PB 22164 - September 29, 2005 - USPS.com® - About

POSTAL BULLETIN 22164 (9-29-05)
Other organizations and managers responsible for
system, application, and product development include:
chief inspector; inspector general; chief privacy officer; contracting
officers and general counsel; and business partners
(see Appendix A, Consolidated Roles and Responsibilities,
for details).
* * * * *
8-6 Application Information Security Assurance
Phases
* * * * *
8-6.1 Phase 1 — Definition
* * * * *
[Add new 8-6.1.5 and 8-6.1.6 to read as follows:]
8-6.1.5 Document High-Level Architecture
A high-level architectural diagram (e.g., hardware, communications,
security devices, and interconnected resources)
is developed for all applications. The architectural diagram
is submitted to the manager, SIS, for review and determination
of the impact on the infrastructure and the need for
additional security controls for the application (e.g.,
enclave).
8-6.1.6 Document Information Resources in the
Enterprise Information Repository
All applications are documented in the Enterprise Information
Repository (EIR).
8-6.2 Phase 2 — Design and Integration
* * * * *
[Delete 8-6.2.1, Document High-Level Architecture, and
8-6.2.2, Document Information Resources in the Enterprise
Information Repository.]
* * * * *
[Delete 8-6.2.11, Conduct Vulnerability Scan.]
* * * * *
[Renumber current 8-6.2.3 through 8-6.2.16 as new 8-6.2.1
through 8-6.2.13. Add new 8-6.2.14 to read as follows:]
8-6.2.14 Register Application in eAccess
The application is registered in eAccess which is the Postal
Service application for managing the authorization process
for personnel needing to access the application and the associated
information. Registration is also required for the
use of managed accounts (i.e., machine accounts, etc.).
8-6.3 Phase 3 — Testing
* * * * *
95
[Renumber current 8-6.3.4 through 8-6.3.9 as new 8-6.3.5
through 8-6.3.10. Add new 8-6.3.4 to read as follows:]
8-6.3.4 Conduct Vulnerability Scan
A vulnerability scan is recommended for all information
resources and applications, and is required for some information
resources and applications (see Handbook
AS-805-A, Application Information Security Assurance
[ISA] Process).
* * * * *
10 Hardware and Software Security
* * * * *
10-2 Roles and Responsibilities
* * * * *
10-2.8 Database Administrators
Database administrators (DBAs) are responsible for:
* * * * *
[Revise item d to read as follows:]
d. Tracking hardware and software vulnerabilities, and
deploying database security patches.
* * * * *
10-4 Configuration and Change Management
* * * * *
[Renumber current 10-4.5 through 10-4.6 as new 10-4.6
through 10-4.7. Add new 10-4.5 to read as follows:]
10-4.5 Patch Management
An effective patch management process must be implemented
to investigate, prioritize, test, track, and control the
deployment and maintenance of software releases, and to
resolve known security vulnerabilities. The patch management
process must be addressed by all information
resources installed in the Postal Computing Environment.
Personnel involved in the patch management process must
be trained to ensure a viable vulnerability mediation
process.
Patch management involves acquiring, testing, and installing
multiple patches (code changes) to software systems,
including operating system software, supporting software
and packages, firmware, and application software. Patch
management tasks include: maintaining current knowledge
of available patches; deciding what patches are appropriate
for particular information resources; prioritizing the