SERVERS AND APPLICATIONS
| Type: | Standard |
| Last Updated: | December 27, 2023 |
| Sponsor: | Scott Hunt, Assistant Vice President, OIT |
| Owner: | Jeremy Young, Pillar Director Foundational Solutions, OIT |
| Custodian: | Mary Stevens, IT Governance, OIT |
| Version: | 1.0 |
PURPOSE
Protect university systems, data, and resources by addressing identified risks to the integrity of systems and applications.
SCOPE
These standards apply to all university owned devices and information systems. They extend to all university departments, employees, students, partners, consultants, and vendors.
POLICY BASIS
These standards support the Appropriate Use of Information Technology Resources Policy and the Data Use, Privacy, and Security Policy.
REQUIREMENTS
End of Life
- Only install and use actively patched and supported vendor Operating Systems.
- Any Operating System identified as End-of-Life must be upgraded.
- Major vendor operating systems include:
- Microsoft Windows
- Linux (Red Hat, Ubuntu) with the latest distribution or distribution marked “Long-Term Support (LTS).”
Patch Operating Systems
- Patch vendor-supported Operating Systems regularly.
- Plan for retirement, replacement, or rehosting of servers and other systems before reaching end-of-life status with the corresponding vendor.
Application Software
- Patch application software regularly.
- Plan for retirement, replacement, rehosting, or refactoring of applications and application software before reaching end-of-life status with the corresponding vendor.
Endpoint Protection Software
- CrowdStrike Falcon is the required endpoint protection platform for BYU and CES.
- Do not disable or uninstall Falcon unless specifically directed by the CES Security Operations Center.
- If Falcon conflicts with other anti-virus software, remove the other anti-virus products.
Note: The Falcon client does not need to be installed on tablets and mobile devices.
Centralized Log Management
- Log records are to be in a single location which is secure for storage.
- 120 day retention is the target.
Backup and Restore
- Create a copy of confidential and sensitive data and save in case data is lost, compromised, or corrupted.
- Backup is used to restore data to a previous point in time.
GUIDELINES
- Plan for retirement, replacement, or rehosting end-of-life systems and applications.
- Establish centralized log management.
- Prioritize patching efforts to address highest risk systems and applications first.
- Manage vulnerabilities.
- Subscribe to vulnerability notification service.
ROLES & RESPONSIBILITIES
CSRs, System and Application Owners: Patch Operating Systems regularly, plan for retirement, replacement, or rehosting, manage vulnerabilities, keep centrally managed logs for at least 120 days.
CES Security Operations Center: Direct when Falcon may be disabled or uninstalled and receive known or suspected breaches of data or compromises of IT Resources. Coordinate the response when systems or applications may be at risk.
COMPLIANCE & ENFORCEMENT
All users of IT Resources must adhere to the IT Standards. Not completing required fixes after notice, disabling or uninstalling Falcon unless specifically directed by the CES Security Operations Center, or not reporting known or suspected breaches of data or compromises of IT Resources may be treated as a serious security violation.
The Appropriate Use of Information Technology Resources Policy states:
The university reserves the right, in its sole discretion and for any reason or no reason, to immediately revoke authorization to access or use any or all IT Resources.
STANDARDS OWNERSHIP & REVIEW
This standard is reviewed every year, or sooner if there is a major change in policy, regulations, or systems.
RELATED RESOURCES
- Servers and Applications | IT Standards Training
IT Standards are developed by subject matter experts and approved by the Information Technology Committee, which consists of the CIO, the CISO, University Vice Presidents and other senior leaders.