|
|
Information Technology Security Policy and Guidelines Revision 2.0 Revision History Page
Table of Contents
1.0 INTRODUCTION:
Information Technology (IT) security is critical to assuring the integrity and confidentiality of information maintained on Lewis-Clark State College’s numerous Information Systems. At a minimum, the IT Security Policy is responsible for setting guidelines and processes to assure that:
2.0 APPROPRIATE USAGE OF LCSC INFORMATION TECHNOLOGY RESOURCES: Appropriate usage of all Information Technology data, tools and services at Lewis-Clark State College is outlined in the LCSC Appropriate Use of Technology Guidelines.
NOTE: All requests for modifications or additions to this document, clarifications to the intent of specific areas of the document, or the reporting of IT security violations should be directed to the Lewis-Clark State College Chief Technology Officer (CTO) and Director of Information Technology (IT) at the following location:
CTO and Director of Information Technology
3.0 NETWORK SYSTEMS: Employees at Lewis-Clark State College have access to the college’s Local Area Network (LAN). While this access yields extensive benefits including data sharing and transfer, resource/hardware sharing, and access to the Internet; access to the network also poses several security risks. Specific policies related to LAN Security include:
· PASSWORD MANAGEMENT: Access to LCSC’s LAN Domain is controlled by login requirements including a valid Username and Password. Usernames are assigned by the IT Department using approved naming standards.
The account/user naming standard at LCSC
is: <First letter of first name, Middle Initial, Entire Last Name> For example: The User Name for John Q. Public would be <JQPUBLIC>
Password requirements are as follows: o Format: Domain Passwords are required to meet the following minimum format: § 6 characters in length § Passwords may not contain your username or any part of your full name § Passwords must contain characters from at least 3 of the following 4 classes: o Upper case letters (A,B,C,.....Z) o Lower case letters (a,b,c,.....z) o Numerals (0,1,2,3,...9) o Non-alphanumeric(special characters) (Punctuation Marks and other symbols)
o Expiration & Reuse: LAN passwords expire after 90 days and must be changed at that time. No passwords that have been used in the previous 6 password cycles can be reused.
INTERNET ACCESS: All employee and laboratory/classroom computers at LCSC are provided with Internet access. Policies governing the usage of Internet access from LCSC are included in the LCSC Appropriate Use of Technology Guidelines.
Policies governing access to Lewis-Clark State College’s LAN via the Internet are outlined below:
· FIREWALL MANAGEMENT: Lewis-Clark State College’s Internet Firewall is managed by the Network and Client Services Division of the IT Department. This Division is tasked with assuring that the Firewall Configuration is managed to provide maximum security for the college, while allowing faculty and staff to accomplish their assigned jobs. Complete documentation and configuration of the LCSC Firewall is maintained by this division.
· FIREWALL CHANGE REQUESTS: Occasionally, changes to the configuration/conduits of the firewall are required. Users requesting changes to the firewall configuration are required to submit a request via the IT HelpDesk, including at a minimum the:
o Description of the requested change o Justification for the change o Required date of change o Expiration of change (if the requested change is temporary in nature)
The HelpDesk will log the change, and submit the request to the Network and Client Services Division. All changes to the Firewall Configuration are to be documented and approved in accordance with the IT Configuration Management Plan.
WIRELESS ACCESS: (Under Development) The security guidelines and policies related to wireless networking at LCSC will be developed and implemented in parallel with the design and installation of Campus-Wide Wireless technology scheduled for fall 2002.
4.0 DESKTOP AND CLIENT SYSTEMS: Desktop computers are critical to most functions at LCSC, and nearly every employee has a desktop computer or laptop with LAN and Internet Access, as well as stand-a-lone computing capability. As a result, these systems not only represent a major productivity tool for the college, if not addressed properly they also represent a significant security risk. Specific security policies related to desktop/client computer systems (other than laboratory or classroom computers) include.
A complete inventory of all desktop computers and related equipment is maintained by the IT Department as part of the Track-It Database.
