Security Awareness security.nsu

1. Security Awarenesshttp://security.nsu.edu Norfolk State University Policies

2. Security Awareness:Policies • NSU policies are available from: • http://www.nsu.edu/policies • Policy 60.201: Acceptable Use of Technology Resources • Policy 62.002: Computer Systems Passwords • http://www.nsu.edu/oit/policies • Policy 61.002: Electronic Data Privacy and Ownership • Policy 62.001: Continuity of Operations Disaster Recovery Plan • http://www.nsu.edu/forms • Resource Authorization Request / OIT Request Form & Information Security Access Agreement

3. Security Awareness:Policies • Policy 60.201: Acceptable Use of Technology Resources • Describes standards for using the University resources. • States that activities can be monitored. • States what types of use or access are authorized or not authorized. • Examples: • material covered by law not permitted • obscene, inflammatory, or objectionable not permitted • Do not allow access to unauthorized persons • equipment removal • external equipment • downloading and causing too much traffic

4. Security Awareness:Policies • Policy 60.201 (Continued) • Privacy (or rather, no expectation of) • Commonwealth policy • Electronic communications can be forwarded without users knowledge • Viewed or downloaded material/information • University is not responsible • Use caution • Protect NSU assets

5. Security Awareness:Policies • Policy 60.201 (Continued) • User Responsibilities include (some, not all): • You represent NSU • Operate in an ethical manner • Maintain security • use for approved purposes • Respect

6. Security Awareness:Policies • Policy 60.201 (Continued) • Network Accounts • used for university business • maintain privacy and security of account information • Some Prohibited items are: • logging onto more than one computer • sharing passwords • introducing Virsuses, worms • permitting unauthorized persons access

7. Security Awareness:Policies • Policy 60.201 (Continued) • University records • email is for delivery • up to users to deem what is retained or archived • Violations will be handled • According to state policy • According to Vice President or designee • Interpretation is according to the VP of Research and Technology

8. Security Awareness:Policies • Policy 62.002: Computer Systems Passwords • Guidelines • Used to access network, email, etc… • Creation: • complex, not easy to guess (dog, son, car, etc..) • At least 8 characters • Mix upper & lower case letters, numbers and special characters • Not a word or name

9. Security Awareness:Policies • Policy 62.002: (Continued) • Protection: • change IFAS/DataTel pw every 30 days • change network pw every 12 months • use a passphrase • do not write it down • Do not use it on non-NSU systes • Do not share it • Treat as confidential

10. Security Awareness:Policies • Policy 62.002: (Continued) • Assessment • Random assessments of passwords • Violations handled according to VP

11. Security Awareness:Policies • Policy 61.002: Electronic Data Privacy and Ownership • It is everyone’s responsibility to protect and maintain university data • Any data required to conduct university business and operation • Public use data for public use • Internal use not available to anyone outside the university • Highly sensitive data is data based on legal specifications, law, or any other data that needs to be protected • Protect data for those that conduct business with the university

12. Security Awareness:Policies • Policy 61.002: (Continued) • Authorized use • Limit Access • Safeguard SSN • Departments are responsible for reviewing and monitoring internal policies • Exercise caution and care

13. Security Awareness:Policies • Policy 62.001: Continuity of Operations Disaster Recovery Plan • Password protected to ensure security • Describes the procedures for restoring operation in the event of disaster as soon as possible • Contains possible scenarios • Contains list of servers and network equipment and the type of equipment each is • If restoration is needed, the order of restoration is included

14. Security Awareness:Policies • Policy 62.001: (Continued) • Management Team • makes decisions and directs recovery • Damage Assessment Team • determine extent of damage • Recovery Team • determine assets needed • conduct recovery • Contact information for team members, contractors and vendors

15. Security Awareness:Policies • Policy 62.001: (Continued) • Backup procedures • Risk Assessment and planning • Restoration procedures

16. Security Awareness:Policies • Resource Authorization Request / OIT Request Form & Information Security Access Agreement • All users must have one • Agreement with university to abide by policies, laws and procedures • New users use this to get accounts for necessary access • Get access to additional resources • Needs supervisor signature