Purpose

This document provides guidelines / instructions that enable Symantec users or the Technology Services Group members to developed, identify, evaluate and remediate system and application vulnerabilities in order to prevent a catastrophic systems failure.

Background

This document defines accountability and a process that coordinates the patch and vulnerability management effort to include communication, documentation and reporting requirements. By adhering to the following guidelines, Symantec can reduce risks that can lead to adverse security incidents. The primary parties responsible for complying with these procedures include key Information Technology (IT) managers and Risk Management’s Information Security Officer (ISO).

Technical Impact 1 – 5:       A measure of how important a device is to the communications of the network.

Threat 1 – 5:                          An activity that has either the potential of causing harm to a computer or a network.

Vulnerability 1 – 5:               A flaw, mis-configuration, or weakness that allows the security of the system to be violated.

Criticality 1 – 5: A measure of how important a system is to the organization’s mission.

1 – lowest – no risk or does not apply

2 – Low risk – little or no impact

3 – Would cause damage

4 – Would cause serious damage

5 – Would cause exceptionally grave damage