Security

�̾��Ƶ websites and web applications must be secure. This means that the tools and practices used to create and maintain them must ensure the appropriate confidentiality, integrity, and availability of data and services that they provide.

Security guidelines

Standards for security of �̾��Ƶ websites and web applications are set by the Information Security Committee and monitored by Enterprise Cybersecurity Services.

Website platforms and web applications may be developed in-house or acquired by �̾��Ƶ from a third-party, either via a university-approved commercial licensing agreement or by using an open-source solution. Any third-party solution, regardless of licensing structure and including open-source, must be vetted by Cybersecurity Services to determine if a Security Assessment Review (SAR) is required. Any solution determined to require a SAR must complete that process prior to implementation.

Static websites

For static websites, the primary security concern is limiting access to who can add or modify those files. In this regard, user account practices are of primary importance:

Do not share usernames and passwords with anyone.
to a website, web tool or �̾��Ƶ server for yourself or an employee using the IT Accounts Management System.
If a user account has not been accessed in a year, an attempt will be made to contact the owner and potentially disable it.
If you are hosting your own site, please review the hosting standard as well as the standard on standalone websites.

Web applications

For web applications, proper user account practices are important, but there are many additional areas of concern in relation to security. The following is a summary of the most important points:

Web hosting environments and associated database systems supporting them should be maintained by experienced professionals. For additional information on hosting, see the standard on web hosting.
Underlying frameworks and technologies must be updated on a regular basis, especially to install security-related patches.
Web applications should be tested for issues with the web application coding before being put into production, at least annually once they are live, and after any significant revision to the application. These issues include concerns such as SQL injection, cross-site scripting, authentication and authorization, and session control. �̾��Ƶ IT provides to check web applications.
Wherever possible, web applications that require users to authenticate should use .
Web applications must have a designated administrator and a backup person who is responsible for overseeing the web application and granting authorization of various levels of access rights to other individual users within that application.
Web applications that involve sensitive or restricted data per the �̾��Ƶ Data Classification Policy must undergo a specific security review by Enterprise Cybersecurity Services.
Web applications that are developed in-house should be following industry best practices such as the .
The principle of least privilege should always be used in granting access rights and managing permissions in any web application.

Security breaches

If any �̾��Ƶ employee suspects a security-related incident with a website or web application, follow the Cybersecurity Incident Reporting process.

Report the security incident to your manager. If you are a manager, contact the IT Service Desk and state that you are reporting an information security incident.

Support

For questions regarding security, please contact Cybersecurity Services or the website owner or manager.

Responsibility for security

Website owners and managers of any websites set up on �̾��Ƶ servers are responsible for following security-related best practices for their websites. All �̾��Ƶ employees must report security-related incidents following the Cybersecurity Incident Reporting process. In addition, site owners and managers must comply with all relevant laws, and this standard.

Violations

�̾��Ƶ reserves the right to remove a website or access to that website if the owner or manager does not appropriately maintain security practices. If the site or content owner cannot be contacted or is no longer at �̾��Ƶ, that content will be administered by ET&S Software Development and can be removed if deemed inaccurate or inappropriate. �̾��Ƶ also reserves the right to remove a website or access to that website if it is considered to have violated this standard or any other �̾��Ƶ policies.

If inappropriate security practices are reported, �̾��Ƶ ET&S will contact the site owner to discuss the issue. Unacceptable responses may cause the UNH website, web application, or server access to be suspended.

Reports regarding inappropriate security .

�̾�����Ƶ