revised for Gov Connect compliance. Andrew Marriott 15/09/ Published. Andrew 20/08/ Section 8 Appendix A New section for VDI. Added reference to the virtual desktops. Marriott Andrew Marriott References None. Distribution List All staff and agents of the Council. Notes None.
4 1. Introduction 1.1. As software becomes increasingly more powerful, the programming techniques used in its development becomes more complex. This complexity can lead to the introduction of flaws or bugs in the software. Occasionally these flaws can be exploited by third-parties to compromise a computer and, therefore, the integrity of the network and all computers attached to it To mitigate the risks associated with software flaws, vendors release software patches to remove these vulnerabilities. 2. Objectives 2.1. The objective of this procedure is to ensure that computer systems do not pose an unmanaged security risk for the Council. One important step in achieving this goal is ensuring that all applicable and required software patches are applied in a timely and effective manner, taking into account the risks associated with the software being patched. 3. Context 3.1. This procedure applies to all IT equipment used by members, officers and agents of the Council. 4. Responsibility 4.1. The IT Team is responsible for the overall patch management implementation, operations, and procedures. While safeguarding the network is every user s job, the IT Team have the responsibility to ensure that all known and reasonable defences are in place to reduce network vulnerabilities while keeping the network operating. This responsibility includes the tasks detailed below. 5. Monitoring 5.1. The IT Team will monitor security mailing lists, review vendor notifications and Web sites, and research specific public Web sites for the release of new patches. Monitoring will include, but not be limited to, the following:- Scanning the Council s network to identify known vulnerabilities. Identifying and communicating identified vulnerabilities and/or security breaches to GovCertUK.. Monitoring GovCertUK, notifications, and Web sites of all vendors that have hardware or software operating on Fylde Borough Councils network.
5 6. Review and Evaluation 6.1. Once alerted to a new patch, the IT Team will download and review the new patch within the following timescales:- MS Windows two working days of its release. Linux one week of its release. Other best endeavours IT will categorize the criticality of the patch according to the following: Emergency an imminent threat to Fylde Borough Councils network Critical targets a security vulnerability Not Critical a standard patch release update Not applicable to Fylde Borough Councils environment 6.3. Regardless of platform or criticality, all patch releases will follow a defined process for patch deployment that includes assessing the risk, testing, scheduling, installing, and verifying. 7. Risk Assessment and Testing 7.1. IT will assess the effect of a patch to the corporate infrastructure prior to its deployment. The Team will also assess the affected patch for criticality relevant to each platform (e.g., servers, desktops, printers, etc.) If IT categorizes a patch as an Emergency, the team considers it an imminent threat to Fylde s network. Therefore, the Council assumes greater risk by not implementing the patch than waiting to test it before implementing Patches deemed Critical or Not Critical will undergo testing for each affected platform before general implementation. IT will expedite testing for Critical patches against a group of test devices representative of the IT estate, prior to implementation. 8. Notification and Scheduling 8.1. Regardless of criticality, each patch release will require the creation of a helpdesk ticket prior to its release. The IT manager will decide when notifying staff is necessary. 9. Implementation 9.1. IT will deploy Emergency patches within two working days of availability. As Emergency patches pose an imminent threat to the network, the release may precede testing. In all instances, the team will perform testing (either pre- or post-implementation) and document it for auditing and tracking purposes.
6 9.2. Where possible patches classed as Critical will be implemented outside of normal office hours whilst those classed as Not Critical will be implemented during scheduled preventive maintenance. Each patch will have an approved Helpdesk ticket For new network devices, each platform will follow established hardening procedures to ensure the installation of the most recent patches Appendix A details the target implementation times for the various classifications of patches. 10. Auditing, Assessment, and Verification Following the release of all patches, IT staff will monitor helpdesk calls to verify the successful installation of the patch and to monitor any potential adverse effects. 11. Virtual Desktop Environment The guidance laid out in this also applies to the Virtual Desktop Environment and applications provided using the ThinApp system. 12. User Responsibilities and Practices Users of equipment being patched must not knowingly hinder or stop the update process and, if requested must restart the equipment at the earliest convenient time. 13. Violations Failure to comply with this will be dealt with through the Council s disciplinary process and may potentially lead to the termination of employment.
