When you deploy, manage or operate a web presence, it's essential to follow these best practices to secure your environment and prevent incidents for which your department or faculty could be held liable.

1. Patch and upgrade operating systems and applications regularly to ensure these are up-to-date with vendor(s) security updates. In cases of critical exploits, apply security patches or workarounds immediately according to vendor鈥檚 security alert subscriptions or announcement.
2. Configure operating systems and applications according to best practices provided by the vendor(s), including but not limited to:
   • changing default passwords and managing passwords according to the ITS Standard for and
   • disabling accounts, services and applications that are not needed & decommissioning unused servers
   • managing accounts following the principle of least privilege and the ITS Standard for
   • restricting access and data to authorized parties only
3. Implement web authentication and encryption technologies according to ITS Standards for and
4. Back up content, application configurations and operation system regularly following聽 the ITS Standard for
5. Set up and monitor access log files properly to enable incident investigation according to the ITS Standard for and
6. Define change control processes to ensure all changes are justified, documented and tracked
7. Follow as applicable, such as for

Contact

• For any questions about the above guidelines, contact IT Service Desk on the聽 to reach IT Security team for consultation
• For web applications and services hosted outside of McGill,
  • follow the Cloud service acquisition process and Policy on the Responsible Use of McGill Information Technology Resources
  • indicate on the homepage that the website is not hosted by McGill
• For the McGill-supported Web Management System (WMS) see the Web Services Contact us page

Tools

• IT Services will launch pilot for the vulnerability management and scan services in 2020. If you are interested to be part of the pilot, please contact IT Security on the聽

References