TTUHSC IT Policies
1.4.18 SERVER HARDENING
Standard/Procedure
A server cannot be connected to the TTUHSC network until it is in a TTUHSC I.T. approved secure state. Prior to connecting the server to the network, the following must be performed:
- Install the operating system from an I.T. approved source which includes proper licenses,
- Receive a reserved IP address from the appropriate regional campus network administrator,
- Remove all unnecessary software, system services, and drivers,
- Set appropriate security parameters, file protections, and enable audit logging,
- Disable or change the password of default accounts, and
- Complete a Server Registration Form (http://www.ttuhsc.edu/it/forms/serverregistration.aspx) and submit it to its@ttuhsc.edu.
Immediately after connection to the network, the following must be completed:
- Install I.T. approved anti-virus software, and
- Apply the latest vendor supplied patches, which have been tested for compatibility with the production environment.
Note: For more detailed information and procedures based on specific operating system, please refer to Guidelines For Operating Systems Security at http://www.ttuhsc.edu/it/policy/ossecurity.aspx.
All servers are required to pass a vulnerability assessment performed by the TTUHSC ITS prior to use. Administrators are required to correct all network/operating system vulnerabilities identified as high or medium risk during the vulnerability assessment. Examples of high and medium risk vulnerabilities are:
- Accounts with blank or weak passwords
- Outdated version or patch levels of server software and services
TTUHSC ITS will monitor security issues, both internal and external to TTUHSC, and will monitor the release of security patches on behalf of TTUHSC. After the server administrator is notified by the ITS, patches must be implemented within a specified timeframe determined by the security level of the patch, or the risk level of the vulnerability. ITS will routinely monitor to ensure the system(s) are in compliance. Failure to comply with these guidelines can result in the server(s) being removed from the network.
Patches are classified as follows:
- Critical Updates - These include updates or hotfixes for the operating system and mission critical applications. These fixes address security vulnerabilities and system stability problems.
- Virus updates - Anti-virus vendors supply updates/signatures to protect against the latest viruses. In order to provide maximum protection, all servers should receive regular anti-virus updates and upgrades.
- Applications/Program patches - This includes updates for specific applications that could affect the overall security of the server.
TTUHSC I.T. will perform due diligence in testing security patches before release when practical.