a. General Statement of Policy
It is the policy of the UW to ensure the security, availability,
privacy, and integrity of its information
systems, networks,
and data and to ensure full compliance with all applicable federal and
state statutes and regulations.
All providers and users of UW computing services, resources,
and data are required to comply with all established policies, guidelines,
and procedures, including applicable federal and state statutes and regulations.
The general policy outlined in this section is the foundation
for all other policy statements, guidelines, and procedures that are developed
and implemented within UW computing environments.
b. Monitoring User Accounts, Files, and Access
The UW does not routinely inspect or monitor the use of computers.
However, the normal operation and maintenance of UW computing and network
resources require authorized UW staff to back up and cache data and communications,
log activity, monitor general usage patterns, and perform other activities
that are necessary for the delivery and availability of service.
Receipt of a report or discovery of inappropriate or unauthorized
use of computing and network resources may trigger monitoring and investigation
by authorized UW staff.
UW systems owners and operators may specifically monitor
the activity of individual users including files, session logs, content
of communications, and Internet access without notice, when:
The user's activity prevents access to computing and network
resources by others.
General usage patterns indicate that unacceptable activity
is occurring.
There is reasonable cause to believe that a user has violated
or is violating policy or law.
It appears necessary to do so to protect the UW from liability.
It is required by and consistent with law.
Evidence of misuse of computing resources will be referred
to appropriate UW officials. Evidence of possible criminal activity, which
could include user files, email, and/or activity logs, will be turned over
to appropriate UW and law enforcement officials.
c. Electronic Data and Records Management
Much of the vast amount of electronic data generated throughout
the University comprises official UW records and requires
specific management and handling practices and procedures as defined by
the UW and state law.
All UW system owners, operators, data
custodians, and users are obligated to understand the nature of the data they generate, use,
or store and to ensure that they are managing that data in full compliance
with all state laws and UW records management policies. All UW system owners,
operators, data custodians, and users are required to properly manage and
protect electronic data they may be using, transmitting, and storing.
UW Records Management Services is the primary resource for
information and support regarding these obligations. Specific information
regarding what is defined as an official record of the UW, as well as retention,
destruction, and archival requirements, is available through UW Records
Management Services.
The University privacy officer and the UW Electronic
Information Privacy Policy on Personally Identifiable Information are
the primary sources for direction and information regarding personally
identifiable information.
The document named UW Guidelines for Implementing Systems
and Data Security Practices contains a table of security measures commensurate
with data categories.
d. Access Controls
The UW has hundreds of different computing environments hosted
on University networks, and within UW departments, schools, and business
units. These environments require different security measures. Consequently,
access control measures required for
establishing users' access to any UW computing resources should be commensurate
with
the functional nature and degree of criticality of the computer
systems, network resources, and data involved.
All system owners, operators, and data
custodians are responsible
for ensuring that their systems are properly protected with appropriate
access control measures based on the criticality of their systems and the
data involved. The document named UW Guidelines for Implementing Systems
and Data Security Practices provides direction on how to define the appropriate
security measures for computing systems.
In addition, all computing systems hosted on UW networks
must support and comply with the following fundamental access control measures,
functions, and operating principles:
Systems are required to have an access control mechanism that
allows for an appropriate level of authorization and
allocation of system and data resources to individual users. Access mechanisms
can be physical, transaction-based, role-based, time-based,
user-based, or use any other reasonable control method appropriate
for the systems' functions.
Shared systems are required to have the capability to log
basic information about user access activity and to create
historical logs and access violation reports.
System access accounts for users must be based on a unique
identifier, and no shared account is allowed except as authorized
by the system owner or operator and where appropriate accountability
can
be maintained.
Users' system access must be based on the principle of least
privilege and the principle
of separation of duties.
Computer applications must be developed and integrated in
a way that maintains individual user accountability and audit
capability.
Documented procedures should be in place for issuing, altering,
and revoking access privileges on shared systems.
e. Systems and Network Security
In light of the complex and diverse nature of the different
computing environments hosted on UW networks and the wide range of statutory
and regulatory compliance requirements, all systems and network security
measures must be based upon the functional nature and degree of criticality
of the computer systems, network resources, and data involved.
All system owners and operators are responsible for ensuring
that they have implemented all necessary security measures. Failure to
do so risks creating security breeches or other incidents and could lead
to temporary restrictions or even suspension of access to UW network resources.
The document named UW Guidelines for Implementing Systems
and Data Security Practices provides direction on how to define the appropriate
security measures for computing systems.
