{"id":113680,"date":"2018-04-10T15:51:55","date_gmt":"2018-04-10T19:51:55","guid":{"rendered":"https:\/\/www.bu.edu\/tech\/?page_id=113680"},"modified":"2022-12-19T09:52:03","modified_gmt":"2022-12-19T14:52:03","slug":"vulnerability-management-policy","status":"publish","type":"page","link":"https:\/\/www.bu.edu\/tech\/about\/policies\/vulnerability-management-policy\/","title":{"rendered":"Vulnerability Management Policy"},"content":{"rendered":"

Vulnerability Management Policy<\/h1>\n

Approved by Tracy Schroeder, Vice President of Information Services & Technology, April 9th<\/sup>, 2018. Last reviewed by the Vulnerability Advisory Board, December 15,2022.<\/span><\/span>\u00a0<\/span><\/p>\n

<\/a>Purpose and Scope<\/h2>\n

Information Security (InfoSec) is charged with helping to protect the University\u2019s electronic information. To do so, InfoSec conducts regular scans of the entire enterprise looking for misconfigured and\/or unsecured electronic devices. InfoSec then works with IS&T, IT Partners, and other units, to verify and remediate discovered vulnerabilities, especially when a new threat has been discovered.<\/span>\u00a0<\/span><\/p>\n

The policy applies to all IS&T managed systems.\u00a0 All non-IS&T IT organizations at the university are strongly encouraged to adopt this policy as well.<\/span>\u00a0<\/span><\/p>\n

<\/a>Baseline expectations<\/h2>\n

Per University Policy <\/span>Minimum Security Standards<\/span><\/a> systems are expected to be running currently supported operating systems, patched, and maintained regularly.\u00a0<\/span>\u00a0<\/span><\/p>\n

In compliance with that policy, individuals responsible for systems connected to the University network are expected to allocate or obtain resources to remediate issues identified by the vulnerability scans that are not otherwise being addressed by regular patching.\u00a0<\/span><\/p>\n

<\/a>Program Management<\/h2>\n

Vulnerability <\/span>Management is a <\/span>Service Component <\/span>of <\/span>the <\/span>Server Security <\/span>Services <\/span>Client Service<\/span>.\u00a0 The Director <\/span>of Information Security is the S<\/span>ervice <\/span>O<\/span>wner <\/span>and <\/span>is <\/span>responsible for the oversight of this <\/span>program.<\/span>\u00a0 <\/span>The Director <\/span>shall <\/span>appoint a Service Component Manager, who also serves as the Vulnerability Manager under this policy.<\/span><\/span><\/p>\n

<\/a>Technology<\/h3>\n

Vulnerability management tools evaluate patch levels<\/span> and apply patches<\/span>, <\/span>scan for and fix <\/span>configuration weaknesses, and identify software vulnerabilities on electronic devices and the software applications running on them. <\/span>Common vulnerability management tools consist of patch management tools, vulnerability scanners, and reporting and validation tools.<\/span> Vulnerability scanning tools <\/span>work by performing <\/span>authenticated and unauthenticated <\/span>checks.\u00a0 <\/span>Authenticated <\/span>checks are required as they are significantly more accurate.\u00a0<\/span><\/p>\n

Authentication Requirements for Scanning<\/h4>\n

Scanning <\/span>technologies work best by performing checks<\/span> directly on the systems.\u00a0 A <\/span>service account<\/span> or equivalent<\/span> with <\/span>appropriate <\/span>privileges <\/span>is <\/span>need<\/span>ed<\/span> <\/span>for<\/span> these tools to work effectively.<\/span>\u00a0 The <\/span>Vulnerability <\/span>Manager shall supply documentation on how to configure the needed <\/span>privileges<\/span>.<\/span>\u00a0<\/span><\/span><\/p>\n

<\/a>Process<\/h3>\n

The Director of Information Security shall charter a Vulnerability Advisory Board (VAB), led by the Vulnerability Manager and consisting of members as detailed in the VAB charter.\u00a0<\/span>\u00a0<\/span><\/p>\n

The VAB meets regularly to review and evaluate patch and vulnerability scan data, assign priorities to vulnerabilities, and determine what remediation projects will be assigned and executed for the upcoming days\/month(s).\u00a0 Emergency VAB meetings will take place on an as needed basis to deal with urgent threats.<\/span>\u00a0<\/span><\/p>\n

The VAB creates and assigns remediation projects, reports on progress in remediating vulnerabilities, escalates issues and risks relating to non-remediated vulnerabilities, and authorizes Systems Administration to assign patch and reboot schedules on behalf of unresponsive system owners.<\/span>\u00a0<\/span><\/p>\n