7 Appendix A Patch Deployment Target Timescales Emergency IT will deploy Emergency patches within two working days of availability. As Emergency patches pose an imminent threat to the network, the release may precede testing. In all instances, the team will perform testing (either pre- or post-implementation) and document it for auditing and tracking purposes. Classification Critical Public Facing Servers (DMZ) Private Servers (LAN) PCs (including virtual desktops) Within five working days of release. Within eight working days of release. Within ten working days of release. Within five working days of release. Within eight working days of release. Within fifteen working days of release. Within five working days of release. Within eight working days of release. Within fifteen working days of release. Not Critical All Servers PCs (including virtual desktops) Within ten working days of release. Within fifteen working days of release. Within twenty working days of release. Within ten working days of release. Within fifteen working days of release. Within twenty working days of release. Not Applicable Patch will not be approved for installation.
8
UMHLABUYALINGANA MUNICIPALITY PATCH MANAGEMENT POLICY/PROCEDURE
UMHLABUYALINGANA MUNICIPALITY PATCH MANAGEMENT POLICY/PROCEDURE Originator Patch Management Policy Approval and Version Control Approval Process: Position or Meeting Number: Date: Recommended by Director
Data Management Policies. Sage ERP Online
Sage ERP Online Sage ERP Online Table of Contents 1.0 Server Backup and Restore Policy... 3 1.1 Objectives... 3 1.2 Scope... 3 1.3 Responsibilities... 3 1.4 Policy... 4 1.5 Policy Violation... 5 1.6 Communication...
Information and Communication Technology. Patch Management Policy
BELA-BELA LOCAL MUNICIPALITY - - Chris Hani Drive, Bela- Bela, Limpopo. Private Bag x 1609 - BELA-BELA 0480 - Tel: 014 736 8000 Fax: 014 736 3288 - Website: www.belabela.gov.za - - OFFICE OF THE MUNICIPAL
Title: Security Patch Management
Effective Date: 11/10; Rev.: 07/12 POLICY: Security patching of computer systems attached to the IHS network will follow a defined process that includes, but is not limited to, risk assessment, testing,
PATCH MANAGEMENT POLICY IT-P-016
IT-P-016 Date: 28 th March, 2016 Stamford International University ( STIU ) Patch Management Policy Rationale Stamford International University ( STIU ) is responsible for ensuring the confidentiality,
ITP01 - Patch Management Policy
IT Services Policy ITP01 - Patch Management Policy Prepared by: < Shelim Miah> Version: V1.0 Page 1 of 8 Description & Target Audience: Policy to outline the requirement of all systems and software applications
Patch and Vulnerability Management Program
Patch and Vulnerability Management Program What is it? A security practice designed to proactively prevent the exploitation of IT vulnerabilities within an organization To reduce the time and money spent
ManageEngine Desktop Central Training
ManageEngine Desktop Central Training Course Objectives Who Should Attend Course Agenda Course Objectives Desktop Central training helps you IT staff learn the features offered by Desktop Central and to
PATCH MANAGEMENT. February 2008. The Government of the Hong Kong Special Administrative Region
PATCH MANAGEMENT February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable
INSIDE. Management Process. Symantec Corporation TM. Best Practices Roles & Responsibilities. Vulnerabilities versus Exposures.
