Please comment on this DRAFT Information Security Policy
---------- DRAFT -- DRAFT -- DRAFT -- DRAFT -----------------------
OUS Information Security Policies – DRAFT 9
Executive Summary
• OUS has a responsibility to protect its Information Assets, business processes, and follow appropriate laws and regulation relating to information security.
• OUS will meet its obligations by each member institution implementing an ongoing information security program.
• Each Institution’s CIO will have responsibility for institution’s program and will assign Chief Information Security Officer (CISO) duties to appropriate group or person.
• Each Institution’s CISO or equivalent will be responsible for planning, monitoring, and reporting on the information security program.
• Each Institution will create Information Systems Policies that cover at a minimum: Classification Standards that at least identify essential and highly sensitive data, processes, and systems; security baselines commensurate with classification; and labeling and handling standards for highly sensitive data, processes, and systems.
• Each Institution will create Personal Information and User Policies that cover at a minimum: Securing Personally Identifiable Information; Acceptable Use of Computing Resources; and employee polices for security-sensitive personnel.
• Each Institution will create Security Operations policies that cover at a minimum: a notification and escalation plan for breaches of personally identifiable information, a risk assessment program; and an incident response plan.
• Each Institution will create Network and Telecommunications Policies which at a minimum ensure that highly sensitive information assets are in a secured zone on the network and are not transmitted outside of secured zones in clear text.
• Each Institution will establish physical security standards that protect essential or highly sensitive Information Assets which are critical to the functioning of the institution.
• Each Institution will establish a Disaster Recovery Plan for essential Information Assets.
• Each Institution will develop awareness and training programs for all Information Asset users regarding Information Security.
• OUS Internal Audit will conduct periodic Information Security Policy Audits.
1 Purpose
The Oregon University System and its member institutions, collectively referred hereinafter as OUS, have a responsibly to protect information entrusted to them, ensure the effective operation of business critical processes, and must abide by the security policies established by the State Board of Higher Education as well as laws and regulations at the federal, state, and local level relating to information security. OUS must meet a standard of due care regarding the protection of institutional information assets as well as those belonging to OUS students, faculty members, customers, and research partners.
OUS “Information Assets� includes information and systems that are owned by OUS, information that OUS is obligated to keep secure by applicable law or by contract, and information exempt from disclosure under public records laws. OUS Information Assets are found in written, spoken, electronic, printed, magnetic, optical and other mediums.
The purpose of this policy is to document OUS management’s intent regarding the protection of these Information Assets. It is to be used by each OUS institutions’ management to develop, document, implement, and maintain local information security policy and programs.
2 Goals
OUS member institutions will develop and implement ongoing information security programs, and assign clear and appropriate roles and responsibilities to the administration, IT personnel, and institutional community members. The basic objectives are to achieve and maintain:
TRUST - Ensure that institutions establish a baseline of security that will serve as a basis for the ongoing trust of OUS’s information systems, engender confidence between OUS and its students, faculty members, customers, research partners, and the citizens of the State of Oregon.
INTEGRITY - Establish the concepts of due care, best practice, and security baselines as the basis for protecting the Information Assets of OUS in a manner commensurate with their sensitivity, value, and criticality to ensure they meet expectations of form, fit and function.
ACCOUNTABILITY - Maintain the accountability of information users, preserve management options if there is asset misuse or abuse, ensure security of OUS’s physical assets, and provide for business continuity.
3 Authority and Scope
This policy applies to the Oregon University System as organized and empowered by ORS Chapters 351 and 352, and is specifically authorized under ORS 351.087. This policy is applicable to all OUS member institutions as well as all employees, students, contractors, consultants, agents, and vendors working on their behalf. It is applicable to all OUS Information Assets, regardless of form or media. It applies to information gathering, protection, use, processing, storage, communications, and transit.
OUS Member Institution policies, procedures, standards, and work instructions are required to comply with this policy.
4 Roles and Responsibilities
The OUS Chancellor shall have overall oversight responsibility for the provisions of this policy.
The OUS Chief Information Security Officer (CISO) shall have responsibility to develop, implement, maintain, and monitor compliance with this policy.
