Table of Contents. Routine Access User Manual

Transcription

1 Table of Contents Routine Access User Manual Routine Access to Secure Server... 2 Eraser Settings (Suggested One-time set up)... 6 Unencrypt a Folder Within Your Project Encrypting Data Using 7zip: typical Use Time Saving Tips for Using 7zip Strategies for Efficient Data Management Closing the Session Masking Data

2 Routine Access to the Secure Server (all users) STEP 1: VPN into the UNCO Privileged through Pulse Secure Note: If on campus you will not need to connect through Pulse Secure Open up Pulse Secure click connect Select the UNCO Privileged and click connect Enter your UNC username and password 2

3 Step 2A: Connecting from Remote Desktop to the Secure Server (PC users) Open the search bar on your computer (click start button on Windows 7) and type in Remote. This will bring up a list, select Remote Desktop Connection Secure Server Name: iteiiapp01 type this in the box next to Computer: Click Connect after you type in the computer name Type in your UNC user name and password then click OK 3

4 Step 2B: Connecting from Remote Desktop to the Secure Server (Mac users) Double Click on the Microsoft Remote Desktop icon Under My Desktops, double click on ITEIIAPP01 4

5 Click Continue when the box below appears Step 3: Your DUO APP will alert you on your phone Open the DUO app and click APPROVE to the pending request. Approve promptly or this step will time out. 5

6 Step 4: Welcome to the Secure Server Your Project Folder is located in Volume (E:) Eraser Settings (Suggested One-time Setup) Eraser settings are unique to each individual user account, this process can t be set up by an administrator. Only you can change these settings for your account. We use eraser on each visit within the virtual server that permanently erase files and folders. To improve efficiency and speed you need to change the initial settings. 6

7 Step 1: Click the arrow in the bottom right hand corner Step 2: Double click on the eraser icon 7

8 Step 3: Click on Settings Step 4: You will need to change the Default File Erasure Method 8

9 Step 5: Use the drop down to select US DoD M (3 passes) Step 6: Click Save Settings 9

10 Unencrypting a folder within your project The folder structure with each project folder follows: a) Source Data Folder b) Export Folder c) First.Last Folder for Each User With the exception of the Export folder, each folder within the project folder will be encrypted separately with the same password as determined by the PI. This way, no one s data ever gets lost due to a forgotten password, the PI can access all folders within their project at any time, and even server administrators cannot access restricted use data (because they won t have the project-specific password). The Export folder should never be encrypted, although sensitive files that are being transported should be encrypted before being placed in the Export folder. The entire project folder should never be encrypted. When you need to access both the source data folder and your First.Last folder at the same time, you will need to unencrypt both folders. Be sure to leave sufficient time at the end of your work session to properly re-encrypt and erase files from both folders. Step 1: Opening your 7-zip encrypted archive Go to the (E:) drive where your project folder is located Select your Project Folder for this example we will use First.Last Inside your project folder, unencrypt the folder(s) that you intend to work in. 10

11 Step 2: Right Click on your archive and hover over 7-Zip and click Extract Here Enter your password then click OK 11

12 This will extract all the files from the encrypted archive to a new First.Last user folder within the project folder. Your First.Last folder is now available for you to Party With Your Data! (or to do work, depending on how the day feels). If you are making changes in your first.last folder (adding, changing, or deleting files), delete the old 7zip archive. Because it is encrypted so no one can read it, you can use the regular delete button and send it to the recycle bin. If you are in doubt about whether something should be deleted to the recycle bin or erased, please use eraser. Encrypting Data using 7-Zip: typical use At the end of your work session, be sure to leave enough time to close up shop properly by re-encrypting your folder and Erasing all unencrypted data. 7zip will allow you to encrypt (scramble so others can t read) and compress (shrink) your files using the project password. Encryption is a best practice and required by many data use agreements. To begin, confirm that you have deleted your previous 7zip archive. Remember, it can go into the recycle bin because no one can read it. Then right click on the folder that needs encryption. In this example, we encrypt the Source Data folder for a project called Test Project. Typically, however, you will be encrypting your First.Last folder. 12

13 Step 1: Scroll to 7-Zip then to Add to Archive Step2: On the screen below the only task that you need to complete is Set Your Password. THIS IS AN ESSENTIAL STEP. If you do not set the password, your data will compress but not encrypt. Always use the project password provided by the PI. There is no way to recover passwords, so be sure you enter the project password correctly. Once finished click OK. 13

14 Step 3: 7-Zip makes a copy of your data files and puts them in a.7z encrypted archive. The next screen shot shows you what your folder looks like after the 7-zip archive is created. Please note 7zip may be slow depending on how big the files are that need to be encrypted. Step 4: To complete the process, after 7zip is done, erase the original unencrypted Test Project Source folder. Right click on the folder, highlight Eraser, and click Erase. Do not start erasing until 7zip is done creating the encrypted archive. 14

15 Step 5: Eraser will permanently erase your unencrypted files so that they cannot be recovered by you or anyone else. The system will ask you one more time to make sure. Click Yes This process deletes and repeatedly overwrites the unencrypted Test Project Source folder so that it cannot be reconstructed. The size of your folder will determine how long 7zip and eraser take. If using eraser is extremely slow, changing the settings in eraser will help improve the speed of deleting files permanently by reducing the number of times the data are overwritten. Time Saving Tips for Using 7zip 1) If you extract your 7zip archive to review a document but are not making any changes, you do not need to re-create the 7zip archive. Simply erase the unencrypted folder using Eraser. 2) If you want to add files to an archive without unencrypting the archive You might want to do this, for example, if you are a PI with new source data. You have a 15

