About this policy
Policy contact:
Date of last update:
May 27, 2020
Policy statement
All systems on the Luddy networks will be scanned for vulnerabilities using the UITS Qualys service at a frequency no longer than monthly. Reports of detected vulnerabilities will be generated and distributed within the ITG for review. All reported vulnerabilities will be addressed and tracked per the procedures section of this policy document.
Exceptions to policy
All reported vulnerabilities that are accepted will be noted in IT Procedure: Qualys Scan Exceptions per the below procedure.
Procedures
The auto-generated, monthly vulnerability reports will be reviewed and detected vulnerabilities will be addressed per the following procedure:
- If the reported vulnerability is a false hit or is of very low risk and highly impractical to resolve, the vulnerability will be accepted. Acceptance involves 1) approval by the area expert (ie. Windows, Mac, or Linux admin), 2) approval of the Luddy Chief Information Privacy and Security Officer, 3) Approval of the Luddy IT Director, and 4) addition to IT Procedure: Qualys Scan Exceptions.
- If a high risk vulnerability is detected (Qualys Severity Risk 4 or 5) it will be addressed as follows:
- A footprints ticket will be immediately opened and assigned to the appropriate area team (windows, mac, linux, etc) and the security team. The ticket will be given a priority of high in footprints.
- An entry will be added for the risk to IT Procedure: Qualys Scan Open Issues, noting the assignee and footprints ticket number.
- The issue will be resolved within 2 business days unless coordinated with, and approved by, the Luddy Chief Information Privacy and Security Officer.
- A rescan will be performed to verify the fix.
- The footprints ticket will be closed, noting the action taken to resolve the issue.
- The line item in IT Procedure: Qualys Scan Open Issues will be removed.
- If a lower priority risk is detected (Qualys Severity Risk 1, 2, or 3) it will be addressed as follows:
- An entry will be added for the risk to IT Procedure: Qualys Scan Open Issues, noting the assignee.
- The issues will be resolved within 1 week unless coordinated with, and approved by, the Luddy Chief Information Privacy and Security Officer.
- A rescan will be performed to verify the fix.
- The line item in IT Procedure: Qualys Scan Open Issues will be removed.