Loyola University Chicago

- Navigation -

Loyola University Chicago

Information Technology Services

Vulnerability Assessment Policy

Scope:

This policy covers all of Loyola University Chicago’s computing, networking, telephony and information resources.

Purpose:

The purpose of this policy is to grant authorization to appropriate members of the Information Security Team to conduct audits, consisting of vulnerability assessments and penetration tests, against the University’s computing, networking, telephony and information resources.

Audits may be conducted to:

Policy:

For the purpose of performing an audit, consent to access identified systems will be provided to members of the Information Security Team through the ITS Vulnerability Assessment Authorization Form. Via completion of the form the University hereby provides its consent to allow members of the Information Security Team to access its computing, networking, telephony and information resource devices to the extent necessary to perform the scans authorized in this policy.

This access may include:

The Information Security Team will communicate the details of the vulnerability assessment with the Department Head before scheduling and deploying any assessments.

Periodic Vulnerability Scanning

The Information Security Team will run periodic, internal vulnerability scans at least quarterly. Results of these scans will be addressed in accordance with the risk posed to the University. The Information Security Team will use the Common Vulnerability Scoring System (CVSS) to aid in setting patching guidelines.

Patching Schedule

CVSS Score

Within 30 days

7.0-10.0

Within 120 days

4.0-6.9

In addition to the above patching guidelines, vulnerabilities deemed critical by the Information Security Team must be patched as soon as possible.

Service Degradation and/or Interruption

Network and server performance and/or availability may be affected by network scanning. The University releases the Information Security Team of any and all liability for damages that may arise from network and server availability restrictions caused by approved network scanning.

PCI Environment Requirements

The Information Security Team will run internal and external network vulnerability scans at least quarterly and after any significant change in the network. Results of these scans will be addressed in accordance with the PCI-DSS. Although the University utilizes access controls to prevent the deployment of rogue access points in the PCI-DSS environment, the Network Services Team will use wireless scanners in the University’s cardholder environment on at least a quarterly basis to ensure that rogue wireless networks are not present.  To aid in the identification of non-authorized access points, the Network Services Team will maintain an inventory of authorized wireless access points including a documented business justification for each instance.

Penetration Testing

The information Security Team will run internal and external penetration testing annually on the PCI-DSS environment as well as on a selected rotation of non-PCI applications.  Penetration tests include network-layer penetration tests and application-layer penetration tests.

Automated Monitoring and Alerting

Loyola employs the use of intrusion-prevention systems (IPS).  All traffic at the perimeter of the cardholder data environment as well as at critical points in the cardholder data environment are monitored.  All IPS monitoring points are configured to alert personnel of suspected compromises.  IPS configurations and devices are configured, maintained, and updated per vendor instructions to ensure optimal protection.

Exceptions:

Exceptions to this policy will be handled in accordance with the ITS Security Policy.

Review:

This policy will be maintained in accordance with the ITS Security Policy.

Emergencies:

In emergency cases, actions may be taken by the Incident Response Team in accordance with the procedures in the ITS Incident Response Handbook. These actions may include rendering systems inaccessible.

 

APPENDIX

Documents Referenced

ITS Incident Response Handbook

ITS Security Policy

ITS Vulnerability Assessment Authorization Form

HISTORY

September 30, 2008: Initial Policy
September 18, 2012: Added section for PCI Compliance
June 4, 2014: Annual review for PCI Compliance
August 8, 2014: v1.2 Added section for PCI 3.0 Compliance

Loyola

Information Technology Services
1032 W. Sheridan Ave. · Chicago, IL 60660 · 773.508-4ITS

InfoServices@luc.edu

Notice of Non-discriminatory Policy