University of Kansas Medical Center Operational Protocol: Vulnerability Management

The University of Kansas Medical Center recognizes that the regular application of vendor-supplied security patches is a critical component in protecting the University network, systems and data from damage or loss due to threats such as worms, viruses and directed attacks.

Purpose
The purpose of this policy is to define the requirements for notification, testing and installation of security-related patches. While important to the correct functionality of a software application or system, those patches that are not security-related are not covered by this policy.

Individuals and Groups Covered By This Policy
Applies to all electronic devices connected to the University network including but not limited to computer workstations and servers, network switches and routers, specialized medical devices, etc.

Definitions

Remediated: corrected a fault or deficiency.  An action taken to remediate a security vulnerability could include applying a vendor's patch, applying additional security controls, or changing a system's configuration to one that is no longer vulnerable.

Vulnerabiliity: A security risk or weakness which can be exploited to allow an attacker to compromise the security of a system.

Exemptions

This policy applies to everyone at all campuses and sites of the University of Kansas Medical Center. There are no exemptions.

Responsibilities

System and application administrators are responsible for assessment and application of security patches that impact systems under their management and supervision.

Information Security will monitor vendor and third-party sources for updated vulnerability information daily and distribute pertinent patch information to the appropriate application and system owners in each business unit.  Additionally, Information Security will utilize automated scanning tools to identify vulnerabilities or configuration issues weekly on all devices connected to the KUMC network.

I. Requirements for Vulnerability Remediation

• Information Security will classify identified vulnerabilities according to the following severity levels:
  
  Critical: A "critical" classification applies to broad threats to the entire campus or remotely exploitable vulnerabilities through which an intruder can easily gain control of numerous systems, compromise one or more systems containing sensitive information, or cause wide-spread service interruption.  Vulnerabilities assigned a rating of "critical" must be remediated within 24 hours.
  
  High: A "high" classification applies to vulnerabilities through which an intruder can gain control of one or more systems.  This includes local exploits where the risk of compromise is not as urgent as a critical vulnerability.  Vulnerabilities assigned a rating of "high" must be remediated within 14 days.
  
  Medium:
 A "medium" classification applies to vulnerabilities that may allow an intruder to gain access to information stored on a host.  Vulnerabilities assigned a rating of "medium" must be remediated within 30 days.

Low: A "low" classification applies to vulnerabilities that do not pose an immediate threats to KUMC systems.  Vulnerabilities assigned a rating of "low" must be remediated within 90 days.


• System administrators must apply required patches to all applicable KUMC-owned or managed devices or complete other remediation actions within the timeframe associated with the vulnerability's severity level.
• In a situation where a patch cannot be installed due to incompatibility with a system or other software application, the application or system owner must request an exception within the same timeframe.

II. Additional Recommendations

• System administrators should install patches on a non-production system, if available, to verify that the security patch will not adversely impact system functionality.
• If a non-production testing system is not available, system administrators must take appropriate measures to verify the patch's correct functionality after being installed into production.
• When available, it is recommended that system administrators utilize tools such as Windows Security Update Services or LANDesk to automate the consistent installation of security patches. System and application owners are encouraged to contact Information Security to utilize available patch automation services.

Exceptions

Requests for exceptions to this Policy may be granted for security patches that compromise the usability of an application or computer system and where other security measures (e.g., network filtering, firewall, etc.) are in place to mitigate risk. Any requests must be submitted in writing to the Director of Information Security for approval. The KUMC Information Security Exception Form is available for this purpose.

Exceptions will be permitted only on receipt of written approval from Information Security. Information Security will retain documentation of currently permitted exceptions and will review them on an annual basis.

Enforcement

Suspected or known violations of this policy will be reported to the appropriate University officials, and may result in:

• Removal of non-compliant systems from the University's network
• Accountability for conduct under any applicable University or campus policies, procedures, or collective bargaining agreements, including disciplinary action.
• Prosecution under applicable statutes.

Suspected or known violations of University regulations and/or State and Federal law will be processed by the appropriate University authorities and/or law enforcement agencies.

Contact information

For information on this policy, please contact:

Sherry Callahan
Director of Information Security
Department of Information Resources
University of Kansas Medical Center
1020 Taylor, 3901 Rainbow Blvd
Kansas City, Kansas 66160
(913) 588-0966

Steffani Webb
Associate Vice Chancellor for Information Resources
Chief Information Officer (Interim)
University of Kansas Medical Center
1018 Taylor, 3901 Rainbow Blvd
Kansas City, Kansas 66160
(913) 588-7300

Last Review Date: March 13, 2011
Last Revision Date: March 13, 2011