Transcription

1

2

3

4

5

6

7 Appendix B t Data Security Classificatin Plicy Allwed University Systems fr Data Security Classificatins Date f initial publicatin: June 6, 2017 Date f latest revisin: N/A St. Thmas Service r System Public / Directry Inf Internal / Prpietary Prtected PII (SSN's & Bank Accunt#) ed Identifiable Human Subject esearch Credit Card Data HIPAA Data Persnal Strage: DrpBx r Other Persnal Strage Persnal G-mail, Htmail, etc. St. Thmas Website ( St. Thmas emvable Strage (Unencrypted) St. Thmas emvable Strage (Encrypted) St. Thmas Wrsktatin Lcal Strage (Unencrypted) St. Thmas Wrsktatin Lcal Strage (Encrypted) ITSM: Web Help Desk Calendar: Office365 Yammer: Office365 File Strage: MyStrage Office365 Dcument Management: SharePint Dcument Management: OneDrive St. Thmas Intranet: Unily File Strage: AcadStre File Strage: DeptStre1 CrashPlan POe LMS: Blackbard / Canvas Banner EP (Banner INB ) Dcument Management: Optix CM: Flatbridge CM: Salesfrce CM: eheer uffal Cdy TuchNet PayPath and Marketplace Authrize.net PyraMed

8 Appendix C t Data Security Classificatin Plicy Cntrls Standards fr Data Security Classificatins User Security Standards Prtect Passwrds Different Passwrds ecurring Task? What t D Users' passwrds and ther access credentials must never be shared. Different passwrds must be used fr St. Thmas and nn- St. Thmas accunts. Date f initial publicatin: June 6, 2017 Date f latest revisin: N/A ed Strng Passwrds Cmprmised Passwrds Accessing Cnfidential Infrmatin Sharing Cnfidential Infrmatin Lss f Cnfidential Infrmatin Dispsal f Cnfidential Infrmatin Payment Card Transactins Passwrds used fr St. Thmas business must be f sufficient length and cmplexity t reasnably prtect them frm being guessed by humans r cmputers. Passwrds must be changed immediately if there is a suspicin f cmprmise. Cnfidential infrmatin must nly be accessed fr authrized purpses. Cnfidential infrmatin must nly be shared with thse authrized t receive it. Any actual r suspected lss, theft, r imprper uses f r access t cnfidential infrmatin must be reprted prmptly. Cnfidential infrmatin in any frm must be apprpriately dispsed when it is n lnger needed. All users handling credit card r debit card transactins must cmply with University Payment Plicy requirements. End Pint Security Standards ecurring Task? What t D ed Patching Apply security patches within seven days f publish. Use a supprted OS versin. Whle Disk Encryptin Enable FileVault fr Mac, r BitLcker fr Windws. Malware Prtectin Install ITS apprved and supprted anti-virus slutin and cnfiguratins. Backup user data at least daily. University prvided Backups CrashPlan is the recmmended slutin. Ensure backups are encrypted in transit and at rest. Inventry All university end pints must be tracked in the ITS inventry. egulated Data Security Cntrls Implement hardened ITS PC standard cnfiguratin n device. Server Security Standards Patching ecurring Task? What t D Based n Natinal Vulnerability Database (NVD) ratings, apply high severity security patches within seven days f publish and all ther security patches within 90 days. Use a supprted OS versin. ed Vulnernability Management Perfrm a quarterly Nessus scan. emediate severity 4 and 5 vulnerabilities within seven days f discvery and severity 3 vulnerabilities within 90 days. Credentials & Access Cntrl Firewall eview existing accunts and privileges quarterly. Enfrce passwrd cmplexity. Enable hst-based firewall in default deny mde and permit the minimum necessary services. Inventry Physical Prtectin Multifactr Authenticatin Centralized Lgging All university servers must be tracked in the ITS inventry. Place system hardware in a secure data center r ITS apprved hsted lcatin. equire multifactr authenticatin fr all interactive user and administratr lgins. Frward security event lgs t a remte lg server. University IT Splunk service recmmended.

9 Malware Prtectin Install ITS apprved and supprted anti-virus slutin and cnfiguratins. Intrusin Detectin Enable firewall and IDS rules t allw nly required traffic. eview alerts as they are received. Sysadmin Training Attend ITS server admin security training annually. Dedicated Admin Wrkstatin Access administrative accunts and systems nly via a certified Priviledge Access Wrkstatin. Security, Privacy, and Legal eview equest a Security, Privacy, and Legal review and implement recmmendatins prir t deplyment. egulated Data Security Cntrls Implement PCI DSS, HIPAA, r exprt cntrls as applicable. Applicatin Security Standards ecurring Task? What t D ed isk Assessment Applicatin is put thrugh ITS risk assessment prcess prir t aquistin. All identified risks must be accespted by the Data Owner(s). EDUCAUSE HECVAT r HECVAT Lite are preferred assessement tls. Patching Based n Natinal Vulnerability Database (NVD) ratings, apply high severity security patches within seven days f publish and all ther security patches within 90 days. Use a supprted OS versin. Vulnerability Management Inventry Firewall Credentials and Access Cntrl Multifactr Authenticatin Centralized Lgging Sysadmin Training Perfrm a quarterly Nessus scan. emediate severity 4 and 5 vulnerabilities within seven days f discvery and severity 3 vulnerabilities within 90 days. Applicatin is added t the ITS Applicatin Inventry Database. Enable hst-based firewall in default deny mde and permit the minimum necessary services. eview existing accunts and privileges quarterly. Enfrce passwrd cmplexity. Lgins with UST dmain accunts whenever pssible. equire multifactr authenticatin fr all interactive user and administratr lgins. Frward lgs t a remte lg server. University ITS Splunk service recmmended. Attend at least ne Stanfrd Infrmatin Security Academy training curse annually. Intrusin Detectin Enable sftware-based firewall and IDS rules t allw nly required traffic. eview alerts as they are received. Physical Prtectin Applicatin is hsted in a UST data center r ITS apprved hsting slutin. Dedicated Admin Wrkstatin Access administrative accunts and systems nly via a certified Priviledge Access Wrkstatin. Security, Privacy, and Legal eview equest a Security, Privacy, and Legal review and implement recmmendatins prir t deplyment. egulated Data Security Cntrls Implement PCI DSS, HIPAA, r exprt cntrls as applicable.