DOCUMENT INFORMATION VCSATS Policy Number: VCSATSP 100-030 Title: Policy Owner: Effective Date: 5/1/2013 Revision: 7.0 Vulnerability and Penetration Testing Policy Infrastructure Manager TABLE OF CONTENTS DOCUMENT INFORMATION... 1 TABLE OF CONTENTS... 1 1. PURPOSE... 2 2. SCOPE... 2 3. RESPONSIBILITIES... 2 4. REFERENCES... 2 5. DEFINITIONS... 3 6. POLICY... 3 6.1 Vulnerability Testing... 3 6.2 Penetration Testing... 3 7. ENFORCEMENT... 4 8. COMPLIANCE REFERENCE INDEX... 4 9. HISTORY... 5 Page 1 of 5
1. PURPOSE This policy defines the guidelines for conducting vulnerability testing and penetration testing of systems within the VCSA division 45 C.F.R. 164.304(c)(1). 2. SCOPE This policy applies to Vice Chancellor Student Affairs Technology Services. 3. RESPONSIBILITIES TABLE 1 - ROLES AND RESPONSIBILITIES Role Responsibility Infrastructure Manager Oversee the performance of this process Ensure this document remains current and is updated whenever changes to the process occur Review and approve changes to this document Director Technology Services Review and approve changes to this document 4. REFERENCES TABLE 2 - REFERENCES Reference VCSATSP 100-010 Policy Guidance Location VCSATS Policy Center Page 2 of 5
5. DEFINITIONS The terms and definitions found in VCSATSP 100-010 Policy Guidance, as referenced in section 4 references, shall apply, unless a term is expressly defined here. The scope of every term expressly defined in this section is limited to this document. TABLE 3 - LOCAL DEFINITIONS Term, Abbreviation, Acronym None Definition 6. POLICY Vulnerability testing and penetration testing is required for Restricted systems. Optionally, non-restricted systems may also apply these standards. 6.1 Vulnerability Testing 6.1.1 VCSATS must conduct vulnerability testing on all public-facing systems and Restricted systems with testing of Restricted systems occurring on a regularly scheduled basis PCI DSS 11.2.1 (a). 6.1.2 External Vulnerability Testing (scans) of Restricted systems must be conducted on a regularly scheduled basis PCI DSS 11.2.2 (a). 6.1.3 Upon any configuration change to the system, an internal scan must be performed 11.2.3 (a).. 6.1.4 Failed vulnerability scans must be addressed and followed by a retest, repeating these steps until the vulnerability testing completes successfully 11.2.3 (b). PCI DSS PCI DSS 11.2.1 (b), PCI DSS 11.2.2 (b), PCI DSS 6.1.5 Upon identification of new vulnerability issues, Firewall configuration standards shall be updated accordingly. 6.2 Penetration Testing 6.2.1 External and internal penetration testing shall be performed at least once a year 11.3 (a). 6.2.2 External and internal penetration testing shall be performed after any significant infrastructure or application changes PCI DSS 11.3 (a). 6.2.3 Penetration testing shall minimally consist of network-layer and application-layer penetration tests PCI DSS 11.3.1, PCI DSS 11.3.2. PCI DSS Page 3 of 5
6.2.4 Exploitable vulnerabilities noted during penetration testing shall be corrected and an adequate retest performed to demonstrate that identified exploit is addressed (b) PCI DSS 11.3 7. ENFORCEMENT Any employee found to have violated this policy may be subject to disciplinary action. 8. COMPLIANCE REFERENCE INDEX 45 C.F.R. 164.304(c)(1)... 2 PCI DSS 11.2.1 (a)... 3 PCI DSS 11.2.1 (b)... 3 PCI DSS 11.2.2 (a)... 3 PCI DSS 11.2.2 (b)... 3 PCI DSS 11.2.3 (a)... 3 PCI DSS 11.2.3 (b)... 3 PCI DSS 11.3 (a)... 3 PCI DSS 11.3 (b)... 4 PCI DSS 11.3.1... 3 PCI DSS 11.3.2... 3 Page 4 of 5
9. HISTORY Fogbugz Case Description of Changes 1513 Create initial version of this policy. 2352, 2353 Approval requested for version 1.0 of this policy. Approval was not received. 1513 Updated diagram to version 1.0 which added a swimlane for Approved Scanning Vendor (ASV) 2382, 2383 Requested approvals for version 2.0 of this policy 3209 Updates made in support of UCOP for PnC Hosting project. 3626, 3627 Requested approvals for version 3.0 of this policy (Rejected) 3638 Corrected issues found during approval review. 3658, 3660 Requested approvals for version 4.0 of this policy (Rejected) 3713 Corrected issues found during approval review. 3746, 3747 Requested approvals for version 5.0 of this policy. 4910, 7439 Updated document number to match the approved naming convention. Changed references from critical and PCI to Restricted. Added section 6.4 7634, 7635 Requested approvals for version 6.0 of this policy. 8466, 8660 Added HIPAA references, PCI DSS references, and support for penetration testing. 8902, 8903 Requested approval for version 7.0 of this policy. Page 5 of 5