Res 2009-171 - Laserfiche WebLink

Home Browse Search

Brazos RFP 209-028 Hand Held Ticket Writer System 112 Security Patch updates should be Once a new version (or patch) is created and tested, we Expected identified for implementation identify several customers to pilot the patch prior to general within 5 days of a new patch release. Those customers are notified and given the release (i.e. server, OS, opportunity to accept or refuse the new patch. Once that application, browser, and patch has been tested and verified in a customer database). environment, all customers are notified of the patch and given the opportunity to refuse and/or schedule the release within their environment. The City will identify the person who will be charged with determining both the willingness to accept a pilot patch as well as scheduling the release of those patches. 113 Security The System should allow single Each user is assigned a user ID and a security profile Expected sign on authentication to the (defined by the City). Each user is required to sign into the application. handheld device and the website. Once they successfully log in, all applications and functions that they have access to are available without additional sign-ons. 114 Security The System should provide LDAP Brazos Technology can integrate with Active Directory for Expected or MS Active Directory BuiidlT and eCitation servers, but we do not recommend authentication. integration for the devices. This is because if the City chooses to have TCIC/NCIC returns, we must comply with those requirements for passwords. 115 Security All Windows systems should be We have installed our eCitation server with Symantec, Expected compatible with Symantec Anti- McAfee, and Sophos anti-virus software packages. If the Virus application. City desires another system, we will verify operation and work with the City to set the appropriate security levels to ensure system operation. 116 Security All Systems (i.e. client, web The entire Brazos Solution has been built utilizing the Expected servers, application servers, industry best standards for policy and risk management, database servers) should meet security architecture, user security, authentication, and DRA industry-best standards (InfoSec). issues. We are not completely sure how to address the very broad scope of this requirement, but would be willing to answer any question desired by the City. Since our system runs in a hosted environment, security and DRA issues are at the heart of our entire system. One of our customers, the Department of Homeland Security, put us through a rigorous vetting process to ensure our system was compliant with their security and business continuity requirements. 117 Security Systems should be able to be We do not have any SNMP traps built into our system and Expected monitored using SNMP. believe that another server should have this monitoring capability. We currently use a service provided by Rackspace (our hosting company) to provide this monitoring capability. 118 Security The System should minimize the The Brazos system allows the City to configure which ports Expected number of different IP ports used are used for all data transmission from the devices to the by servers, clients, and other servers as well as from the web server to the DBMS. Since related sub-systems. the City can define all of these ports, security on these ports should be straightforward. In addition, since our system is built as a hosted model, setting up additional customers (such as the University) is built into the system. While all data are contained in the same database schema, it is all sectioned off via customer number which allows the entities to operation completely autonomously and/or share information with each other. Item # Cate o Requirement Description Required Response Priorit 119 Security To maintain network security, the All defined ports (described above) are set via the Expected System must include re- web.config file and in each customer profile. This allows the assignable ports for the System. City to define and/or change them at any time.