16 colleague who needs to access the new file promptly but you don t have time to unencrypt, add the new file, and re-encrypt the archive at the moment. Step 1: right click on file and select add to archive. In this example the file name is new file and the 7zip encrypted folder is first.last.7z Step 2: Use the dropdown to find the 7zip file that you want to add the new file. Be SURE to set password. If the password is not set then the file will not be encrypted. 16

17 Step 3: Notice that the file is still outside of the first.last.7z folder. 7 zip creates a copy of the file and doesn t delete this file. You will need to erase this file after you make sure that the file is inside of the archive in step 4. Step 4: In order to view that the new file was added to the 7 zip folder right click on the 7 zip folder and select open archive. This is a great option that can be used at any time to view what files are inside the 7 zip folder. 17

18 Step 5: The new file is now in the archive. Notice that you cannot put the folder in the archive, only into the main area. To make sure that this file is encrypted you can double click on the file and if the file is encrypted you will be prompted to enter a password. If the file is not encrypted it will open up. Strategies for Efficient Data Management Your data use agreement likely requires encryption at rest, and the secure server uses 7zip to accomplish this. The 7zip encryption process is used during every visit to the secure server and the efficiency and speed of extracting and re-encrypting your data depends on the size of the encrypted 7zip container. Below are some examples of strategies to use in your first.last work folder. For example, lets pretend that you have a meeting that starts at the top of the hour and while working on the secure server you have not planned far enough ahead to start erasing and encrypting all of your files to be ready for the meeting on time. You are toast for this time, but with a little advance planning, you won t find yourself in the same situation again. Encrypt data you re not currently working with into a separate 7zip archive If you are finished with data sets and are not currently working on them, you can set them aside in a separate encrypted folder. For example, when building an analytic dataset you may have to create some interim datasets to get to a final data set. If you re using all of these datasets in your first-last working folder, extracting the files and re-encrypting them might be a slow process. A strategy to speed this process up is to encrypt the interim datasets you are not currently using into a separate 7zip container. 18

19 This will improve the speed of the 7zip encrypted container you are currently working on. Erase temporary files as you work The speed of encrypting using 7zip depends on the size of your files. Keeping your folders up to date by erasing temporary files as you work instead of waiting until the end of the session will improve your time management while working on the secure server. Closing the Session Log Off the Virtual Machine Logging off the virtual machine is crucial to maintaining optimal functionality of the server for all users. After you have re-encrypted any and all folders, erased all unencrypted data, and closed all your programs, click on the windows explorer button in the bottom left corner of your screen. 19

20 Step 1: Right Click on your name and select Sign Out Your session on the EII virtual server will now be over, but you will still be connected to the UNC VPN through Pulse. If left connected, Pulse will time out and disconnect itself after several hours. Step 2: Disconnect from Pulse secure. To disconnect from the VPN, click on the Pulse icon. Then click the Disconnect button (image below is from a Mac- looks slightly different on a PC). 20

21 Masking Data FERPA requires personally identifiable information to be de-identified whenever there is public reporting of personally identifiable information from an education record including: race/ethnicity, gender, poverty (eligible for free and reduced lunch program), eligibility or participation in Special Education or other programs, student achievement, and assessment data. According to the FERPA guidance, masking of data must be sufficient so that it is not possible for a reasonable person in the school community who does not have personal knowledge of the relevant circumstances to identify individual students based on reasonably available information including other public information released by the agency, such as a report presenting detailed data in tables with small size cells. In our examples we follow CDE's requirement that all sample sizes 16 be masked. Please refer to your data use agreement for sample size requirements applying to your data. Masking is used to protect personally identifiable information when the number of students in a group is small. Colorado Department of Education masks all numbers when there are 16 or fewer students in a group. Masking Examples: Reporting Table 1 shows all data accessible by a PI with authorized access to personally identifiable data. As shown, it would be a violation of FERPA to remove this table from the secure machine. EXAMPLE 1: Summary Table Visible to User with Access to PII Below % White 30 (21%) Black 23 (34%) Asian 4 (11%) Meets % 73 (50%) 42 (62%) 13 (34%) Exceeds % 42 (29%) 3 (4%) 21 (55%) Total Masking small cell sizes allows the essence of the table to be reported publicly while still protecting individual privacy. In addition to protecting personally identifiable information of groups with 16 or fewer students, data must be masked in charts or other presentations so that no single student could be identified, including through inference or discovery. Performance Level Reporting When reporting student performance on assessments in levels All data are still masked for groups of 16 or fewer MASKING EXAMPLE 1: View after Data is Masked for Public Reporting Below Meets Exceeds Total White % 50% 29% Black * 42 * 68 62% Asian * * 21 55% 38 21

22 Notes for Example 1 All cells are reported for White because they all meet the criteria Exceeds has 3 Black students but Below needs to be masked also to protect student identities Both Below and Meets are less than the criteria and are masked in Asian EXAMPLE 2: Summary Table Visible to User with Access to PII Below Meets Exceeds Total White (20%) (25%) (55%) Black (12.5%) (50%) 37.5% Asian 5 (33.3%) 5 (33.3%) 5 (33.3%) 15 MASKING EXAMPLE 2: View after Data is Masked for Public Reporting Below Meets Exceeds Total White (20%) (25%) (55%) Black * 20 * 40 (50%) Asian * * * 15 Notes for Example 2 All cells are reported for White because they all meet the criteria Both Below and Exceeds are less than the criteria and are masked for Black No cells are reported for Asian because the total is below 16 22