When you deploy, manage or operate a web presence, it's essential to follow these best practices to secure your environment and prevent incidents for which your department or faculty could be held liable.
- Patch and upgrade operating systems and applications regularly to ensure these are up-to-date with vendor(s) security updates. In cases of critical exploits, apply security patches or workarounds immediately according to vendor’s security alert subscriptions or announcement.
- Configure operating systems and applications according to best practices provided by the vendor(s), including but not limited to:
- changing default passwords and managing passwords according to the ITS Standard for Privileged Password Management and User Password Standard
- disabling accounts, services and applications that are not needed & decommissioning unused servers
- managing accounts following the principle of least privilege and the ITS Standard for Role Based Access Control
- restricting access and data to authorized parties only
- Implement web authentication and encryption technologies according to ITS Standards for Cryptography and Authentication
- Back up content, application configurations and operation system regularly following the ITS Standard for Data Security Lifecycle controls
- Set up and monitor access log files properly to enable incident investigation according to the ITS Standard for Logging and Secure Error Logging
- Define change control processes to ensure all changes are justified, documented and tracked
- Follow other ITS Standards as applicable, such as for API Security
Contact
- For any questions about the above guidelines, contact IT Service Desk on the IT support site to reach IT Security team for consultation
- For web applications and services hosted outside of McGill,
- follow the Cloud service acquisition process and Policy on the Responsible Use of McGill Information Technology Resources
- indicate on the homepage that the website is not hosted by McGill
- For the McGill-supported Web Management System (WMS) see the Web Services Contact us page
Tools
- IT Services will launch pilot for the vulnerability management and scan services in 2020. If you are interested to be part of the pilot, please contact IT Security on the IT support site