1) |
|
Systems Security—Minimum Measures and Practices
To protect the availability and integrity of UW computing resources,
all computing systems and servers hosted on UW networks should comply
with the following systems security measures and practices:
Operating systems and applications must be maintained
with the timely application of all related
vendor-issued patches necessary to prevent
the systems from being compromised and/or causing
disruptions of network services and/or other
systems. Externally accessible systems must install antivirus
software and maintain procedures for regular
signature updates. -
Shared systems are required to have a technical access
control mechanism that
allows authorization and allocation of
system and data resources to individual users.
-
Procedures must be maintained for regular backup of all data
and system files necessary for discovery
and recovery purposes. All backup media
should be stored properly in a location authorized by
the data owner with protections that allow
access to the data by authorized personnel
only. The ability to recover data from backups should be
tested regularly.
Shared systems are required to have the capability to
log basic information about user access
activity, system changes, and events
for the possible creation of historical logs and access
violation reports. Logs must be monitored
for intrusions or attempts at unauthorized
access.
-
Systems must maintain a functioning and accurate system
clock, since it is a critical element
for the computer forensics and
system logs that are essential
for successful investigations.
-
Encryption capabilities (the ability to turn readable text
into unreadable cipher text) must be
used for systems that send or receive
personally identifiable information that
is transmitted over open networks like
the Internet or UW-owned networks.
Critical servers must be
housed in protected areas such as server
sanctuaries (locations where suitable
physical and logical security measures
can be implemented). (See UW Guidelines for Implementing Systems
and Data Security Practices.)
|
| 2) |
|
Network Security—Minimum Measures
and Practices
To protect the security, availability, and integrity of UW network
resources, all computing systems and servers hosted on UW networks
should comply with the following security measures and practices:
Support proactive vulnerability probing and reporting
by UW authorized technicians to help manage
system security needs.
-
Use secure protocols (e.g., SSL/SSH/Kerberos) for accessing
all services that require authentication.
Report all security breaches to the appropriate security
entity (C&C Security Operations, UW Medicine IT Services Security
Infrastructure Team, and/or the UW privacy officer). - Display security-warning banners prior to allowing the
access log-on process to be initiated
on systems running applications that are accessible on the UW-owned
network. These security banners
must inform all users that the system
or application being accessed is proprietary, that it should be
accessed only by authorized users,
and that system use is monitored for enforcement
purposes.
|
f. Physical Security
Physical security measures are an important
part of any effort to protect information system assets
and services. As with logical security measures at
the UW, the physical security measures required for
protecting UW computing resources must be commensurate
with the nature and degree of criticality of the computer
systems, network resources, and data involved.
The UW has a wide spectrum of information
systems deployments. They include:
Large data-center facilities.
Modest-sized server rooms.
Small sets or individual departmental servers located in
all manner of office environments.
Computer labs.
Telecommunications closets and vaults of all shapes and
sizes.
Media storage areas.
Desktop computer workstations and printers.
- Wireless and mobile systems.
These technology deployments require different physical security measures. These measures are especially important when sensitive information is involved. All system
owners and operators are responsible for ensuring that they have implemented the appropriate physical security measures for their particular computing environment. All users are required to respect the physical security measures in place.
The following physical security measures and objectives
should be implemented where applicable to protect UW computing and network
assets and sensitive information:
Physical access control measures sufficient to prevent UW
assets from unnecessary and unauthorized access, use, misuse,
vandalism, or theft.
Computer rooms and telecommunications closets located away
from heavy traffic patterns and not advertised.
-
When appropriate, physical security measures should be in
accordance with standards specified in the current edition
of the National Fire Protection Association (NFPA) publication
No. 75,
Protection of
Electronic Computing/Data Processing Equipment, and by
Occupational Safety & Health Administration (OSHA) Safety and Health
Standards. This is particularly important for data-center facilities.
Certified smoke and fire-alarm and fire-suppression systems
for data centers, server rooms, telecommunication closets,
and vaults to mitigate potential damage to UW assets in the event of
a fire.
Environmental control measures (e.g., power supply, heating,
ventilation, air conditioning, plumbing, and physical location)
sufficient to protect UW assets from preventable service disruptions
or harm.
Departmental and general access labs monitored and secured
when not open for use.
Inventory control measures (e.g., asset tags or other identification
markings) for tracking and accounting for UW assets.
Secured off-site data/media storage and procedures that
meet all archival, backup, and recovery needs for UW computing
and network operations.
Specific procedures for users of UW laptops, wireless services,
and other mobile computing devices such as PDAs to prevent
the theft or compromise of these devices.
Tools, systems, or procedures implemented to meet physical
security requirements should be selected based on their cost-effectiveness
and appropriate level of ability to protect UW assets.
g. Personnel Security Measures
This section outlines security measures
and procedures that should be established and maintained
when working with UW personnel throughout the employment
process and when dealing with vendors, contractors,
and temporary employees.
