Jump to content - Jump to section navigation
This Information Security Plan (the "Plan") describes Brandeis University's safeguards to protect confidential personal information.
Confidential Personal Information ("CPI"), for purposes of this Plan, includes the following categories of information:
These safeguards are provided in order to:
This Plan also provides for mechanisms to:
Brandeis recognizes that both internal and external risks may potentially exist. These risks include, but are not limited to:
Brandeis recognizes that this may not be a complete list of the risks associated with the protection of CPI. Since technology growth is not static, new risks are created regularly. Accordingly, the LTS Department will actively participate and monitor advisory groups such as the Educause Security Institute, the Internet2 Security Working Group and SANS for identification of new risks.
Dennis Devlin, the LTS Chief Information Security Officer, and Peter Giumette, Dean of Student Financial Services, serve as the coordinators of this Plan. They are responsible for assessing the risks associated with unauthorized transfers of CPI and implementing procedures to minimize those risks to Brandeis.
Employees in departments that handle CPI, including certain confidential financial information, receive ongoing training on the importance of confidentiality of CPI. Employees are also trained in the proper use of computer information and passwords. Training further includes controls and procedures to prevent employees from providing confidential information to unauthorized individuals, including "pretext calling." ("Pretext calling" occurs when an individual attempts to improperly obtain personal information so as to be able to commit identity theft.) Employees are trained on how to properly dispose of documents that contain CPI. Each department responsible for maintaining CPI is instructed to take steps to protect CPI from destruction, loss or damage due to environmental hazards, such as fire and water damage or technical failures. These training efforts should help minimize risk and safeguard CPI security.
Brandeis has addressed the physical security of CPI by limiting access to only those employees who have a business reason to know such information. CPI is available only to Brandeis employees with an appropriate business need for such information.
Student loan files, account information and other paper documents containing CPI are kept in file cabinets, rooms or vaults that are locked each night. Only authorized employees know combinations and the location of keys. Unmonitored storage areas holding paper documents containing CPI are kept secure at all times. No paper documents containing CPI may be removed from campus without the express authorization of a department manager. Paper documents that contain CPI are shredded at the time of disposal.
Access to CPI via the University's computer information system is limited to those employees who have a business reason to know such information. Each employee is assigned a user name and password. Databases containing CPI, including but not limited to accounts, balances and transactional information, are available only to Brandeis employees in appropriate departments and positions.
Brandeis takes reasonable and appropriate steps consistent with current technological developments to make sure that all CPI in electronic form is secure and to safeguard the integrity of records in storage and transmission. All systems connected to the Brandeis network are scanned for known vulnerabilities, allowing LTS to identify systems where patches and updates are not applied in a timely fashion and to take appropriate steps to mitigate the risk. Passwords for central UNet systems are required to comply with complexity rules and must be changed as described in the UNet Account Policy. When technically feasible, encryption technology is utilized for both storage and transmission. Legacy systems unable to support password policies or encryption will not be used. With regard to personal computers containing CPI, all memory components will be completely reformatted or otherwise erased for any new use. All CPI stored on laptops or other portable devices must be encrypted.
Brandeis maintains systems to prevent, detect, and respond to attacks, intrusions, and other system failures. The Information Security Plan Coordinators regularly review network access and security policies and procedures, as well as protocols for responding to network attacks and intrusions. Any security breaches or other system failures must be reported immediately to the Information Security Plan Coordinators. Information Security Plan Coordinators shall be responsible for documenting responsive actions taken in connection with any incident involving a breach of security, and mandatory post-incident review of events and actions taken, if any, to make changes in business practices relating to protection of CPI.
If the University chooses to retain a service provider that will maintain, process or regularly access CPI, Brandeis will carefully review the service provider's information security programs or other measures used by the service provider to protect CPI. Brandeis will assess the adequacy of the service provider's system of safeguarding information based upon CPI to which the service provider has access, the nature of services provided by the service provider, and the level of risk. The service provider will be required to have in place controls to assure that any subservicer (or subcontractor) used by the service provider will also be able to protect the University's CPI.
A clause will normally be included in all contracts with service providers having access to CPI related to Brandeis that will require them to implement security measures consistent with 201 CMR 17.00 et seq. to safeguard such CPI and to assure that such CPI is used only for the purposes set forth in the contract.
Brandeis maintains a computer security system that provides at a minimum to the extent technically feasible:
The Information Security Plan Coordinators work with the appropriate University departments to ensure that this security system infrastructure is appropriately maintained.
CPI will only be retained for as long as needed for the University's reasonable business purposes, including for the purpose of complying with any state or federal law. Each department that stores CPI will annually review the CPI it has retained for the purpose of determining which information may be purged.
Any employee who violates this policy shall be subject to discipline pursuant to the University's Corrective Action Policy or other relevant disciplinary policy.
Once an employee who has access to CPI concludes his/her employment, either voluntarily or involuntarily, such employee's access to CPI shall be terminated.
This Plan is subject to periodic review and adjustment. Adjustments might be necessary or advisable due to changes in technology, increases or decreases in the sensitivity of the information that is covered by this Plan, and the assessment of internal or external threats to the security and integrity of the covered information, among other reasons. Continued administration of the development, implementation and maintenance of the Plan will be the responsibility of the Information Security Plan Coordinators, who may designate specific responsibility for implementation and administration as appropriate.