Symantec Corporation TM Symantec Product Vulnerability Management Process Best Practices Roles & Responsibilities INSIDE Vulnerabilities versus Exposures Roles Contact and Process Information Threat Evaluation
AHS Flaw Remediation Standard
AGENCY OF HUMAN SERVICES AHS Flaw Remediation Standard Jack Green 10/14/2013 The purpose of this procedure is to facilitate the implementation of the Vermont Health Connect s security control requirements
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT S OF PUBLIC WELFARE, INSURANCE AND AGING
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT S OF PUBLIC WELFARE, INSURANCE AND AGING INFORMATION TECHNOLOGY POLICY Name Of Policy: System and Information Integrity Policy Domain: Security Date Issued: 06/22/11
Security Policy for External Customers
1 Purpose Security Policy for This security policy outlines the requirements for external agencies to gain access to the City of Fort Worth radio system. It also specifies the equipment, configuration
NCUA LETTER TO CREDIT UNIONS
NCUA LETTER TO CREDIT UNIONS NATIONAL CREDIT UNION ADMINISTRATION 1775 Duke Street, Alexandria, VA 22314 DATE: September 2003 LETTER NO.: 03-CU-14 TO: SUBJ: ENCL: Federally Insured Credit Unions Computer
SECURITY PATCH MANAGEMENT INSTALLATION POLICY AND PROCEDURES
REQUIREMENT 6.1 TO 6.2 SECURITY PATCH MANAGEMENT INSTALLATION POLICY AND PROCEDURES 6.1 TO 6.2 OVERVIEW In accordance with Payment Card Industry Data Security Standards (PCI DSS) requirements, [company
Server Management-Scans & Patches
THE UNIVERSITY OF TEXAS-PAN AMERICAN OFFICE OF AUDITS & CONSULTING SERVICES Server Management-Scans & Patches Report No. 14-11 OFFICE OF INTERNAL AUDITS THE UNIVERSITY OF TEXAS - PAN AMERICAN 1201 West
Patch Management Procedure. e-governance
for e-governance Draft DEPARTMENT OF ELECTRONICS AND INFORMATION TECHNOLOGY Ministry of Communication and Information Technology, Government of India. Document Control S/L Type of Information Document
Cyber Security Incident Handling Policy. Information Technology Services Center (ITSC) of The Hong Kong University of Science and Technology
Cyber Security Incident Handling Policy Information Technology Services Center (ITSC) of The Hong Kong University of Science and Technology Date: Oct 9, 2015 i Document Control Document Owner Classification
The Value of Vulnerability Management*
The Value of Vulnerability Management* *ISACA/IIA Dallas Presented by: Robert Buchheit, Director Advisory Practice, Dallas Ricky Allen, Manager Advisory Practice, Houston *connectedthinking PwC Agenda
IT Security Standard: Patch Management
IT Security Standard: Patch Management Introduction This standard defines specific procedural and configuration elements needed to implement the Bellevue College policy # 5250: Information Technology (IT)
Guidelines for Security Patch Management on Windows File Servers
Guidelines for Security Patch Management on Windows File Servers Introduction The following notes offer guidelines and best practice with regards preparing, reacting and managing critical security patch
NYS LOCAL GOVERNMENT VULNERABILITY SCANNING PROJECT September 22, 2011
NYS LOCAL GOVERNMENT VULNERABILITY SCANNING PROJECT September 22, 2011 Executive Summary BACKGROUND The NYS Local Government Vulnerability Scanning Project was funded by a U.S. Department of Homeland Security
Vulnerability Management Policy
Vulnerability Management Policy Policy Statement Computing devices storing the University s Sensitive Information (as defined below) or Mission-Critical computing devices (as defined below) must be fully
Complete Patch Management
Complete Patch Management Targeted, Reliable and Cost-efficient Brief Secunia CSI Corporate Software Inspector Empower your organisation to take control of the vulnerability threat & optimize your ITsecurity
SRA International Managed Information Systems Internal Audit Report
SRA International Managed Information Systems Internal Audit Report Report #2014-03 June 18, 2014 Table of Contents Executive Summary... 3 Background Information... 4 Background... 4 Audit Objectives...
