The new version of MAC OS X, 10.10 (Yosemite) is expected to be released today, Thursday October 16th, and is currently incompatible with the ClearPass registration system and potentially other services at Rowan.

University Policies

University Policies

Page tree

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 6 Next »

ROWAN UNIVERSITY POLICY


Title: Workstation Use and Security Policy 
Subject: Information Security 
Policy No: ISO: 2013:03                                                                       
Applies: University-Wide
Issuing Authority: Information Security Office - Director of Information Security
Responsible Officer: Vice President for Information Resources and Chief Information Officer                              
Adopted: 07/01/2013
Amended: 06/01/2014
Last Revision: 08/08/2018

I. PURPOSE

This policy specifies the appropriate use and security applicable to ROWAN’s workstations. 

II. ACCOUNTABILITY

Under the direction of the President, the Chief Information Officer and the University’s Director of Information Security shall implement and ensure compliance with this policy.

III. APPLICABILITY

This policy applies to all members of the ROWAN community.

IV. DEFINITIONS

  1. Administrative Safeguards – administrative actions, and policies and procedures to manage the selection, development, implementation, and maintenance of security measures to protect the University’s information assets and to manage the conduct of the University community in relation to the protection of those information assets.
  2. Availability – the expectation that information is accessible by ROWAN when needed.
  3. Confidentiality – the expectation that only authorized individuals, processes, and systems will have access to ROWAN’s information.
  4. Information System – consists of one or more components (e.g., application, database, network, or web) that is hosted in a University campus facility and which may provide network services, storage services, decision support services, or transaction services to one or more business units.
  5. Integrity – the expectation that UMNDJ’s information will be protected from improper, unauthorized, destructive, or accidental changes.
  6. Physical Safeguards – physical measures, policies, and procedures to protect the University’s information assets from natural and environmental hazards, and unauthorized intrusion.
  7. Removable Media – including, but not limited to, CDs, DVDs, storage tapes, flash devices (e.g., CompactFlash and SD cards, USB flash drives), and portable hard drives.
  8. Technical Safeguards – the technology and the policy and procedures for its use that protect the University’s electronic information and control access to it.
  9. ROWAN Community – faculty, staff, non-employees, students, attending physicians, contractors, covered entities, and agents of ROWAN.
  10. Workstations – desktop computers and laptops.

V. POLICY

ROWAN’s workstations are provided by the University for business, academic, and research use. They must be used in accordance with the University’s policies and secured against unauthorized access.

In order to protect the confidentiality, integrity, and availability of ROWAN’s electronic information and information systems, activity may be reviewed, logs captured, and access monitored without notification.

A. Requirements

  1. Workstation Use 
    1. Removable Media:  Connecting personal removable media, particularly portable hard drives and USB thumb drives, to ROWAN workstations is prohibited.
    2. Users must not save on workstations information classified Confidential, Private, or otherwise considered sensitive or privileged information, unless it is appropriately secured against theft or loss.
      1. Users and business units should consult with their IT services organization, the Office of Ethics, Compliance and Corporate Integrity, and the Office of Legal Management regarding what kind of security is appropriate for the sensitive information they store on their local workstations.
      2. Outlook email archives are automatically stored locally on workstations. If email archives contain sensitive information (in the message body or in an attachment), they must be secured against theft or loss of the workstation.
    3. Sensitive information should be saved in folders with access limited to those individuals authorized to access the information.
    4. Folder access entitlements must be reviewed according to the University’s “Information Security: Electronic Information and Information Systems Access Control policy.”
    5. Users must logoff or lock their workstations when not in use.
    6. Users should consider using a privacy screen to prevent unauthorized people from viewing information on their workstation screen.
    7. Users must consult with their IT services organization before installing software or connecting hardware that has not been issued or purchased by ROWAN.
    8. When installing personal software authorized by ROWAN, users must provide and retain proof of purchase and licenses (unless the software is offered free by the software developer).
  2. Workstation Security
    1. Workstation builds must incorporate ROWAN’s baseline security controls and safeguards defined by the University’s Information Resources and Technology (IR&T) organization.
    2. Workstations that deviate from ROWAN’s baseline security controls and safeguards must be identified. Deviations must be documented and state:
      1. The department where the workstation resides.
      2. The purpose of the workstation.
      3. The workstation’s serial number.
      4. The controls and safeguards not applied to the workstation.
      5. The business justification for deviating from ROWAN’s baseline security controls, safeguards, and configurations.
      6. The IT manager approving the deviation.
    3. IT service organizations and the businesses are expected to maintain an accurate and current inventory of all workstations.
    4. Login banners are required and must state:
      This workstation is the property of ROWAN and exclusively for the use by authorized members of the University community and limited to activities specific to their role and responsibilities. All activity occurring during the use of this workstation (including Internet use) is governed by the University’s Code of Conduct, its policies, as well as by federal, state, and local laws.
    5. Idle timeout mechanisms must be employed.
    6. A user ID and password must be required to use the workstation.
    7. Local workstation administrator access is a privilege and will only be granted when a clear business need is established and standard University IT services or alternative solution cannot support the user’s business needs.
      1. The University reserves the right to revoke without notice local administrator privileges if access is deemed to present a risk to ROWAN’s electronic information or information systems.
      2. The user’s manager and/or the University’s IT service organizations will periodically re-assess the user’s need for administrator access and at their discretion revoke the entitlement (without notice) or offer an alternative solution to meet the user’s need.
      3. Workstation administrator access is auditable and subject to access entitlement reviews.
    8. Workstations that provide access to or use of sensitive information or information systems should not be located in publicly accessible areas.
      1. If a workstation must be located in a public area, physical and technical safeguards must be employed to protect against unauthorized access.
      2. When feasible, workstation monitors should face away from public viewing.

B. Responsibilities

  1. Information Resources and Technology (IR&T) is responsible to define base controls and configurations for workstation builds.
  2. All ROWAN IT Service Organizations or Departments managing their own workstations are responsible to incorporate the University’s baseline security controls, safeguards, and configurations into their workstation builds and to maintain an accurate and current inventory of all their workstations. Any deviation from ROWAN’s baseline security model must be documented.
  3. The Presidents and Vice Presidents of the University’s units and the Deans of the schools have ultimate responsibility for the protection of their electronic information and information systems against unauthorized disclosure, loss, or misuse. They must ensure that all members of their respective organizations follow the administrative, physical, and technical safeguards defined in this policy.

VI. NON-COMPLIANCE AND SANCTIONS

Violations of this policy may subject the violator to disciplinary actions, up to or including termination of employment or dismissal from a school, and may subject the violator to penalties stipulated in applicable state and federal statutes. Sanctions shall be applied consistently to all violators regardless of job titles or level in the organization.                                                               


By Direction of the CIO:

________________________________

Mira Lalovic-Hand,

VP and Chief Information Officer  

                                                                                          



  • No labels
Error occurred during template rendering. Contact your administrator for assistance.