Member’s with No IT Staff Member’s With IT Staff Have the local support contractor demonstrate how they Server and Workstation images should be stored near meet this control and document the process in the service the production site in a secure logical and physical level agreement. location. Images should be included in the backup strategy with the backup media stored off-site in a secure location with significant regional separation. Server and Workstation images should be stored at the Disaster Recovery documentation must be provided member site, not at the local vendor site. Images should that details how to use these images for recovery of be included in the backup strategy with the backup media servers or workstations. stored off-site in a secure location Disaster Recovery documentation must be provided that Implement ITL based change control procedures for details how to use these images for recovery of servers or image masters and changes to servers. Approved workstations. This is similar to new device build checklist changes to servers, including patch management, but not the same. should be performed on image masters. Implement integrity checking tools to ensure the approved image has not been altered before it is used. Consult the SANS Vendor Solutions link above for vendor products that perform this control. Control No. 3 – Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers – Quick Win No. 5 3.5 Run the last version of software and make sure it is fully patched. Remove outdated or older software from the system. 3.5 - Recommendations: Recommended Products or Services Member’s with No IT Staff Member’s With IT Staff This control requires that software be kept current – e.g. This control requires that software be kept current – the last version. And it requires that the software be e.g. the last version. And it requires that the software patched. This includes all software, not just the operating be patched. This includes all software, not just the system, that is on a master image. operating system, that is on a master image. The local support vendor should be retained to perform Use products discussed earlier for patch management routine maintenance that includes software update and and vulnerability management tools to make sure patching. servers, workstations, and image masters are kept current.
Member’s with No IT Staff Member’s With IT Staff Have the local support contractor demonstrate how they meet this control and document the process in the service level agreement. Server and Workstation images should be stored near the production site in a secure logical and physical location. Images should be included in the backup strategy with the backup media stored off-site in a secure location with significant regional separation. Server and Workstation images should be stored at the member site, not at the local vendor site. Images should be included in the backup strategy with the backup media stored off-site in a secure location Disaster Recovery documentation must be provided that details how to use these images for recovery of servers or workstations. Disaster Recovery documentation must be provided that details how to use these images for recovery of servers or workstations. This is similar to new device build checklist but not the same. Implement ITL based change control procedures for image masters and changes to servers. Approved changes to servers, including patch management, should be performed on image masters. Implement integrity checking tools to ensure the approved image has not been altered before it is used. Consult the SANS Vendor Solutions link above for vendor products that perform this control. Control No. 3 – Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers – Quick Win No. 5 3.5 Run the last version of software and make sure it is fully patched. Remove outdated or older software from the system. 3.5 - Recommendations: Recommended Products or Services Member’s with No IT Staff Member’s With IT Staff This control requires that software be kept current – e.g. the last version. And it requires that the software be patched. This includes all software, not just the operating system, that is on a master image. This control requires that software be kept current – e.g. the last version. And it requires that the software be patched. This includes all software, not just the operating system, that is on a master image. The local support vendor should be retained to perform routine maintenance that includes software update and patching. Use products discussed earlier for patch management and vulnerability management tools to make sure servers, workstations, and image masters are kept current.
3b-cyberrm-5-wcia-prioritizedsans20controls1.docx