Page History

ROWAN UNIVERSITY POLICY

Title: Encryption Policy
Subject: Information Security
Policy No: ISO:2016:05 
Applies: University-

...

Wide
Issuing Authority: Senior Vice President for Information Resources and Chief Information Officer
Responsible Officer:

...

 Director of Information Security
Date Adopted: 04/01/2016
Last Revision: 07/03/2018
Last Review: 07/03/2018

I.  PURPOSE

The purpose of this policy is to provide Rowan University communities guidance on the use of encryption to protect Rowan University's information resources that contain, process, or transmit confidential and or sensitive information.

...

1. It is the policy of Rowan University to employ encryption to mitigate the risk of disclosure or alteration of confidential and or sensitive information within Rowan University's information systems infrastructure or through outsource services example "Cloud Storage Services and or Software as a Service".
2. Requirements:
1. All laptop computing devices owned by Rowan must employ whole disk encryption, as defined in this policy, to protect University data regardless to how sensitive this data is.
2. All Rowan University owned and BYOD desktop computing devices containing Rowan's confidential and/or sensitive data must employ whole disk encryption, as defined in this policy, to protect this data.
3. All Rowan University owned and BYOD Mobile devices such as Personal Digital Assistant (PDA), Tablets and Smartphones containing Rowan confidential and/or sensitive data must employ encryption, as defined in this policy, to protect this data.
4. Databases, network shared systems which would include but be limited: (Container, Volume, Files, Folders, etc.)
   1. Sensitive data not housed in a University approved datacenter must be encrypted.
   2. Data in motion: End user facing connections over which confidential or sensitive data may be exchanged should be encrypted in transit when leaving a datacenter in order to prevent unintended exposure of data where technically practicable.
5. All portable media containing Rowan University confidential and/or sensitive data must employ encryption, as defined in this policy, to protect this data.
6. All data contained within email classified as confidential or sensitive leaving Rowan University's managed datacenters must employ encryption in transit where technically practicable, as defined in this policy, to protect this data in transit.
7. Portable computing devices and desktop computing devices that contain Rowan confidential or restricted data solely in transient data files (i.e. files that do not remain on the computing device after a system power down or reboot) are not required to employ whole disk encryption to protect the data, but it is highly recommended to do so when feasible.
8. Encryption implementation standard
1. Only encryption solutions approved by the Offices of the Chief Information Officer and Director of Information Security may be utilized to satisfy the requirements of this policy.
2. The whole disk encryption solution will centrally manage whole disk encryption client software for all systems, including encryption format, key management, and logging.
3. The use of encryption to protect a data asset will be the result of a data classification decision made by the data owners. The requirement to use or not use encryption will be based on the classification level assigned to a data asset. The classification level assigned to a data asset will be based on the university Data Classification Policy.
4. Based on the classification level assigned to a data asset, data at rest shall be encrypted in accordance with the university Data Classification Policy when the data does not reside in a Rowan University managed and physically secured data center.
5. Based on the classification level assigned to a data asset, data in transit, external to Rowan University managed data centers, shall be encrypted in accordance with the university Data Classification Policy.
6. The exporting or international use of encryption systems shall be in compliance with all United States federal laws (especially the US Department of Commerce's Bureau of Industry and Security's Export Administration Regulations) or appropriate international laws.
7. Technology owner will maintain documented procedures for supported cryptographic algorithms, by data classification level, based on documented baselines provided and maintained by the ISO. Technology owner procedures may include accommodations for each technology agreed upon between technology owner and ISO.
8. The Technology Owner, in accordance with ISO standards, will maintain documented procedures for cryptographic key management which include documentation on the processes of:
   • Generating cryptographic keys
   • Distributing cryptographic keys
   • Escrowing cryptographic keys
   • Enabling authorized users to access stored cryptographic keys
   • Changing and updating cryptographic keys
   • Revoking cryptographic keys
   • Archiving cryptographic keys
   • Auditing and logging cryptographic key management
9. Rowan University retains the right to decrypt data using the centrally maintained key(s) to support operational requirements or when approved by the ISO, CIO or general counsel.
9. Deployment responsibilities
   1. It is the responsibility of the Data Owner and Technology Owner to ensure that systems requiring encryption are identified, and that encryption is properly deployed on these systems
10. End user responsibilities
1. Users must report any known, unencrypted restricted data on portable computing devices to IRT support staff and request assistance in removing the data or acquiring encryption software.
2. Users must not attempt to disable, remove, or otherwise tamper with the encryption software
3. Special Circumstances for RowanSOM
   1. Due to the highly confidential and/or sensitive nature of data used at the Rowan University School of Osteopathic Medicine (RowanSom), all devices, including but not limited to those referenced above in sections E through F, must employ whole disk and USB encryption.
   2. EXCEPTIONS TO SPECIAL CIRCUMSTANCES
      1. Any RowanSOM device which has the sole purpose of serving multiple users (not assigned to an individual, i.e Classroom/Lab devices) is explicitly exempt from having USB encryption enabled, provided the machine is not used to read, store, or access confidential and/or sensitive data.
      2. Documentation of these devices must be communicated to the Information Security Office (ISO) in writing at the time the device is placed into service or before the USB encryption has been disabled. The ISO will maintain a master list of all devices for which USB encryption has been disabled.
      3. Any exception that does not meet the above requirements must be approved by the ISO. All requests must be made using the Rowan Policy Exception form and be submitted to the ISO for approval by the Director of Information Security.
4. NON-COMPLIANCE AND SANCTIONS
   1. Violation of this policy may subject the violator to disciplinary actions, up to or including termination of employment or dismissal from a school, and may subject the violator to penalties stipulated in applicable state and federal statutes. 
       
      By Direction of the CIO:
      
      __________________________________
      Mira Lalovic-Hand,
      VP SVP and Chief Information Officer