Esri Software Security & Privacy Blog - Page 4

ArcGIS Online was granted a FedRAMP Tailored Low (Li-SaaS) Authority to Operate(ATO) which went into effect June 28th 2018. When a solution such as ArcGIS Online is authorized, specific applications, services, and providers are assessed as part of the effort.  The security controls for this authorization align with National Institute of Standards and Technology (NIST) Special Publication 800-53 (Revision 4) which maps to International Standards Organization (ISO) 27001 & 15408 controls.

The Portal for ArcGIS Security 2018 Update 2 Patch has been released for Portal for ArcGIS 10.3.1.

ArcGIS Enterprise Administrators should consider installing this patch as high priority, as it addresses an incorrect proxy access control vulnerability, among others.

Security patches are released for the last minor release in a series of ArcGIS products that are still in mainstream support.

All versions of this patch are available here:

Portal for ArcGIS Security 2018 Update 2 Patch

Users can also run the ArcGIS Patch Notification tool to check for, download, and install patches.

Check for and install software patches and updates—ArcGIS Server (Windows) Installation Guide (10.5)... 

In today’s cybersecurity landscape, ensuring the products and services you receive from a software company have security and privacy considerations built-in is paramount.  Today, we are publicly releasing an overview of the assurance measures we incorporate, including governance, standards alignment, assessments/tools, vulnerability/incident management, and guidelines utilized.

We have also updated the Trust Center to have its own domain, so that users are no longer directed to .doc.arcgis.com pages as part of the main site and we have updated the Documents section descriptions to more easily identify what content is best for you (including the SDLC overview document titled “Esri Software Security and Privacy”).

We welcome your feedback on this overview, so feel free to reach out to our team – Esri’s Software Security & Privacy team –SoftwareSecurity@Esri.com

Reference:
Esri Software Security & Privacy (SDLC Overview) –https://downloads.esri.com/RESOURCES/ENTERPRISEGIS/Esri_SDLC.pdf 

The ArcGIS SSL/TLS Guidance Briefing has been updated. Updates include specific guidance for ArcGIS Client software, insight into TLS plans for ArcGIS Online, and details regarding ArcGIS Enterprise components.

Browse to the ArcGIS Trust Center document repository to review this document and all of our other helpful resources!