Reso 2021-3185 - Laserfiche WebLink

Home Browse Search

maintenance windows, risks, etc. Not all updates are relevant in every environment, so each is evaluated for relevance and risk before implementation. Protection From Attacks The OWASP standards are built into development processes and manual testing is performed in addition to peer review as required by our SDLC. WEX uses an automated dynamic application security testing (DAST) solution that scans web applications to find vulnerabilities and provide guidance on remediation. WEX receives vulnerability announcements, for relevant systems, from vendors, third parties, NIST, FDIC, FBI, and other threat feeds and has a dedicated security operations team managing and maintaining the vulnerability management program. The Vulnerability management procedure requires a ticket to be generated and assigned to Information Technology operations teams for patching. Logging and Log Monitoring Logs are aggregated and correlated using an on premise, commercially available, SIEM platform. Logs are kept for one year. Additionally, WEX has managed services contracts with a well known global service to assist in monitoring and responding to log events. Remote Access Remote access to WEX networks from a non -trusted network requires an authorized device, the use of VPN and two -factor authentication. Network based intrusion detection is used at critical points of the network infrastructure. Network access control has been implemented to ensure only authorized devices that have the correct security posture are admitted onto the network. Media Destruction WEX utilizes a third -party vendor for media destruction. WEX also has onsite degauss capability that meets Department Of Defense requirements for media sanitization. Access Access is granted through the provisioning of a unique user ID, with least privilege rights granted. Requests are approved by a user's manager, and provisioned by a systems access group. Initial logon requires a password change, and access is disabled upon termination. Key password parameters: Min. Length of 8 characters must choose 3 out of the 4 of the following: capital letter, lower case letter, number, special character. Lock out is three unsuccessful attempts and expiration is 90 days. User authentication can be performed, depending on the application, by: Active Directory, LDAPS, or Oracle access manager. Encryption Policies and Standards WEX encryption policies and standards govern encryption for data in transit and/or at rest. Standard algorithms are AES 256 and 3DES. WEX SAN data is encrypted at rest using AES256 and mobile devices utilize whole disk encryption. For web applications, SSL is used between web servers and the browser. Console access is SSH. MASTER AGREEMENT No. 00819 - FLEET CARD SERVICES PAGE 107 OF 138