Managing Vulnerabilities for PCI Compliance White Paper. Christopher S. Harper Managing Director, Agio Security Services
Managing Vulnerabilities for PCI Compliance White Paper Christopher S. Harper Managing Director, Agio Security Services PCI STRATEGY Settling on a PCI vulnerability management strategy is sometimes a difficult
Get what s right for your business. Contact @lliance Technologies.
Provisioning Looking for new technology? You need systems in line with your business goals. You also need those systems to interact seamlessly. We can help you get the right technology to the right place
PCI Compliance for Cloud Applications
What Is It? The Payment Card Industry Data Security Standard (PCIDSS), in particular v3.0, aims to reduce credit card fraud by minimizing the risks associated with the transmission, processing, and storage
Patch Management Policy
Patch Management Policy L2-POL-12 Version No :1.0 Revision History REVISION DATE PREPARED BY APPROVED BY DESCRIPTION Original 1.0 2-Apr-2015 Process Owner Management Representative Initial Version No.:
State of South Carolina Policy Guidance and Training
DRAFT For Discussion Purposes Only State of South Carolina Policy Guidance and Training Policy Workshop All Agencies Information Systems (IS) Acquisitions, Development, and Maintenance Policy April/May
OPEN SOURCE SECURITY
OPEN SOURCE SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225
Change Management Control Procedure
Change Management Control Procedure Procedure Name: Procedure Number: Prepared By: Approved By: Change Management Control ESS100 Nancy Severance Director, Administrative Computing Services Paul Foley Director,
Can Your Diocese Afford to Fail a HIPAA Audit?
Can Your Diocese Afford to Fail a HIPAA Audit? PETULA WORKMAN & PHIL BUSHNELL MAY 2016 2016 ARTHUR J. GALLAGHER & CO. BUSINESS WITHOUT BARRIERS Agenda Overview Privacy Security Breach Notification Miscellaneous
Utica College. Information Security Plan
Utica College Information Security Plan Author: James Farr (Information Security Officer) Version: 1.0 November 1 2012 Contents Introduction... 3 Scope... 3 Information Security Organization... 4 Roles
Taking a Proactive Approach to Linux Server Patch Management Linux server patching
Taking a Proactive Approach to Linux Server Patch Management Linux server patching In years past, Linux server patch management was often thought of in terms of we don t patch our servers unless there
AUDIT OF NASA S EFFORTS TO CONTINUOUSLY MONITOR CRITICAL INFORMATION TECHNOLOGY SECURITY CONTROLS
SEPTEMBER 14, 2010 AUDIT REPORT OFFICE OF AUDITS AUDIT OF NASA S EFFORTS TO CONTINUOUSLY MONITOR CRITICAL INFORMATION TECHNOLOGY SECURITY CONTROLS OFFICE OF INSPECTOR GENERAL National Aeronautics and Space
2 Copyright 2015 M. E. Kabay. All rights reserved. 4 Copyright 2015 M. E. Kabay. All rights reserved.
CSH5 Chapter 40 Managing Patches & Vulnerabilities Peter Mell & Karen Kent Scarfone Topics Introduction to Patch & Vulnerability Management Why Use Automated Patching Solutions? Patch & Vulnerability Management
BOARD OF DIRECTORS PAPER COVER SHEET. Meeting date: 22 February 2006. Title: Information Security Policy
BOARD OF DIRECTORS PAPER COVER SHEET Meeting date: 22 February 2006 Agenda item:7 Title: Purpose: The Trust Board to approve the updated Summary: The Trust is required to have and update each year a policy
The Department of Technology Services is responsible for installing and managing security controls and technologies on behalf of the State of Utah.
