Vulnerability Management Standard
1. Introduction
This standard establishes information security vulnerability management activities at the Rochester Institute of Technology (RIT). Vulnerability management activities are a critical component of RIT’s information security program. The purpose of this standard is to establish a framework for the systematic identification and remediation of vulnerabilities in RIT Information Assets. The primary audience for this standard is system owners and administrators.
2. Scope
This standard defines requirements for managing vulnerabilities on university information resources, helping to safeguard RIT information assets through systematic identification, assessment, and mitigation of security risks.
What does the Standard apply to?
This standard applies to:
-
All RIT-owned or leased systems.
-
All systems that handle, process, or store RIT data, regardless of their physical location or the network connection method used to access RIT resources.
-
Other systems not owned by RIT, including personally owned, grant-funded, or vendor-managed systems that access or interact with RIT-owned or managed Information Assets.
3. Vulnerability Scanning
Vulnerability scanning is a critical security measure, performed both as an automated and on-demand task, to identify software vulnerabilities, missing patches, and improper configurations on information resources (collectively referred to as "vulnerabilities" in this standard). Attackers will often test a system's defenses for weaknesses. Once a weakness is found, it can be exploited to take control of the system. Our network vulnerability scanning is designed to find these weaknesses, or "vulnerabilities" before they are discovered.
Automated, routine scanning of RIT-owned and leased systems, combined with manual scans and ad hoc assessments, enable RIT to proactively address security risks and meet information security compliance requirements, thus protecting RIT’s Information Assets and data from damage or loss.
The Information Security Policy (C08.1) requires RIT to conduct routine and ad hoc scans on systems, applications, and devices connected to RIT networks. Vulnerability scanning technologies assess devices/systems risks. Continuous vulnerability scanning of RIT Information Assets is managed by the Information Security Office (ISO) to ensure up-to-date insights on potential vulnerabilities.
Individuals responsible for managing these devices/systems must not interfere with, block, or limit access to the vulnerability scanning tools or their assessments.
The ISO will provide scan results, including prioritized vulnerability findings, to system owners and administrators for review, remediation, and mitigation. System owners and administrators may also request or conduct additional on-demand vulnerability scans in response to significant system changes or other circumstances that might impact the security posture. RIT system owners are responsible for ensuring that vendors remediate vulnerabilities on vendor-managed systems.
Vulnerability severity is determined by the rating provided by the National Institute of Standards and Technology (NIST) using the Common Vulnerability Scoring System (CVSS). Remediation and mitigation of identified vulnerabilities is prioritized based on the degree of associated severity and the impact on the confidentiality, integrity, or availability of the vulnerable Information Assets.
4. Vulnerabilities Identified outside of RIT Vulnerability Scanning Processes
Vulnerabilities may be identified internally by RIT or externally by third parties or RIT-contracted services. While the university's internal scanning processes described above are a critical component of identifying vulnerabilities within our environment, not all vulnerabilities can be detected through these means. Some vulnerabilities are discovered externally by third parties, including researchers, vendors, or security organizations.
When such vulnerabilities are disclosed, the Information Security Office (ISO) assesses whether they are applicable to the university's assets and systems. This requires collaboration among relevant IT personnel to identify any exposure to the reported vulnerabilities. Once identified, these vulnerabilities are addressed by the appropriate systems administrators following the remediation timelines and prioritization levels outlined in this standard. This vulnerability management approach ensures that emerging threats are managed effectively, reducing the risk to the university’s information systems and data.
5. Vulnerability Remediation
All IT system owners and administrators are provided access to and are asked to regularly review the results of vulnerability scans completed by the ISO for systems for which they are responsible; and evaluate, test, remediate, and mitigate identified vulnerabilities as appropriate.
-
Remediation activities include, but are not limited to, testing and applying patches or system updates when they are available, and correcting configuration errors.
-
Mitigation activities include, but are not limited to, implementing controls to minimize the impact of a vulnerability when a patch or system update is unavailable.
The timeframes for remediating vulnerabilities based on their assigned CVSS scores are defined in the RIT Vulnerability Management Plan. This document outlines specific remediation expectations and provides the current version of the CVSS scoring system used by our office to assess and prioritize vulnerabilities. This plan is regularly updated and serves as the authoritative source for our remediation requirements.
7. Exceptions
If unable to meet remediation expectations, engage the Standards Exception Process and consult with the Information Security Office.