View
212
Download
0
Category
Preview:
Citation preview
Management of Data as Responsible Use
ICPL
2005
Information Privacy and Security
• As usual in higher education, different institution will have, and take, different approaches to the protection, preservation, and proper use of their IT resources and assets:– Hardware– Software– Data
Privacy and SecuritySecurity and Privacy
• Security– Administrative
• Program
– Logical• Availability• Integrity• Confidentiality
– Physical• Locks and Keys
• Privacy– Transparency
• Data collected/stored• Relevancy
– Disclosure• Notice
– Control• Correct Mistakes• Opt-In or Out
– Security• Administrative• Logical• Physical
Data…
Is at the core of the intersection between security and privacy, not least in the
experience of information technologies.
Comprehensive Information Security Policies
• UC-Berkeley Framework– http://ist-socrates.berkeley.edu:2002/pols.html
• UCOP– http://www.ucop.edu/ucophome/policies/bfb/is3.pdf
• Princeton– http://www.princeton.edu/~protect/PoliciesAndGuidelines/
InfoSecPolicy05-21-2004.pdf
• Chicago– https://security.uchicago.edu/regulated-computers/
policy.shtml
Data Classification and Stewardship
• Classification– http://www.stanford.edu/group/security/
classification/classification_of_data.html
• Stewardship– http://www.itc.virginia.edu/policy/
itcadminappendixa.html– http://www.web.virginia.edu/iaas/
data_catalog/institutional/data_digest/datadigest.html
Cornell IT Policy Framework
http://www.cit.cornell.edu/oit/policy/framework-chart.html
Security of Information Technology ResourcesEvery user responsible for security of devices
connected to the network
Five Categories of Users/Obligations
IT Director: coordinate security program
Unit Heads: oversee (for their unit)
Security Liaisons: effectuate (unit risk assessment)
Local Support Provider: implement (desktop)
User: know who you are and don’t share password!
Responsible Use of IT Resources
Every user must manage the data on their IT devices
Five Categories of Users/Obligations
IT Data Director: coordinate
Stewards: oversee (policy)
Data Liaisons: effectuate (inventory/flows)
Custodians: implement (secure that web page!)
Users: know who you are (and don’t infringe copyright!)
Conclusion
Protection, preservation and appropriate use of institutional IT assets and interests requires comprehensive
information data and security programs.
That an institution have such programs is a given; how they are constructed goes to the history, culture and tradition of the
institution.
Recommended