DTS Standard 5000-1002-S1 PATCH MANAGEMENT SECURITY STANDARD Status: Approved Effective Date: August 26, 2009 through August 25, 2011 Revised Date: N/A Approved By: J. Stephen Fletcher Authority: UCA 63F-1-103;
IPLocks Vulnerability Assessment: A Database Assessment Solution
IPLOCKS WHITE PAPER February 2006 IPLocks Vulnerability Assessment: A Database Assessment Solution 2665 North First Street, Suite 110 San Jose, CA 95134 Telephone: 408.383.7500 www.iplocks.com TABLE OF
Introduction. Special thanks to the following individuals who were instrumental in the development of the toolkits:
Introduction In this digital age, we rely on our computers and devices for so many aspects of our lives that the need to be proactive and vigilant to protect against cyber threats has never been greater.
Service Children s Education
Service Children s Education Data Handling and Security Information Security Audit Issued January 2009 2009 - An Agency of the Ministry of Defence Information Security Audit 2 Information handling and
ensure prompt restart of critical applications and business activities in a timely manner following an emergency or disaster
Security Standards Symantec shall maintain administrative, technical, and physical safeguards for the Symantec Network designed to (i) protect the security and integrity of the Symantec Network, and (ii)
PATCH MANAGEMENT POLICY PATCH MANAGEMENT POLICY. Page 1 of 5
Page 1 of 5 TABLE OF CONTENTS 1. OVERVIEW... 3 2. DEFINITIONS... 3 3. PURPOSE... 3 4. SCOPE... 3 5. POLICY... 4 6. WORKSTATIONS... 4 7. SERVERS... 4 8. ROLES AND RESPONSIBILITIES... 4 9. MONITORING AND
Antivirus and Malware Prevention Policy and Procedures (Template) Employee Personal Device Use Terms and Conditions (Template)
Below you will find the following sample policies: Antivirus and Malware Prevention Policy and Procedures (Template) Employee Personal Device Use Terms and Conditions (Template) *Log in to erisk Hub for
Information Security Incident Management Policy and Procedure
Information Security Incident Management Policy and Procedure Version Final 1.0 Document Control Organisation Title Author Filename Owner Subject Protective Marking North Dorset District Council IT Infrastructure
Introduction. PCI DSS Overview
Introduction Manage Engine Desktop Central is part of ManageEngine family that represents entire IT infrastructure with products such as Network monitoring, Helpdesk management, Application management,
AHS Vulnerability Scanning Standard
AGENCY OF HUMAN SERVICES AHS Vulnerability Scanning Standard Jack Green 10/17/2013 The purpose of this procedure is to facilitate the implementation of the Vermont Health Connect s security control requirements
Service Level Terms Inter8 Cloud Services. Service Level Terms Inter8 Cloud Services
Date 7 July 2015 SERVICE LEVEL TERMS INTER8 CLOUD SERVICES Article 1. Definitions In these Service Level Terms ( SLT ), the following terms, indicated with a capital, whether single or plural, will have
California Department of Technology, Office of Technology Services WINDOWS SERVER GUIDELINE
Table of Contents 1.0 GENERAL... 2 1.1 SUMMARY...2 1.2 REFERENCES...2 1.3 SUBMITTALS...2 1.3.1 General...2 1.3.2 Service Request...3 1.4 EXPECTATIONS...3 1.4.1 OTech...3 1.4.2 Customer...3 1.5 SCHEDULING...4
CSIRT Introduction to Security Incident Handling
CSIRT Introduction to Security Incident Handling P. Jacques Houngbo AIS 2013Technical Workshops Lusaka, Zambia, June 2013 If you think technology can solve your security problems, then you don t understand
Better secure IT equipment and systems
Chapter 5 Central Services Data Centre Security 1.0 MAIN POINTS The Ministry of Central Services, through its Information Technology Division (ITD), provides information technology (IT) services to government
WHITE PAPER. Attaining HIPAA Compliance with Retina Vulnerability Assessment Technology
WHITE PAPER Attaining HIPAA Compliance with Retina Vulnerability Assessment Technology Table of Contents Overview 3 HIPAA & Retina Enterprise Edition 3 Six Steps of Vulnerability Assessment & Remediation
Did you know your security solution can help with PCI compliance too?