<\/a>Remediation Target Priorities<\/h3>\n

The following table defines how remediation priorities will be assigned and the target resolution timeframe for vulnerabilities in each priority <\/span>rank<\/span>.\u00a0 The use of \u201cdays\u201d versus \u201cbusiness days\u201d in expressing times is significant \u2013 not all vulnerabilities can wait until the start of the next business day.<\/span><\/span>\u00a0<\/span><\/p>\n\n\n\n\n\n\n\n
Priority Rank<\/u><\/strong><\/td>\nDefinition<\/u><\/strong><\/td>\nInitial Assignment<\/u><\/strong><\/td>\nTarget Resolution<\/u><\/strong><\/td>\n<\/tr>\n
P1<\/strong><\/td>\nVulnerability that is remotely exploitable with no compensating controls<\/td>\n1 day<\/td>\n2 days<\/td>\n<\/tr>\n
P2<\/strong><\/td>\nVulnerability that is remotely exploitable with compensating controls<\/td>\n2 business days<\/td>\n1 week<\/td>\n<\/tr>\n
P3<\/strong><\/td>\nVulnerability that is not remotely exploitable<\/td>\nroutine patching<\/td>\n45-60 days<\/td>\n<\/tr>\n
P4<\/strong><\/td>\nVulnerability that cannot immediately be exploited.<\/td>\nroutine patching<\/td>\n90 days<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

It may be necessary to further prioritize hosts within <\/span>the<\/span> priority <\/span>rankings above<\/span>. \u00a0Hosts should be prioritized according to Data Classification with hosts containing Restricted Use data remediated first. \u00a0<\/span>Note that some c<\/span>ompliance <\/span>requirements like PCI <\/span>might dictate shorter resolution time frames. <\/span>Once Restricted Use systems are secured the remainder should be remediated according to risk, considering the impact of a breach and the likelihood of compromise. \u00a0The use of private network <\/span>a<\/span>ddressing,<\/span> and other compensating controls <\/span>may<\/span> be used to prioritize the list. \u00a0 The VAB may provide additional guidance on a case-by-case basis.<\/span><\/span>\u00a0<\/span><\/p>\n

<\/a>Exemptions from the Scanning Process<\/h3>\n

Vulnerability management scanning is an essential practice for a secure organization and the goal is to have 100% participation.\u00a0 If participation creates issues for a system, the system owner or administrator shall work directly with Information Security and\/or the VAB to review possible options.\u00a0 Those options might include disabling a specific vulnerability check that may be causing an issue.\u00a0 An approach that solves the specific problem will be preferred over a general exemption as more general exemptions may cause critical vulnerabilities to be missed.\u00a0<\/span>\u00a0<\/span><\/p>\n

Exemptions from vulnerability scanning for an entire system will be granted only after a Risk Acceptance Form has been signed by the head of the unit and submitted to Information<\/span> Security to obtain approval from the Vice President of IS&T or an assigned designee. <\/span>\u00a0<\/span><\/p>\n

Note: Private network and\/or departmental or host-based firewall rules are generally not considered sufficient compensating controls because these rules are often disabled and\/or removed for troubleshooting purposes which would leave these systems open to attack.<\/span>\u00a0<\/span><\/p>\n

<\/a>Authority<\/h2>\n

University Policy <\/span><\/span>Minimum Security<\/span> <\/span>Standards<\/span><\/span><\/a> <\/span><\/span>states, that “systems should be routinely scanned for vulnerabilities and discovered vulnerabilities should be remediated swiftly.” <\/span>I<\/span>n accordance with the\u00a0<\/span> <\/span><\/span>Cybersecurity Training, Compliance, a<\/span>n<\/span>d<\/span> Remediation<\/span><\/span><\/a> policy<\/span><\/span>,<\/span><\/span>\u00a0<\/span><\/span> IS&T will conduct routine scans and audits of computing technologies connected to the university network for vulnerabilities which may indicate a lack of compliance with the <\/span><\/span>Minimum Secu<\/span>r<\/span>ity Standards<\/span><\/span><\/a>.<\/span><\/span>\u00a0<\/span><\/p>\n

<\/a>References<\/span><\/h3>\n

Vulnerability Management Service Page<\/span><\/a>\u00a0<\/span><\/p>\n

Minimum Security Standards<\/span><\/a>\u00a0<\/span><\/p>\n

Cybersecurity Training, Compliance, and Remediation<\/span><\/a>\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Vulnerability Management Policy Approved by Tracy Schroeder, Vice President of Information Services & Technology, April 9th, 2018. Last reviewed by the Vulnerability Advisory Board, December 15,2022.\u00a0 Purpose and Scope Information Security (InfoSec) is charged with helping to protect the University\u2019s electronic information. To do so, InfoSec conducts regular scans of the entire enterprise looking for…<\/p>\n","protected":false},"author":13352,"featured_media":0,"parent":21310,"menu_order":1,"comment_status":"closed","ping_status":"closed","template":"","meta":[],"_links":{"self":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/113680"}],"collection":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/users\/13352"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/comments?post=113680"}],"version-history":[{"count":10,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/113680\/revisions"}],"predecessor-version":[{"id":143073,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/113680\/revisions\/143073"}],"up":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/21310"}],"wp:attachment":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/media?parent=113680"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}