Each member institution’s Chief Information Officer (CIO), or equivalent, shall have oversight responsibility on their campus for institutional provisions set forth in this policy and shall be responsible for ensuring that intuitional policies are developed in accordance with this policy.
Each member institution’s CISO or equivalent shall be responsible for developing, implementing and maintaining institution level policy, procedures, standards, and plans to meet the requirements of this policy.
5 Institutional Policy Requirements
5.1 Security Management
Each member institution should establish an ongoing information security program and assign clear and appropriate roles and responsibilities to their Administration, CIOs (or equivalent), and all local University community members. The CIOs (or equivalent) of each member institution will be responsible for establishing the program and ensuring that it is effective. At a minimum, member intuitions shall specifically assign the responsibility to plan, facilitate compliance, and report on the status of their program to a person or appropriate group to act as Chief Information Security Officer.
Each member institution should create clear and consistent policy in accordance with their information security program, which outline general information security operations including such things as risk assessment procedures, incident response responsibilities, security testing, and day to day security compliance. The specifics of those policy requirements are outlined in the following sections.
5.2 Information Systems Security
Information Systems are composed of three major components: data, applications, and infrastructure systems. All three must be addressed in order to ensure overall security of these assets. OUS Member institutions should establish policy, procedures, security controls, and standards which govern these assets. These policies should ensure that fundamental security principles, such as those documented as pervasive principles in the Generally Accepted Information Security Principles , are established and maintained.
At a minimum each member institution shall establish:
a) Information system classification standards. These standards shall ensure that Essential and/or Highly Sensitive data, applications, and infrastructure systems are identified and standards for handling them are developed. Member institutions may deem it appropriate to establish multiple levels of sensitivity or criticality.
b) Security baselines for information systems. Security Baselines are a minimum set of operational guidelines which affect the relative security of an Information Asset. Baselines shall be appropriate to the level of sensitivity and criticality of the systems and ensure that the due care and best practice principles are met.
5.3 User and Personal Information Security
Everyone interacting with information assets has a responsibility to ensure the security of those assets. Each member institution must create policies that articulate the rights, responsibilities, and roles of anyone interacting with Information Assets. Policies must take into account federal, state and local laws, as well as other institutional policies. For example, FERPA requirements will require attention when dealing with student records and HIPPA requirements will require attention when dealing with health information. Policies should be made readily available to all interested parties.
At a minimum each member institution shall establish:
a) Personal Information Policies. Member institutions are required to specifically define procedures for dealing with personally identifiable information. Information, such as social security numbers, credit card numbers, and driver’s license information, is naturally sensitive and appropriate steps should be taken to protect the privacy of this type of information.
b) Acceptable Use Policies. Member institutions are required to develop policies which define the parameters of acceptable use for all users of information resources within the organization. These policies must ensure that the use of Information Assets 1) is consistent with standard security practices, 2) ensure that those resources operate effectively, and 3) that appropriate laws relating to Information Assets are followed. For example these policies may include user account management, resource use limitation, definitions of inappropriate behavior, copyright restrictions, commercial use restrictions, and confidentiality requirements. These polices should also include definitions of enforcement mechanisms in case of violation. Member institutions shall make it clear that prior notification is not a requirement for applicability of the policy and they shall clearly state that there should be no expectation of privacy while using institutional resources.
c) Security Sensitive Personnel Policies. Employees that have access to essential or highly sensitive data and processes should be designated as serving in critical or security-sensitive capacities as per OAR XXX.XXX and be subject to the appropriate employment policies of the institution.
5.4 Security Operations
OUS member institutions have a responsibility to construct operational standards and policies that ensure due care is taken to secure Information Assets. These operational standards and policies should include reasonable and appropriate proactive and reactive measures to protect Information Assets from unauthorized access, disruption of normal operations, and which comply with appropriate laws and regulation. In particular, member institutions should provide anti-virus software, a system to distribute current anti-virus definitions, and a security patch management system for commonly used operating systems.