Did you know your security solution can help with PCI compliance too? High-profile data losses have led to increasingly complex and evolving regulations. Any organization or retailer that accepts payment
Patch Management. Module 13. 2012 VMware Inc. All rights reserved
Patch Management Module 13 You Are Here Course Introduction Introduction to Virtualization Creating Virtual Machines VMware vcenter Server Configuring and Managing Virtual Networks Configuring and Managing
Managing internet security
Managing internet security GOOD PRACTICE GUIDE Contents About internet security 2 What are the key components of an internet system? 3 Assessing internet security 4 Internet security check list 5 Further
Attaining HIPAA Compliance with Retina Vulnerability Assessment Technology
l Attaining HIPAA Compliance with Retina Vulnerability Assessment Technology Overview The final privacy rules for securing electronic health care became effective April 14th, 2003. These regulations require
March 2012 www.tufin.com
SecureTrack Supporting Compliance with PCI DSS 2.0 March 2012 www.tufin.com Table of Contents Introduction... 3 The Importance of Network Security Operations... 3 Supporting PCI DSS with Automated Solutions...
Using Windows Update for Windows Me
Using Windows Update for Windows Me Contents Introduction... 1 Before You Begin... 2 Downloading and Installing the Windows Update Components... 2 Maintaining a Secure Computing Environment... 6 Introduction
SPECIFIC TERMS AND CONDITIONS ON THE RENTAL OF A KS (KIMSUFI) DEDICATED SERVER
SPECIFIC TERMS AND CONDITIONS ON THE RENTAL OF A KS (KIMSUFI) DEDICATED SERVER Latest Version on September 2nd 2014 SECTION 1: PURPOSE The purpose of these Specific Terms and Conditions, which are complementary
MSP Service Matrix. Servers
Servers MSP Service Matrix Microsoft Windows O/S Patching - Patches automatically updated on a regular basis to the customer's servers and desktops. MS Baseline Analyzer and MS WSUS Server used Server
IT Security Incident Management Policies and Practices
IT Security Incident Management Policies and Practices Information Technology Services Center (ITSC) of The Hong Kong University of Science and Technology Date: Feb 6, 2015 i Document Control Document
SPECIFIC TERMS AND CONDITIONS ON THE RENTAL OF A DEDICATED SERVER
SPECIFIC TERMS AND CONDITIONS ON THE RENTAL OF A DEDICATED SERVER Latest Version on May 22nd 2014 SECTION 1: PURPOSE The purpose of these Specific Terms and Conditions, which are complementary to OVH s
CITY OF BOULDER *** POLICIES AND PROCEDURES
CITY OF BOULDER *** POLICIES AND PROCEDURES CONNECTED PARTNER EFFECTIVE DATE: SECURITY POLICY LAST REVISED: 12/2006 CHRISS PUCCIO, CITY IT DIRECTOR CONNECTED PARTNER SECURITY POLICY PAGE 1 OF 9 Table of
Third Party Identity Services Assurance Framework. Information Security Registered Assessors Program Guide
Third Party Identity Services Assurance Framework Information Security Registered Assessors Program Guide Version 2.0 December 2015 Digital Transformation Office Commonwealth of Australia 2015 This work
NIST National Institute of Standards and Technology
NIST National Institute of Standards and Technology Lets look at SP800-30 Risk Management Guide for Information Technology Systems (September 2012) What follows are the NIST SP800-30 slides, which are
Staying Secure After Microsoft Windows Server 2003 Reaches End of Life. Trevor Richmond, Sales Engineer Trend Micro
Staying Secure After Microsoft Windows Server 2003 Reaches End of Life Trevor Richmond, Sales Engineer Trend Micro Windows Server 2003 End of Life- Why Care? The next big vulnerability (Heartbleed/Shellshock)
TECHNICAL VULNERABILITY & PATCH MANAGEMENT
INFORMATION SECURITY POLICY TECHNICAL VULNERABILITY & PATCH MANAGEMENT ISO 27002 12.6.1 Author: Owner: Organisation: Document No: Chris Stone Ruskwig TruePersona Ltd SP-12.6.1 Version No: 1.1 Date: 1 st
Page 1 of 15. VISC Third Party Guideline
Page 1 of 15 VISC Third Party Guideline REVISION CONTROL Document Title: Author: File Reference: VISC Third Party Guidelines Andru Luvisi CSU Information Security Managing Third Parties policy Revision
HP ProLiant Essentials Vulnerability and Patch Management Pack Planning Guide
HP ProLiant Essentials Vulnerability and Patch Management Pack Planning Guide Product overview... 3 Vulnerability scanning components... 3 Vulnerability fix and patch components... 3 Checklist... 4 Pre-installation
North American Electric Reliability Corporation (NERC) Cyber Security Standard
North American Electric Reliability Corporation (NERC) Cyber Security Standard Symantec Managed Security Services Support for CIP Compliance Overviewview The North American Electric Reliability Corporation
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) August, 2013 Revision 8.0 MICROS Systems, Inc. Version 8.