1) |
|
Measures for Hiring Employees
Comprehensive pre-employment screening is recommended for all potential
candidates for key technical positions when those positions include
an actual or potential wide span of systems control, and/or access
to sensitive information, especially personally
identifiable information or UW financial information. This screening could include checking
and confirming references, background checks for criminal convictions
(both federal and local, as necessary), and reviewing educational records
and credit reports. All hiring officials should consider using such
screening practices when hiring for key technical positions, regardless
of employee type (contract, classified, professional, academic, or
temporary).
All pre-employment inquiries must be conducted in full compliance
with official UW guidelines established by UW Human Resources and in
full compliance with state and federal laws. All hiring officials,
managers, or others must work closely with UW Human Resources when
engaging in any hiring process.
All UW departments, colleges, schools, and business units should have
procedures in place to provide new employees with information about
user responsibilities and guidelines associated with their assigned
computer and network privileges and resources, including access to
this document and related departmental policies, procedures, and guidelines.
Appropriate supervision of new employee access to systems and data
should be standard practice. New employees should be made aware that
secure computing practices will be part of their performance reviews.
All physical and logical access to computing and network facilities
and resources should be assigned in accordance with the principle of
least privilege and principle of separation
of duties.
|
| 2) |
|
Measures for Separating Employees
All UW departments, colleges, schools, and business units should establish
and maintain processes and procedures to properly and quickly close
and remove all computing system and network privileges and resources
when an employee is separated, even if the employee is going to another
job within the UW. These processes and procedures should include the
following:
The separated employee's immediate manager is responsible
for notifying all system owners and operators,
or the designated system administrator handling the computer or
communications accounts,
to close all related accounts and remove
all access capabilities related to the separated employee.
Separated employees may not retain, give away, or remove
from UW premises any UW information (electronic
or hard copy) other than personal copies of information disseminated
to the public and
personal copies of correspondence directly
related to the terms and conditions of their employment. All other
UW information in
the custody of the departing employee
must be turned over to the employee's immediate supervisor at the
time of departure. At the time of separation, all UW property must be returned.
This includes portable computers, printers,
modems, software, cellular telephones, digital pagers, PDAs, documentation,
building keys,
lock combinations, encryption keys, and access
cards.
|
| 3) |
|
Measures for Employees on Leave or Suspension
All UW departments, colleges, schools, and business units should establish
and maintain processes and procedures to properly and quickly close
and remove all computing system and network privileges and resources
when an employee is suspended or is taking an extended leave of absence
(including long-term illness or disability). It is important to use
the same security measures for suspended employees as are used for
separating employees. In addition, extended leaves
of absence may require these measures, at the supervisor's discretion,
taking into consideration such factors as level of access, nature and
scope of computer applications and permissions, and duration of absence.
|
| 4) |
|
Measures for Vendors
Vendors with access to computers and networks should meet many of
the same standards placed on employees. They should understand the
security policies and practices. Their access should be limited to
just what is necessary for them to meet their contract requirements.
When appropriate, vendors should be escorted into physically restricted
areas. When their job is complete, they should return all access devices,
and their log-on privileges should be terminated.
|
h. Policy Enforcement
Individuals who violate this policy may
be denied access to UW computing and network resources
and may be subject to other penalties and disciplinary
action within and outside the UW. Departmental managers
are expected to work with appropriate UW resources
in investigating and addressing suspected violation
of this policy. Such resources include, but are not
limited to, UW Internal Audit, UW Risk Management,
UW Police Department, departmental managers, UW Human
Resources, and Student Affairs.
The UW may temporarily suspend, block,
or restrict access to computing resources and accounts
at any time when it reasonably appears necessary to
do so in order to protect the integrity, security,
or availability of UW computing and network resources
or to protect the UW from liability. The UW will refer
suspected violations of applicable law to appropriate
law enforcement agencies.
In general:
If violations of this policy are minor and unintentional,
the UW will take appropriate actions to resolve the issue,
and violators may be subject to disciplinary measures.
If violations of this policy are a result of negligent or
deliberate acts, the UW will take appropriate actions to
resolve the issue including disciplinary measures up to and including
termination
of employment or expulsion.
- In addition to any other measures taken, if violations of
this policy are a result of suspected illegal activities,
the UW will notify appropriate University authorities and law enforcement
agencies.
The UW reserves the right to pursue appropriate legal actions
to recover any financial losses suffered as the result of violations
of this policy.
i. Policy Maintenance
This policy and the
related guidelines will be reviewed
yearly. A major security compliance
audit must take place every three
years.
