860.00  Vulnerability Management 

Purpose

The Salish Kootenai College Vulnerability Management Policy establishes the rules for the review, evaluation, application, and verification of system updates to mitigate vulnerabilities in the IT environment and the risks associated with them.

Audience

The Salish Kootenai College Vulnerability Management Policy applies to individuals responsible for Information Resource management.

1. Policy
   1. Endpoint Protection (Anti-Virus & Malware)
      1. All Salish Kootenai College owned and/or managed Information Resources must use the Salish Kootenai College IT management-approved endpoint protection software and configuration.
      2. All non-Salish Kootenai College-owned workstations and laptops must use Salish Kootenai College IT management-approved endpoint protection software and configuration before any connection to a Salish Kootenai College Information Resource.
      3. The endpoint protection software must not be altered, bypassed, or disabled.
      4. Each email gateway must utilize Salish Kootenai College IT management-approved email virus protection software and adhere to the Salish Kootenai College rules for the setup and use of this software, which includes, but is not limited to, scanning of all inbound and outbound emails.
      5. Controls to prevent or detect the use of known or suspected malicious websites must be implemented.
      6. All files received over networks or from any external storage device must be scanned for malware before use.
      7. Every virus not automatically cleaned by the virus protection software constitutes a security incident and must be reported to Salish Kootenai College IT Services.
   2. Logging & Alerting
      1. Documented baseline configurations for Information Resources must include log settings to record actions that may affect or are relevant to information security.
      2. Event logs must be produced based on the Salish Kootenai College Logging Standard and sent to a central log management solution.
      3. A review of log files must be conducted on an established schedule. This schedule is dependent on how frequently the logs are updated. IT Services will develop and maintain this schedule.
      4. All exceptions and anomalies identified during the log file reviews must be documented and reviewed.
      5. Salish Kootenai College will use file integrity monitoring or change detection software on logs and critical files to alert personnel to unauthorized modifications.
      6. Log files must be protected from tampering or unauthorized access.
      7. All servers and network equipment must retrieve time information from a single reference time source regularly so that timestamps in logs are consistent.
      8. All log files must be maintained per the Record Retention Schedule.
   3. Patch Management
      1. The Salish Kootenai College IT team is responsible for patch management implementation, operations, and procedures.
      2. All Information Resources must be scanned regularly to identify missing updates.
      3. All missing software updates must be evaluated according to the risk they pose to Salish Kootenai College.
      4. Missing software updates that pose an unacceptable risk to Salish Kootenai College Information Resources must be implemented within a period that is commensurate with the risk as determined by the Salish Kootenai College Vulnerability Management Standard.
      5. Software updates and configuration changes applied to Information Resources must be tested before widespread implementation and must be implemented following the Salish Kootenai College Change Control Policy.
      6. Verification of successful software update deployment will be conducted within a reasonable period as defined in the Salish Kootenai College Vulnerability Management Standard.
   4. Penetration Testing
      1. Penetration testing of the internal network, external network, and hosted applications must be conducted at least annually or after any significant changes to the environment.
      2. Any exploitable vulnerabilities found during a penetration test will be corrected and re-tested to verify the vulnerability was corrected.
   5. Vulnerability Scanning
      1. Vulnerability scans of the internal and external network must be conducted at least quarterly or after any significant change to the network.
      2. Failed vulnerability scan results rated at Critical or High will be remediated and re-scanned until all Critical and High risks are resolved.
      3. Any evidence of a compromised or exploited Information Resource found during vulnerability scanning must be reported to the Salish Kootenai College Information Security Officer and IT Services.
      4. Upon identification of new vulnerability issues, configuration standards will be updated accordingly.

References:

• ISO 27002: 12, 18

History:

Approved 3/17/2023