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) Revision 8.0 August, 2013 1 Table of Contents Overview /Standards: I. Information Security Policy/Standards Preface...5 I.1 Purpose....5
Appendix 10 IT Security Implementation Guide. For. Information Management and Communication Support (IMCS)
Appendix 10 IT Security Implementation Guide For Information Management and Communication Support (IMCS) 10.1 Security Awareness Training As defined in NPR 2810.1A, all contractor personnel with access
IT Security Standard: Computing Devices
IT Security Standard: Computing Devices Revision History: Date By Action Pages 09/30/10 ITS Release of New Document Initial Draft Review Frequency: Annually Responsible Office: ITS Responsible Officer:
Patch Management Reference
www.novell.com/documentation Patch Management Reference ZENworks 11 SP3 February 2014 Legal Notices Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation,
ACTING VICE PRESIDENT, INFORMATION TECHNOLOGY. Michael L. Thompson Acting Deputy Assistant Inspector General for Technology, Investment and Cost
July 14, 2015 MEMORANDUM FOR: JUDITH A. ADAMS ACTING VICE PRESIDENT, INFORMATION TECHNOLOGY FROM: SUBJECT: Michael L. Thompson Acting Deputy Assistant Inspector General for Technology, Investment and Cost
Database Security Guideline. Version 2.0 February 1, 2009 Database Security Consortium Security Guideline WG
Database Security Guideline Version 2.0 February 1, 2009 Database Security Consortium Security Guideline WG Table of Contents Chapter 1 Introduction... 4 1.1 Objective... 4 1.2 Prerequisites of this Guideline...
Office of Inspector General
DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Security Weaknesses Increase Risks to Critical United States Secret Service Database (Redacted) Notice: The Department of Homeland Security,
Miami University. Payment Card Data Security Policy
Miami University Payment Card Data Security Policy IT Policy IT Standard IT Guideline IT Procedure IT Informative Issued by: IT Services SCOPE: This policy covers all units within Miami University that
Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1
Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A
Customer Support Policy
Customer Support Policy This Customer Support Policy ( Policy ) describes the Support that Invenias provides to Customers that have paid all applicable fees and that are using Licensed Software in a Supported
Department of Information Technology Active Directory Audit Final Report. August 2008. promoting efficient & effective local government
Department of Information Technology Active Directory Audit Final Report August 2008 promoting efficient & effective local government Executive Summary Active Directory (AD) is a directory service by Microsoft
Lot 1 Service Specification MANAGED SECURITY SERVICES
Lot 1 Service Specification MANAGED SECURITY SERVICES Fujitsu Services Limited, 2013 OVERVIEW OF FUJITSU MANAGED SECURITY SERVICES Fujitsu delivers a comprehensive range of information security services
STATE OF NEW JERSEY IT CIRCULAR
NJ Office of Information Technology P.O. Box 212 www.nj.gov/it/ps/ Chris Christie, Governor 300 River View E. Steven Emanuel, Chief Information Officer Trenton, NJ 08625-0212 STATE OF NEW JERSEY IT CIRCULAR
Information Security Program Management Standard
