PB 22164 - September 29, 2005 - USPS.com® - About

96 POSTAL BULLETIN 22164 (9-29-05)
patches to be installed; testing patches in a nonproduction
environment first in order to check for unwanted or unforeseen
side effects; developing a backout plan, which
includes backing up the systems about to be patched to be
sure that it is possible to return to a known-good working
configuration should something go wrong with the patch;
ensuring that patches are installed properly; testing
information resources after installation; and documenting
all associated procedures, such as specific configurations
required.
Patch management is critical to ensure the integrity and
reliability of information resources. Patch management
should be capable of:
a. Highly granular patch update and installation administration
(i.e., treating patches and mainframes,
servers, desktops, and laptops separately).
b. Tracking machines, and updating and enforcing
patches centrally.
c. Verifying successful deployment on each machine.
d. Deploying client settings, service packs, patches, hot
fixes, and similar items network-wide in a timely manner
in order to address immediate threats.
e. Initiating from a central management console.
f. Providing scheduling, desktop management, and
standardization tools to reduce the costs associated
with distribution and management.
g. Providing ongoing deployment for both new and
legacy systems in mixed hardware and OS
environments.
h. Automating the repetitive activity associated with rolling
out patches.
i. Analyzing the operating system and applications to
identify possible security holes.
j. Scanning the entire network (IP address by IP address)
and providing information such as service
pack level of the machine, missing security patches,
key registry entries, weak passwords, users and
groups, and more.
k. Analyzing scan results using filters and reports to
proactively secure information resources (e.g., installing
service packs and hotfixes, etc.).
* * * * *
Appendix A Consolidated Roles and
Responsibilities
* * * * *
11 Portfolio Managers
Portfolio managers are responsible for the following:
* * * * *
[Reletter current items e through i as new items f through j.
Add new item e to read as follows:]
e. If a documented vulnerability will not be mitigated,
preparing and signing an acceptance of responsibility
letter as part of the ISA process.
* * * * *
35 Database Administrators
Database administrators are responsible for the following:
* * * * *
[Revise item l to read as follows:]
l. Tracking hardware and software vulnerabilities, and
deploying database security patches.
* * * * *
36 All Personnel
* * * * *
[Reletter current items e through s as new items g through
u. Add new items e and f to read as follows:]
e. Always using their physical and technology electromechanical
access control identification badge or
device to gain entrance to a controlled area.
f. Ensuring no one tailgates into a controlled area on
their badge.
* * * * *
Appendix B Information Security and Related
Documents
[Revise Appendix B to read as follows:]
Administrative Support Manual (ASM)
Subchapter 27, Security
Subchapter 28, Emergency Preparedness
Chapter 8, Information Resources
Handbooks
AS-805, Information Security
AS-805-A, Application Information Security
Assurance (ISA) Process
AS-805-B, Infrastructure Information Security
Assurance (ISA) Process
AS-805-C, Information Security for General
Users
AS-805-D, Information Security Network
Connectivity Process
AS-805-G, Information Security for Mail
Processing/Mail Handling Equipment
AS-816, Open VMS Security
AS-353, Guide to Privacy and the Freedom of
Information Act
Other Related Documents
Enterprise Information Security Architecture
USPS PKI Certificate Policy (CP)