Role and Responsibilities 

Policies and Guidelines

• Acceptable Use Policy
• iHost Service Guidelines
• Cybersecurity Policy

Cybersecurity Requirements

• Review the Cyber Security Policy and ensure the hosted websites and their data fulfill the requirements whenever appropriate. Specifically,
  • Risk Assessment, Classification and Mitigation
  • Minimum Security Standard for Applications
     
• High-risk applications or data are not allowed in iHost.
   
• Register your production websites in CITARS http://itso.hkust.edu.hk/cyber-security/citars. Review and update the record regularly if it has already been registered in CITARS.
   
• Work with ITSO to resolve website vulnerabilities as soon as possible when a cybersecurity breach or threat has been identified.
   
• If you are outsourcing your websites to vendors, please make sure your vendor has a maintenance plan for the entire lifespan of your websites.  Refer to the following page for a quick summary of items that your vendor need to pay attention to.
  /services/cyber-security/application-things-to-note 

Health-check Scanning and Security Vulnerabilities

• Before launching your websites for production, a health-check scanning is recommended.
  • More information about the Web Application Health-check is at
    http://itso.hkust.edu.hk/services/cyber-security/web-application-health-check-scanning  
    
    ​(Notes: If your websites are developed by vendors, they are required to carry out health-check scanning by themselves and resolve any important security vulnerabilities with high or moderate risk, before requesting the health-check service.)
    ​
• You are also requested to carry out health-check scanning to your websites after each major update.  

Account Renewal & Archival 

Regular Security/ Maintenance, End-of-life Schedule and Migration

iHost servers will be regularly patched for security updates.  It would, although it is rare, potentially break some of your programs when applying the security updates.  The technical owners (or your vendors) are required to resolve the issues if it happens. 

When an iHost server reaches the end of its supported date (i.e. end-of-life date), users having websites on that iHost server will need to migrate their contents to another supported server.