...
- Check the “Vulnerability scan schedule” to see what’s on the list for the current month
Copy all the links listed for that month
- In the code, comment out any automatic emails so they won’t get sent.
Check the .htaccess file to make sure that the itsoscan security office can access the sites.
Remove the #(hashtag) in the “require shib-attr uid itsoscan” line to allow them to scan with Duo disabled.
- To scan the Intranet you will need to remove the comment out commands, circled in yellow below, from the command on line 24 circled in red below.
- TURN OFF DEBUGGING on the test servers to be scanned.
Send an email to security-services@cornell.edu requesting a scan.
Please run a security scan on our test sites https://testspi.aad.cornell.edu/ and https://testconnect.aad.cornell.edu/ at your earliest convenience. We have prepared for it by confirming that “itsoscan” has permission, turning off notifications and disabling the automated emails.- Check the reports that come back for any issues more than low-level risk
- When any issues are dealt with save the zipped scan reports in Cornell Box, aad-wsux, Security Scans folder. This folder should be locked down to aad-wsux team and Lisa Stensland (aad IT security contact).
...