To ensure that information security incidents are reported, assessed, and their harmful effects are mitigated to protect Rowan University's information.
Under the direction of the President, the Chief Information Officer and the Chief Information Security Officer shall implement and ensure compliance with this policy. The President/CEOs, Executive Vice President, Senior Vice Presidents, Vice Presidents, Deans, and other members of management will implement this policy.
This policy applies to all members of the Rowan community.
A. Application – a computer program that processes, transmits, or stores University information and which supports decision-making and other organizational functions. It typically presents as a series of records or transactions. These records and transactions are generally accessible by more than one user.
B. Availability – the expectation that information is accessible by Rowan when needed.
C. Business Unit – the term applies to multiple levels of the University, such as a revenue generating unit or a functional unit (e.g., Compliance, Human Resources, IR&T, Legal, Finance, etc.). It may also be comprised of several departments (e.g., IR&T).
D. Confidential Information – the most sensitive information, which requires the strongest safeguards to reduce the risk of unauthorized access or loss. Unauthorized disclosure or access may 1) subject Rowan to legal risk, 2) adversely affect its reputation, 3) jeopardize its mission, and 4) present liabilities to individuals (for example, HIPAA/HITECH penalties). See University policy, Information Classification for additional clarification.
E. Confidentiality – the expectation that only authorized individuals, processes, and systems will have access to Rowan's information.
F. Directory Information – information identified by Rowan that may be released without prior consent of the student. (See Family Educational Rights and Privacy Act policy (00-01-25-05:00) for a comprehensive list of information categorized as Directory Information.)
G. EPHI – electronic patient health information.
H. Information System – consists of one or more components (e.g., application, database, network, or web) that is hosted in a University campus facility, and which may provide network services, storage services, decision support services, or transaction services to one or more business units.
I. Personally Identifiable Information (PII) – examples include full name, personal identification number (such as Social Security number, passport number, driver's license number, taxpayer identification number, bank information, or credit card number), mailing or email address, personal characteristics (such as photographic image, fingerprints, or other biometric information), or any combination of these.
J. Private Information – sensitive information that is restricted to authorized personnel and requires safeguards, but which does not require the same level of safeguards as confidential information. Unauthorized disclosure or access may present legal and reputational risks to the University. See University policy, Information Classification for additional clarification.
K. Service Desk – the University technology service team that receives and handles requests for technical support and requests for new or changes to technology and voice services
L. Security Event – a possible unauthorized attempt to compromise the confidentiality, integrity, or availability of the University's electronic information or information systems. It may be a local threat that can or has evolved to present a larger risk to the University.
M. Security Incident – an actual or possible breach of the University's safeguards that protect its electronic information, information technology infrastructure or services, or information systems (or dependent information systems), and presents a significant business risk to the University.
N. Sensitive Information – protected sensitive electronic information; information classified as confidential or private (such as intellectual property or other information deemed sensitive by a department, school, or unit).
O. SIRT – Security Incident Response Team.
P. Rowan Community – faculty, staff, non-employees, students, attending physicians, contractors, covered entities, and agents of Rowan
Q. User – refers to any member of the Rowan community, as well as visitors, who have been explicitly and specifically authorized to access and use the University's information systems
A. Family Educational Rights and Privacy Act 00-01-25-05:00
Actions that may represent a risk to the University's electronic information, information systems, or information technology infrastructure require a timely response to mitigate the risk to those assets and to the University's business services and operations.
To assist with these efforts, all members of the Rowan community must report any computer activity they believe to be suspicious or consider an unauthorized attempt to access, use, steal, or damage Rowan's electronic information, information systems, or information technology infrastructure (this includes missing computer equipment). Such security events can potentially negatively impact the confidentiality, integrity, and/or availability of the University's electronic information and information systems and threaten its businesses and overall mission. Reporting these events helps the University assess the risk and respond accordingly.
Members of the Rowan community should use their best judgment and err on the side of caution when deciding whether to report activity they believe may be suspicious or that constitutes a threat to the University or their respective organization.
A. Reporting Suspicious Computer Activity and/or Stolen Computer Equipment
B. Communications and Assessment
To assist Compliance with the investigation and respond to reports of suspicious activity, Compliance may request the services of Public Safety, the Office of Legal Management, the Information Security Office.
The Office of Legal Management is to be informed of suspected data breaches to ensure the timely and appropriate engagement of the University's risk mitigation partners and service providers.
The Information Security Office and IRT management will keep the SIRT apprised of any reports that involve potential threats to the University's information technology infrastructure, services, and dependent information systems across the campus.
D. Incident Categorization
Security incidents must be categorized according to the standards listed in the appendix. Categorization is necessary in order to uniformly assess the risk to the University's operations and determine the appropriate response.
E. Incident Handling And Reporting
Failure to report or respond to an event or incident can expose the University to regulatory and/or statutory penalties, costly litigation, and undermine its mission and standing in the community. Any individual who violates this policy shall be subject to discipline up to and including dismissal from the University as well as civil and criminal penalties. Sanctions shall be applied consistently to all violators regardless of job titles or level in the organization.
A. Attachment 1, Appendix
By Direction of the CIO:
VP and Chief Information Officer
A. Event Categorization
This list is not comprehensive and other categories may be added to help with the reporting process. Security events must be categorized according to the potential impact or threat to the confidentiality, integrity, and availability of the University's electronic information and/or information systems. Categorization is necessary in order to assess the risk to the University's business services and operations, and to determine the appropriate response.
A significant and/or persistent attempted intrusion that stands out above the daily activity and could result in unauthorized access of the target electronic information or information system.
Denial of Service
Intentional or unintentional denial of service (successful or persistent attempts) that affects or threatens to affect a critical service or denies access to all or one or more large portions of the University's network.
All instances of successful infection or persistent attempts at infection by malicious code, such as viruses, Trojan horses, or worms.
Access or use of the university's electronic information or information systems that violates Rowan policies and may present a risk to the University's electronic information or information systems.
Instances of unauthorized port scanning, network sniffing, resourcing mapping probes and scans, and other activities that are intended to collect information about vulnerabilities in the University's network and to map network resources and available services.
An instance (or instances) where an attacker uses human interaction to obtain or compromise information about the University, its personnel, or its information systems.
All unintentional or intentional instances of system compromise or intrusion by unauthorized persons, including user-level compromises, root (administrator) compromises, and instances in which users exceed privilege levels.
Any activity that is not recognized as being related to University business or normal use.
Incident Severity Levels
Rating the severity of an incident is a subjective measure of its threat to Rowan's operations. The severity level helps determine the priority for handling the incident, who manages the incident, and the incident response plan.
The following factors help determine severity level:
Potential operational disruption across a campus or all campuses. May have one or more of the following characteristics:
|High|| Potential operational disruption of a school or unit (e.g., Camden or SOM University Hospitals). May have one or more of the following characteristics:|
|Medium||Impact to a business unit that is serious and possibly results in an operational disruption. May have one or more of the following characteristics:|
|Low||Impact to a business unit is minor and may present an operational risk if not addressed immediately. May have one or more of the following characteristics:|
B. INCIDENT HANDLING AND REPORTING
The Incident Report must include:
Prepare a Lessons Learned report for incidents. The report must include the standard incident report information and establish the steps necessary to prevent or limit the risk of the incident recurring. The report shall be submitted to the Chief Information Officer, the Office of Ethics, Compliance and Corporate Integrity, and the Office of Legal Management. The report may be submitted to other University entities when necessary.