Skip to content

Latest commit

 

History

History
31 lines (24 loc) · 3.39 KB

16-vulnerability_scanning_policy.md

File metadata and controls

31 lines (24 loc) · 3.39 KB
Raw

16. Vulnerability Scanning Policy

NutriAdmin is proactive about information security and understands that vulnerabilities need to be monitored on an ongoing basis. NutriAdmin utilizes Tinfoil Security Scanner (or an equivalent tool) to consistently scan, identify, and address vulnerabilities on our systems. We also utilize OSSEC on all systems, including logs, for file integrity checking and intrusion detection.

The NutriAdmin team periodically runs npm audit, which detects known vulnerabilities in npm packages used in the application. When vulnerabilities are detected, steps are taken to evaluate their impact and to remediate them if appropriate and reasonable.

In addition to the above, the NutriAdmin team proactively researchs known vulnerabilities when implementing new systems, or when new knowledge about potential vulnerabilities is obtained.

16.1 Applicable Standards the HIPAA Security Rule

  • 164.308(a)(8) - Evaluation

16.2 Vulnerability Scanning Policy

  1. Tinfoil management is performed by the NutriAdmin Security Officer, or an authorized delegate of the Security Officer.
  2. Frequency of scanning is as follows:
    1. on a yearly basis;
    2. after every production deployment of new features or systems that are evaluated by the Security Officer to potentially expose new vulnerabilities.
  3. Reviewing Tinfoil reports and findings, as well as any further investigation into discovered vulnerabilities, are the responsibility of the NutriAdmin Security Officer. The process for reviewing Tinfoil reports is outlined below:
    1. The Security Officer initiates the review of a Tinfoil Report by creating a Task in the Compliance Review Activity (CRA) Spreadsheet with ID #CRA-14.
    2. The Security Officer, or a NutriAdmin Security Engineer assigned by the Security Officer, is assigned to review the Tinfoil Report.
    3. If new vulnerabilities are found during review, the process below is used to test those vulnerabilities is outlined below. Once those steps are completed, the Task is then reviewed again.
    4. Once the review is completed, the Security Officer approves or rejects the Task. If the Task is rejected, it goes back for further review.
    5. If the review is approved, the Security Officer then marks the Task as Closed, adding any pertinent notes required.
    6. Compliance with the vulnerability scanning policy is monitored on a yearly basis using the Compliance Review Activity (CRA) Spreadsheet to assess compliance with above policy. This monitoring activity is recorded using ID #CRA-15.
  4. In the case of new vulnerabilities, the following steps are taken:
    • All new vulnerabilities are verified manually to assure they are repeatable. Those not found to be repeatable are manually tested after the next vulnerability scan, regardless of if the specific vulnerability is discovered again.
    • Vulnerabilities that are repeatable manually are documented and reviewed by the Security Officer and Privacy Officer to see if they are part of the current risk assessment performed by NutriAdmin.
    • Those that are a part of the current risk assessment are checked for mitigations.
    • Those that are not part of the current risk assessment trigger a new risk assessment, and this process is outlined in detail in the NutriAdmin Risk Assessment Policy.
  5. All vulnerability scanning reports are retained for 6 years by NutriAdmin.