IT-12: System and Information Integrity (SI) Standard

Control:

Flaw Remediation

Required for:

High

Moderate

IU Implementation

• Acquire all software code, updates, and patches from verified vendors.
• Test all code, updates, and patches before installation.
• Install security-relevant software and firmware updates within one month of the release of the update or sooner. Patches and updates for active exploits must be applied within five business days.
• Remove or disable code no longer being used immediately after updates or patching.

Notes

• Where available, code and patch hashes should be checked before being applied.
• Use of centrally provisioned, common IT infrastructure and services provided by UITS often fulfills many of these requirements. Check with the service owner for details.

NIST Cross Reference

SI-2

Control:

Malicious Code Protection

Required for:

High

Moderate

IU Implementation

• Install or enable antivirus/antimalware protection for all systems where it is available.
• Periodically scan information systems and assets for malicious code.

Notes

• Malicious code includes, for example, viruses, worms, Trojan horses, and spyware.
• Malicious code protection mechanisms include, for example, antivirus signature definitions and reputation-based technologies.
• Heuristic-based antivirus/antimalware that consistently monitors behavior would also comply with this requirement in lieu of scheduled scans.
• Use of centrally provisioned, common IT infrastructure and services provided by UITS often fulfills many of these requirements. Check with the service owner for details.

NIST Cross Reference

SI-3

Control:

System Monitoring

Required for:

High

Moderate

IU Implementation

Monitor IT resources to detect attacks and indicators of potential attacks.

Notes

• See also the IT-12 Audit and Accountability (AU) Standard.
• Potential monitoring tools include log analysis, vulnerability scanning, etc.
• Use of centrally provisioned, common IT infrastructure and services provided by UITS often fulfills many of these requirements. Check with the service owner for details.

NIST Cross Reference

SI-4

Control:

Security Alerts, Advisories, and Directives

Required for:

High

Moderate

Low

IU Implementation

Subscribe to relevant internal and external information sources and prioritize action plans based on risk.

Notes

• UISO Security Bulletins
• See Information sources recommended for those providing local UITS support at IU.

NIST Cross Reference

SI-5

Control:

Information Input Validation

Required for:

High

Moderate

Low

IU Implementation

Applications must validate data input.

Developers must write and/or implement code that that verifies the validity of data submitted to applications. Verification should consider:

• Data type
• Data length or size
• Prohibited input, e.g., SQL syntax or commands

For example, numeric value fields must only contain numerals and must be trimmed to an appropriate length.

Notes

For further guidance, see the Open Web Application Security Project (OWASP) testing guide and Input Validation Cheat Sheet.

Use of centrally provisioned, common IT infrastructure and services provided by UITS often fulfills many of these requirements. Check with the service owner for details.

NIST Cross Reference

SI-10

Control:

Error Handling

Required for:

High

Moderate

Low

IU Implementation

Application error messages must provide only the information necessary to enable corrective actions without revealing information that is Critical or Restricted, or that could be exploited.

Notes

For further guidance, see:

• Open Web Application Security Project (OWASP) testing guide and error handling principles
• Handling application and scripting errors for IU websites
• Form validation and error handling

Use of centrally provisioned, common IT infrastructure and services provided by UITS often fulfills many of these requirements. Check with the service owner for details.

NIST Cross Reference

SI-11

Control:

Information Management and Retention

Required for:

High

Moderate

Low

IU Implementation

Data must be retained and destroyed in accordance with associated legal requirements, regulations, and IU policy.

Notes

For further guidance, see:

• Policy UA-18 (University Records Retention and Disposition)
• “Records Retention Schedule” applet at one.iu.edu
• About secure data removal
• Critical Data Guide

If further guidance is needed, consult the University Information Policy Office, the relevant Data Steward, and/or the Office of the Vice President and General Counsel.

NIST Cross Reference

SI-12