Emergency Vulnerability Scanning

ISO Position Paper

Position Title: Emergency Vulnerability Scanning

Position Audience: Princeton IT Professionals

Contact: Information Security Office: InfoSec@princeton.edu 

Position Release Date: August 10, 2017


Problem Statement

From time to time, the University receives critical and time-sensitive security alerts from various
trusted sources that require the ISO to immediately assess campus exposure to the risk of data
loss.

ISO Position

The ISO will review published emergency vulnerability announcements. When it is determined
that a published vulnerability presents an immediate risk to University information categorized
as Restricted or Confidential1, the ISO will scan the University’s network to determine which
systems may be susceptible to the identified vulnerability. These scans will be performed using
University approved tools.

Appropriate channels will be used to alert the University technical community prior to the scans
taking place. Once the scans have finished, notification will be sent to appropriate technical
contacts if their systems are found to be vulnerable. This position paper is meant to work in
conjunction with the ISO Emergency Vulnerability Patching Position Paper to ensure that
vulnerabilities are remediated as soon as possible proportionate to the information risk imposed
by the vulnerability.

1Information Security Policy

Data Classification: Public