5.0 ENTERPRISE APPLICATION LEVEL SECURITY:
5.1 ELECTRONIC MAIL & LCSC MESSAGING SYSTEMS: Lewis-Clark State College’s email and messaging services are provided using Microsoft (MS) Exchange, using MS Outlook as the primary email/messaging client.
· PASSWORD MANAGEMENT: Access to Lewis-Clark State College’s email system is managed as part of the overall Network Domain for the college. As a result, users have a single User ID and Password for access to the network, to email, and to the Windows based File Servers. Information on password management is available in Section 3.0 (Network Systems).
· SHARED EMAIL/CALENDAR ACCESS: The sharing of email and calendar access is a useful tool within Microsoft Exchange, but can be a security risk if handled inappropriately. The following guidelines outline the policy regarding granting shared email and/or calendar access.
o General Security: § Default configuration is that no individual is granted access to another individual’s calendar details. § This configuration can be modified, only by permission of the calendar owner to which access is being shared. § The access level is determined and set by the calendar owner. § Mailbox access is not to be shared unless established by the owner of the mailbox. § The IT Department will not modify any mailbox or calendar to allow access without the expressed/written consent of the calendar/mailbox owner. (Email notification/approval is acceptable).
o Calendar Detail Access: § All individuals at LCSC are granted permission to see all free and blocked out times on other calendars. § No individuals are granted access to view the details of the calendar unless authorized by the calendar owner.
5.2 DATATEL COLLEAGUE SYSTEM: The Lewis-Clark State College Enterprise Resource Planning (ERP) system is Datatel’s Colleague application. This application resides on the IBM RS-6000 Servers and contains critical information in the following areas (but not limited to):
As a result of the sensitive and confidential nature of the information, and the critical service that Datatel Colleague provides to the operation of the campus, control of access to the system, the application, and the data is of critical importance. Key security policies and guidelines related to the Datatel Colleague environment are as follow:
APPLICATION/ACCOUNT LEVEL PASSWORD MANAGEMENT: All users, except those with Root Access, of the Datatel Colleague application require an application level User ID and Password. The following password management requirements are implemented for all non-Web Advisor accounts to Datatel Colleague.
SYSTEM LEVEL (ROOT) PASSWORD MANAGEMENT: Root Level access to the Datatel Colleague server is limited to the three Programmer-Analysts of the IT Department. To assure proper management and continued access to the server, the Root Password does not automatically expire and require mandated change. Password management guidelines for the Root Password are as follow:
The Root Level password must be changed when one of the following criteria exist;
o Power Users: The Power User level has significant access and capability in the Datatel Colleague environment, and has the ability to manipulate data outside of their specific area of involvement. For this reason, granting of Power User access can only be authorized by a majority vote of the Datatel Advisory Committee.
o IT Programmer-Analyst Users: The highest level of access (full access at all levels) is reserved for the Information Technology (IT) Programmer-Analysts. The approval of access at this level is granted by the CTO and Director of Information Technology.
5.3 CAMPUSCRUISER (LCWarriorMail): CampusCruiser is the email, messaging, and portal system maintained via TimeCruiser, an Application Service Provider (ASP). Security and acceptable usage of the CampusCruiser application is controlled by TimeCruiser and is documented in the following documents, which are available on the CampusCruiser website:
· CampusCruiser Terms of Usage · CampusCruiser Privacy Statement
In addition to the guidelines set forth by TimeCruiser, LCSC has established additional guidelines which govern all users of the LCSC CampusCruiser Site (LCWarriorMail.com). These additional guidelines apply to all users and all functions of the LCWarriorMail CampusCruiser environment. Functions included in these guidelines include, but are not limited to: Email, Announcements, Calendar events, Chat Rooms, News Groups/Postings, and Message Boards. All CampusCruiser areas used must be used for lawful purposes only. Users shall not post any material on, or transmit any material to, any area or part of the site that: (i) violates or infringes in any way the rights of any third party; (ii) is unlawful, threatening, abusive, defamatory, invasive of privacy or publicity rights, vulgar, obscene, profane, indecent or otherwise objectionable; or (iii) encourages conduct that would constitute a criminal offense, gives rise to civil liability or otherwise violates any law. Advertising or commercial solicitation may be posted on or transmitted through CampusCruiser.com only the express prior approval by TimeCruiser and the Lewis-Clark State College IT Department. Users are responsible for their own communications and for the consequences of their posting. The uploading, posting or otherwise making available in any community areas any material protected by copyright, trademark or other proprietary right is strictly forbidden unless the user is the owner or has the express permission of the owner of the copyright, trademark or other proprietary right. Users shall be solely liable for any damages resulting from any infringement of copyright, trademark or other proprietary right, or any other harm resulting from any uploading, posting or submission. Users are responsible for being in compliance with the CC Terms of Usage policy located under the Campus-General-Welcome tab. Any LCSC faculty, staff, or student found to be in violation of CampusCruiser or LCSC guidelines for use of CampusCruiser will have their accounts terminated pending a full investigation. Users may petition for re-instatement of their account via sending a letter to the following address:
CTO & Director of Information Technology Lewis-Clark State College 500 8th Avenue Lewiston, ID 83501-2698
6.0 ACCOUNT REQUESTS AND APPROVAL: (Information in this section does not supercede request and approval requirements outlined in specific areas of this document for systems and applications. Please refer to specific areas for additional guidelines). Requests for accounts on general LCSC systems and applications, or on the LCSC LAN must be submitted via formal processes for review and approval. Requesting and approval of accounts is as follows:
The HelpDesk Specialist then enters the appropriate HelpDesk calls for each specific area requested, outlining the level of access requested and the justification/authorization for the request.
o Network, email, and file server accounts are recreated by the Network and Client Services Division. o Telecommunication access/phone is created by the Network and Client Services Division. o Datatel accounts are created by the Application Services Division. o CampusCruiser account levels are established by the LCWarriorMail Administrator.
NOTE: No individual will be provided with access to another department’s file systems without Department level approval of the department owning the directory/information to be accessed.
7.0 ACCOUNT TERMINATION: Account terminations for all systems are handled in accordance with the User Access and Account Management Process.
8.0 FILE SERVER SECURITY: File Servers at Lewis-Clark State College are used for the storage of individual, departmental, and team/project based information. Information on these servers is considered confidential, and access to these systems and directories/files is managed accordingly.
9.0 STUDENT LABORATORIES: Lewis-Clark State College maintains 2 primary computer laboratories for student usage. Information on these computers labs is available on the IT Website. Basic security parameters associated with the Student Computer Labs is as follows:
· Lab Monitors: Lab monitors are on staff at both labs during all hours that the labs are open for student usage. These monitors are present to assist students with usage, but also to assure that proper personnel are accessing the systems, that the systems are not being misused, and that systems are not being damaged or stolen. · Physical/Access Security: The student laboratories are implemented for the sole usage of current students of Lewis-Clark State College. Only students presenting a valid/current Student ID to the lab monitor will be allowed access to and usage of the systems. Upon access to the labs:
The Student Laboratory in the Sam Glenn Building (SGC-B127) also has electronic surveillance. Refer to the section on overall IT Physical Security for information on this topic.
· Data Security: Student data at LCSC is not maintained on a central file server. All systems accessible by students is equipped with a Zip Drive. Students are notified to save all their information on a Zip Disk for security, backup, and easy access when off campus.
10.0 CENTRAL COMPUTER AND IT FACILITY PHYSICAL SECURITY:
· FACILITY SECURITY AND MONITORING: Physical Security of key Information Technology Facilities is critical to assuring continued reliable service to IT customers, and for the protection of expensive and critical IT components. Various levels of physical security exist depending on the facility need. Security requirements for various facilities are as follow:
o Electronic Monitoring: Electronic monitoring will be in place in the following locations, at a minimum. Additional IT locations may be electronically monitored, as determined: § SGC-B106: Foyer/Conference Room for IT Programmer/Analysts and Central Computer Facility § SGC-B106A: Central Computer Facility § SGC-B101: Desktop/Network Technician Center § SGC-B127: Student Laboratory
o Code Key Entrance Systems: The following locations, at a minimum, will be equipped with Code Key entrance locks. Additional IT locations may be equipped with Code Key systems, as determined necessary: § SGC-B106: Foyer/Conference Room for IT Programmer/Analysts and Central Computer Facility § SGC-B106A: Central Computer Facility § SGC-B101: Desktop/Network Technician Center § SGC-B102: Information Technology HelpDesk, and Network & Client Services Office § SGC-B126: Student/Instructional Laboratory § SGC-B127: Student Laboratory
Codes are assigned to specific individuals, so there is not a single code that is available to all users. As a result, code changes/deletions are considered to only be necessary under the following circumstances: § An individual believes or it is determined that their code has been compromised. Their code will be changed. § An individual leaves the college, or takes a new position within the college than no longer warrants access to these locations. Their code will be removed and a new code will not be assigned. Notification of personnel leaving the college, and the removal of their code, is handled via the User Access and Account Management Process.
