1. Purpose
The purpose of this Security Policy is to establish guidelines and procedures to ensure the security and protection of the Subivi website and its associated assets. This policy aims to safeguard the confidentiality, integrity, and availability of information, prevent unauthorized access, and mitigate potential security risks.
2. Scope
This Security Policy applies to all employees, contractors, and third-party individuals or entities who have access to the Subivi website and its related resources.
3. Roles and Responsibilities
3.1 Management
a. Designate a responsible individual or team to oversee website security.
b. Develop and enforce website security policies and procedures.
c. Regularly review and update the security measures to align with evolving threats.
d. Provide necessary resources and training to employees to ensure compliance.
3.2 Employees
a. Follow all website security policies and procedures.
b. Report any suspected security incidents or vulnerabilities to the designated security team.
c. Protect their login credentials and avoid sharing them with unauthorized individuals.
d. Comply with all applicable laws and regulations related to website security.
4. Access Control
4.1 User Accounts
a. User accounts should be created for authorized individuals only.
b. Implement strong password policies, including minimum complexity requirements, regular password changes, and multi-factor authentication where possible.
c. Remove or disable user accounts promptly when no longer required.
4.2 Access Privileges
a. Assign access privileges based on the principle of least privilege, ensuring individuals only have access to resources necessary for their roles.
b. Regularly review and update access privileges to reflect changes in personnel roles or responsibilities.
c. Restrict administrative access and closely monitor privileged accounts.
5. Network Security
5.1 Firewalls and Intrusion Prevention Systems
a. Deploy and maintain firewalls and intrusion prevention systems to monitor and control network traffic.
b. Regularly update firewall and intrusion prevention system rules to defend against emerging threats.
5.2 Secure Sockets Layer (SSL) Certificates
a. Use SSL certificates to enable secure communication between website visitors and the server.
b. Regularly renew and monitor SSL certificates for any vulnerabilities or weaknesses.
6. Web Application Security
6.1 Secure Coding Practices
a. Adhere to secure coding practices during the development of the Subivi website.
b. Regularly update and patch web application frameworks, libraries, and components to address known vulnerabilities.
6.2 Input Validation
a. Implement input validation mechanisms to prevent injection attacks such as cross-site scripting (XSS) and SQL injection.
b. Use server-side validation to verify the integrity and validity of user-supplied data.
6.3 Security Testing
a. Conduct regular security assessments and penetration testing to identify vulnerabilities and weaknesses.
b. Perform code reviews and security audits to ensure compliance with security best practices.
7. Incident Response
7.1 Incident Reporting
a. Establish a process for reporting security incidents promptly.
b. Encourage employees to report any suspected security incidents or vulnerabilities.
7.2 Incident Response Plan
a. Develop an incident response plan outlining the steps to be taken in the event of a security incident.
b. Identify key personnel responsible for incident response and establish communication channels.
8. Security Awareness and Training
a. Provide regular security awareness training to all employees to enhance their understanding of website security risks and best practices.
b. Conduct phishing awareness campaigns to educate employees about potential email-based threats.
9. Policy Review
a. Regularly review and update this Security Policy to reflect changes in technology, threats, or regulatory requirements.
b. Communicate any policy updates to all relevant personnel and ensure their understanding and compliance.
10. Policy Compliance
Non-compliance with this Security Policy may result in disciplinary action, including but not limited to, warnings, suspension, or termination, as deemed appropriate.
By accessing or using the Subivi website, individuals agree to comply with this Security Policy and acknowledge their responsibility in maintaining the security and protection of the website and its assets.
18.05.2023