At a minimum each member institution shall establish:
a) An incident response plan. This plan shall include a threat containment strategy, an intrusion detection system, and a mechanism for tracking and reporting security breaches.
b) A notification and escalation plan for security breaches involving personally identifiable information. This plan shall include clearly defined criteria used to determine that personally identifiable information has been exposed and has been, or it is reasonably believed to have been, obtained by an unauthorized person. This plan shall also include clear escalation and notification steps when such an event occurs and the means by which the member institution’s administration, OUS’s administration, appropriate law enforcement agencies, and the people that could be identified by the information in question, are notified of the breach.
c) An ongoing risk assessment program. This program should regularly identify and track all Essential and/or Highly Sensitive Information Assets, and verify that the appropriate security baseline is in place and being followed with respect to those Information Assets.
5.5 Network and Telecommunications Security
OUS member institutions have a responsibility to ensure secure management of their local networks. Member institutions should have the ability to control who connects to their networks, the ability to create secure zones with restricted access on their networks, and be able to ensure the effective operation of their networks.
At a minimum each member institution shall establish:
a) Secured Zones for essential and highly sensitive Information Assets. These zones shall be created by employing standard network technology to restrict access at the network level to authorized personnel only.
b) Policies that prohibit transmission of unencrypted Highly Sensitive data outside of secured zones.
5.6 Physical and Environmental Security
Each member Institution should establish procedures for the physical protection of its Information Assets. At a minimum, member Institutions shall develop policies and procedures to protect physical areas containing Information Assets that represent Essential or Highly Sensitive information systems which are critical to the functioning of the institution. Member institutions should also consider physical security for computers and other local Information Assets housed in departmental work areas or under departmental control, such as laptop computers, PDAs, etc.
Protection of physical equipment, or of software and data residing on storage media, from theft, loss, damage or improper use should be addressed. Particular attention must be paid where access to or function of essential or highly sensitive information systems is concerned. Member institutions are encouraged to adopt policies which only allow highly sensitive data to be permanently retained on portable equipment if protective measures, such as encryption, are implemented that safeguard the confidentiality and integrity of the data in the event of theft or loss of the portable equipment.
In addition, physical inventories of equipment should be completed and maintained in accordance with the OUS Financial Administration Standard Operating Manual (FASOM) Section 8.03C.
5.7 Business Continuity/Disaster Recovery
As part of ongoing business continuity planning, member institutions are responsible for preparing, periodically updating, and regularly testing a campus Disaster Recovery Plan. This plan should address recovering from a disaster that renders Essential Information Assets unavailable for an unacceptable period of time. Such a Disaster Recovery Plan should establish the frequency of testing member institution disaster recovery procedures. Member institutions should ensure that any local operations procedures are coordinated with overall institutional disaster preparedness plans.
5.8 Awareness, Education and Training
Member institutions are required to develop methods for increasing the level of awareness of information security issues among their constituents. Awareness and training programs may be carried out using a number of different approaches, including document distribution, software distribution, web publishing, and internal or external training sessions. These programs should be carried out on a regular basis, and they should be periodically reevaluated in order to assess their effectiveness.
At a minimum, users should be made aware of their roles and responsibilities within the organization as they relate to the security of Information Systems. Users should also be informed of all policies and procedures which may apply to them. Contact information for central IT Security personnel, as well as department IT personnel, should be made available. Users should be informed of whom to contact, and appropriate measures to take in the event of a security incident. Policies and procedures should be made readily available in accessible locations.
Educational or training materials should be made available in order to educate users on standard security practices. Training on basic computer security concepts should be provided. These concepts include the following: operating system patching, built-in firewalls, anti-virus software, password management, and browser and e-mail security. Additional training should be offered in areas that are of particular concern to the institution.
6 Policy Review Process
The OUS CISO will review this policy annually to ensure that it complies with applicable law and Board Policies. Should this policy be revised, the CIOs (or equivalent) of each member institution will be notified to ensure local policies are reviewed and revised as appropriate.
7 Audit
The OUS internal audit office will conduct periodic information security policy audits to ensure compliance and notify each member institution of any deficiencies.
Appendix A
Glossary
Anti- Virus – Programs that identify malicious code installed on computers without the owner/operator’s knowledge or consent.
Applications – Computer programs that collect, process, or otherwise manipulate data.
