Passing your Security scan

Security is important to us here at Johns Hopkins. In order to make your website externally available it is imperative that you successfully pass your security scans.

Accunetix is the service that we utilize for security scans on websites. in order for your site to become externally available it must pass an acunetix scan. a few ways you can ensure a clean scan are as follows:

  • ensure wordfence is installed and up to date.
  • make sure your wordfence firewall is enabled and protecting
  • remove or rename xmlrpc.php
  • plugins should be up to date
  • no backups in public_html directory

Please keep in mind that custom code could be vulnerable and in that case maybe flagged during your acunetix scan

Nessus Teneble is the product that Johns Hopkins utilizes to scan servers and other high value systems. Any server in the DMZ or that is externally facing must be scanned before release. Any server to be scanned must meet the following qualifications:

  • Must be running a server class operating system. No clients unless specially approved
  • Must be in CMDB with an associated scan group
  • Must have a Nessus Agent installed. (This will be installed automatically when in CMDB with a scan group selected)
  • Must have supported OS and application versions for websites

Depending on the Product, most scans will be completed within 24 hours. However, larger websites may take several days. Once your scan has been completed any issues or vulnerabilities must be corrected before the product is made public.

Tips to Improve Your Cyber Security Practices

While not everything that may show up on a scan is manageable by a Web-Admin there are a few things that you can do to expedite the process.

Wordfence

If you are requesting a WordPress site, Wordfence is mandatory. While it will be preinstalled when the site is released to the Web-Admins, it still must be maintained. For example, this includes updates when applicable and ensuring that firewalls remain active. It is also important that your site remains connected to Wordfence Central.

Plugins

Although Wordfence is very important it is not the only plugin that must be maintained. All plugins should be updated when applicable. In addition to updating plugins, we recommend not using any unapproved plugins as they can contain security holes or be incompatible with your WordPress version and/or theme, thereby breaking your site and wasting all your hard work and time.

Strong Passwords

Having good security practices is the foundation of cyber security. The first step to developing good security practices is having strong passwords. A strong password should be no less than 8 characters and should contain a mixture of upper and lower case letters as well as numbers, symbols and/or special characters. Another option is to use a passphrase, much like a password, a strong passphrase will contain a mixture of characters. If you have trouble remember passwords and passphrases, a password manager such as Last Pass can be an amazing tool.

Protected health information (PHI)

To best protect the anonymity and privacy of our patients and students, it is imperative that your website not contain any PHI that could be misused or stolen. These are the 18 identifiers of PHI:

  1. Names
  2. Dates, except year
  3. Telephone numbers
  4. Geographic data
  5. FAX numbers
  6. Social Security numbers
  7. Email addresses
  8. Medical record numbers
  9. Account numbers
  10. Health plan beneficiary numbers
  11. Certificate/license numbers
  12. Vehicle identifiers and serial numbers including license plates
  13. Web URLs
  14. Device identifiers and serial numbers
  15. Internet protocol addresses
  16. Full face photos and comparable images
  17. Biometric identifiers (i.e. retinal scan, fingerprints)
  18. Any unique identifying number or code