o Key Access: Most offices and remaining IT Facilities which do not have Code Key Systems are required to have key access. These facilities include, but are not limited to the following: § IT Offices § Network Communication Closets and related rooms. § Telecommunications Switch Room
Authorization: Only the CTO and Director of Information Technology may grant authorization for any individual at LCSC to have access to any of these IT facilities. Physical production and management of keys is handled by the Lewis-Clark State College Security Department, and will only provide keys to individuals upon written authorization for the IT Director.
11.0 VIRUS PROTECTION: Protection of Lewis-Clark State College’s critical applications, data, and systems from viruses is a critical component of security at the college. The Information Technology (IT) Department is assigned the responsibility to assure that adequate tools and technology are in place to minimize the potential for any damage resulting from a virus. Individuals on the campus all have responsibilities to assist in minimizing this risk:
12.0 DATA CONFIDENTIALITY
FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT (FERPA):
You are accessing student information that is protected by Federal Privacy Law. Disclosure is allowed to school personnel with a legitimate educational interest in the student. Information regarding any person’s record should be released to a third party ONLY by the Office of the Registrar. If there is an emergency need to contact a student, do not give the student’s location on campus or address/telephone information. Please call the Registrar at extension 2875.
GRAMM-LEACH-BLILEY ACT (GLBA):
13.0 ACCESS TO RESTRICTED INFORMATION: The Information Technology (IT) Department at Lewis Clark State College employs staff and student workers (Irregular Help). Many of these employees have access to information and data stored on desktop computers, file servers, and other systems such as the college’s Datatel Colleague application. Many employees also have access to passwords and other information which could allow them access to confidential information.
These employees have access to sensitive and restricted information ranging from student, staff, and faculty passwords; personal information; and other information ranging from financial to academic records. Much of this information is restricted by the Family Educational Rights and Privacy Act (FERPA) and the Gramm-Leach-Bliley Act (GLBA) as identified in Section 12.0.
Employees are instructed that information is only to be accessed as required in the accomplishment of their assigned duties, and that no information is to be accessed unless it is absolutely necessary. In addition, no information accessed and viewed is to be disclosed to anyone other than those individuals that have a definite need to know with regards to the IT work being undertaken. Any information that must be produced in hardcopy is to be destroyed by shredding so that it is not available for public viewing.
In addition, all staff and irregular help with access to confidential information or data are required to sign the IT Confidentiality Agreement, stating that they understand the security and confidentiality implications of their position. The IT Confidentiality Agreement form is available online and a hardcopy of the document is included as Appendix A. Signed copies are maintained at the IT Main Office with the IT Administrative Assistant.
14.0 DATA BACKUPS AND RECOVERY: Backing up all critical information at Lewis-Clark State College is an important component of data security, and in assuring that any negative impact is minimized in the event of a system failure, or a major disaster affecting IT. As a result, the following guidelines are implemented:
Lewiston, ID
NOTE: Daily backups for the Datatel Colleague application/system are removed the same day and stored as noted above. Daily backups for non-Datatel Colleague systems are stored in the Data Center Fireproof Safe for one night, before being transferred to the locations noted above.
Retention Periods: Backed up information from the LCSC servers are retained for the following retention periods, upon which time tapes are recycled and reused.
· Daily Backups: 3 days · Weekly Backups: 3 weeks · Monthly Backups: &n |