State of California California Information Security Office Information Security Program Management Standard SIMM 5305-A September 2013 REVISION HISTORY REVISION DATE OF RELEASE OWNER SUMMARY OF CHANGES
A Decision Maker s Guide to Securing an IT Infrastructure
A Decision Maker s Guide to Securing an IT Infrastructure A Rackspace White Paper Spring 2010 Summary With so many malicious attacks taking place now, securing an IT infrastructure is vital. The purpose
DIVISION OF INFORMATION SECURITY (DIS)
DIVISION OF INFORMATION SECURITY (DIS) Information Security Policy Information Systems Acquisitions, Development, and Maintenance v1.0 October 15, 2013 Revision History Update this table every time a new
CIP-010-2 Cyber Security Configuration Change Management and Vulnerability Assessments
CIP-010-2 Cyber Security Configuration Change Management and Vulnerability Assessments A. Introduction 1. Title: Cyber Security Configuration Change Management and Vulnerability Assessments 2. Number:
Hardware and Asset Management Program
Hardware and Asset Management Program Program Overview & Acceptable Use Policy An Asset Management Tool (AMT) is a tool for managing user computers such as desktops and laptops. Its main use is for installing
Threat Management: Incident Handling. Incident Response Plan
In order to meet the requirements of VCCS Security Standards 13.1 Reporting Information Security Events, and 13.2 Management of Information Security Incidents, SVCC drafted an (IRP). Incident handling
05.0 Application Development
Number 5.0 Policy Owner Information Security and Technology Policy Application Development Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 5. Application Development
NYSED DATA DASHBOARD SOLUTIONS RFP ATTACHMENT 6.4 MAINTENANCE AND SUPPORT SERVICES
NYSED DATA DASHBOARD SOLUTIONS RFP ATTACHMENT 6.4 MAINTENANCE AND SUPPORT SERVICES 1. Definitions. The definitions below shall apply to this Schedule. All capitalized terms not otherwise defined herein
Title: Data Security Policy Code: 1-100-200 Date: 11-6-08rev Approved: WPL INTRODUCTION
Title: Data Security Policy Code: 1-100-200 Date: 11-6-08rev Approved: WPL INTRODUCTION The purpose of this policy is to outline essential roles and responsibilities within the University community for
Version: 2.0. Effective From: 28/11/2014
Policy No: OP58 Version: 2.0 Name of Policy: Anti Virus Policy Effective From: 28/11/2014 Date Ratified 17/09/2014 Ratified Health Informatics Assurance Committee Review Date 01/09/2016 Sponsor Director
UNCLASSIFIED. http://www.govcertuk.gov.uk. General Enquiries. Incidents incidents@govcertuk.gov.uk Incidents incidents@govcertuk.gsi.gov.uk.
Version 1.2 19-June-2013 GUIDELINES Incident Response Guidelines Executive Summary Government Departments have a responsibility to report computer incidents under the terms laid out in the SPF, issued
V ISA SECURITY ALERT 13 November 2015
V ISA SECURITY ALERT 13 November 2015 U P DATE - CYBERCRIMINALS TARGE TING POINT OF SALE INTEGRATORS Distribution: Value-Added POS Resellers, Merchant Service Providers, Point of Sale Providers, Acquirers,
Acceptable Usage Policy
Contents 1. INTRODUCTION... 2 2. PURPOSE... 2 3. APPLICATION... 2 4. YOUR OBLIGATIONS AND PROHIBITED USE... 2 5. SPAM... 3 6. EXCESSIVE USE... 3 7. SECURITY... 4 8. COPYRIGHT... 4 9. CONTENT... 4 10. REGULARTORY