2022-077-E-IT Dept-PUBLIC LIBRARY ASSOCIATION, a divison of the American Library Association-Digital learning

Browse Search

DocuSign Envelope ID:24BBAFA9-CD81-4144-ACEF-E9036E703739 the scans are reported to the CTO. The CTO will be responsible for ensuring that all identified vulnerabilities are remediated to levels acceptable to the Jende Solutions CISO. • The external assessment will be presented to the Security/IT Steering Committee and Board of Directors to assist in their understanding of threats and hazards for sensitive information and systems. Penetration Testing Methodology Penetration testing allows for the validation of information obtained from vulnerability and web application vulnerability scans. The primary focus of penetration testing it to identify legitimate exploits that could grant an unauthorized user access to the Jende Solutions environment. The groundwork for this test is/will be based on the methodology of Penetration Testing Execution Standard (PTES — www.pentest-standard.org) for systems and network and the Web Application Penetration Testing methodology of OWASP (www.owas.00rg). This is at a high level a four phase process. 1. Phase one— Reconnaissance a. Information gathering via vulnerability assessment tools, port scans and OS fingerprinting. 2. Phase two—Target prioritization a. External—Web or application servers, mail, network, DNS b. Internal—OS patching, database configuration, password security 3. Phase three— Exploitation a. Validating that identified threats can be exploited and capturing sufficient evidence as to allow administrators to effectively implement solutions. 4. Phase four- Re-testing a. Once remediation has been completed, each successfully exploited item must be retested to ensure desired results were achieved. 23. What are the cloud provider's incident management and reporting policies? Information collection, processing, storage and sharing are essential for Jende Solutions to deliver services to its customers. However, that information is also valuable to those who would misuse that data to cause damage to Jende Solutions, or defraud its customers. Jende Solutions has deployed administrative, technical and physical controls to protect sensitive company information as well as customer privacy. However, if controls to protect sensitive data are somehow compromised, Jende Solutions must have an Incident Response Plan to mitigate damage, investigate the cause and recover services. The purpose of this policy is to establish guidelines for the development of Jende Solutions's response to unauthorized network intrusions or other significant information security incidents. Policy Statement Incident Response is the final stage in a process that escalates events through an operation review process to determine if an event was observed on a production processing system could have caused a breach of the system or compromise of sensitive data. Jende Solutions will appoint an Incident Response Team (IRT)and maintain a plan to effectively guide response to an incident. Scope All employees must report all suspicious actions, activities and incidents to the IT department using the Incident reporting form. Standards Jende Solutions will prepare and maintain an incident response plan that will enable the Incident Response Team to respond immediately to a system breach or compromise.