Best Practice – Generally accepted industry practices which have been broadly adopted and considered standard.
Built-in Firewall – Functions within the local operating system of a computer that limit what other machines on the network can connect to it.
Business Continuity – The ability for business processes and functions to continue and for an organization to continue to function despite emergencies, major disruptions, etc.
CIO – Chief Information Officer. The executive level position in an organization that is generally in charge of the Information Technology division and is responsible for the overall IT operations of an organization.
CISO – Chief Information Security Officer. Generally the CISO function is one of being responsible for the Information Security Program.
Data – Information stored electronically, or in print.
Due Care – The conduct that a reasonable man or woman will exercise in a particular situation, in looking out for the safety of others. If one uses due care then an injured party cannot prove negligence. This is one of those nebulous standards by which negligence is tested. Each juror has to determine what a "reasonable" man or woman would do.
Essential Information Assets – Those Information Assets that are critical to the function of the member institution and without which the normal business functions of the member institution can not occur.
FERPA – Family Educational Rights Privacy Act. This federal act protects student records, other than directory information, as private information available only to those with an educational need to know.
HIPPA - Health Information Protection and Privacy Act. This federal act protects health records as private information.
Highly Sensitive Information Assets – Those Information Assets that OUS is obligated by law or contract to protect, or that represent obviously confidential data which if released would represent some actual legal liability to the member institution.
Incident Response – The planned reaction to a breach of security which includes identifying the breach, closing it, and mitigating its effect.
Information Assets – Information and systems that are owned by OUS, information that OUS is obligated to keep secure by applicable law or by contract, and information exempt from disclosure under public records laws. OUS Information Assets are found in written, spoken, electronic, printed, magnetic, optical and other mediums.
Information Systems – A collection of computers and processes which interact with each other to manipulate, transmit, and store data.
Infrastructure Systems – Computers and network devices and the operating systems which run them.
Institutional Community Members – Faculty, Staff, Students, Vendors, Visitors, Affiliates, Courtesy Faculty, etc. In short, all persons who have a relationship with the Institution and therefore may interact with Information Assets of the Institution.
Intrusion Detection System – A program or series of programs that watch network traffic and other activities to identify intrusion attempts and compromised machines.
Risk Assessment – In the context of information security, risk assessment is the determination of both the importance of all Information Assets and their likelihood of being accessed by an unauthorized person or of their function being intentionally impaired by someone.
Security Baseline – A minimum set of operational guidelines which affect the relative security of an Information Asset. These guidelines would typically cover such things as firewall settings and network access controls, local permissions, password change policy, operating system patch management, anti-virus policy, and physical access controls.
Security Breach – Theft or unauthorized acquisition of Information Assets by a person that harms or poses an actual threat to the security, confidentiality, or integrity of those assets.
Security Controls – Procedures to follow which help establish and maintain Authentication, Authorization, and Access to Information Assets. These controls include such things as verifying identity, giving access to Information Assets based on job function or duties, network appliances that restrict connections coming from the Internet or unsecured zones, etc.
Threat Containment – Reactive measure to ensure that a security breach is contained to affected systems and that those systems are not able to be used to launch successful intrusion attempts to other systems.
Operating System – The series of programs loaded on a computer that operate it. Common operating systems include Windows, MacOS, and Unix.
OUS Member Institutions – The Chancellor’s Office, University of Oregon, Oregon State University, Portland State University, Oregon Institute of Technology, Western Oregon University, Southern Oregon University, and Eastern Oregon University.
Password Management – The practice of creating and maintaining passwords on a system that are not easily guessed, programmatically determined, or otherwise obtained by unauthorized persons. This generally means requiring a base level of complexity in the password, and that it is changed on a regular basis.
Personally Identifiable Information – A combination of name and one or more other data elements which could uniquely identify an individual for the purpose of providing restricted access. This term may be formally defined shortly in anti “ID Theft� legislation. Common data elements used in combination with name are: Social Security number, driver’s license numbers, date of birth, account number (such as credit or debit card number), account passwords (including pass phrases such as mother’s maiden name), identification number issued by a foreign nation, passport number, biometric data, etc.
