1. © 2012 Boise State University1 Click for Next Slide! Information Security for Faculty and Researchers Created By OIT Information Security Services http://oit.boisestate.edu/security/

2. © 2012 Boise State University2 Click for Next Slide! Information Security for Faculty & Researchers Role of Information Security Office State and Federal Law Boise State Policy Definitions: Personal Data Institutional Data Public Data Intellectual Property Research Data Copyrighted Materials Confidential Information Best Practices for Protecting Information

3. © 2012 Boise State University3 Click for Next Slide! State and Federal Law Alphabet Soup... FERPA HIPAA PCI-DSS GLBA SOX Red Flag Alerts DMCA Idaho Code §28-51-105 §28-51-

4. © 2012 Boise State University4 Click for Next Slide!... And Boise State Policy Information Technology Resource Use (8000) http://policy.boisestate.edu/wp-content/uploads/2011/05/8000_informationtechnologyresourceuse.pdf Information Privacy and Security (8060) http://policy.boisestate.edu/wp-content/uploads/2011/05/8060_InformationPrivacySecurity.pdf University Records and Archives (1020) http://policy.boisestate.edu/wp-content/uploads/2012/09/1020_Publications-Records_091312.pdf Non Discrimination and Anti-Harassment (1060) http://policy.boisestate.edu/wp-content/uploads/2012/04/1060_040311.pdf

5. © 2012 Boise State University5 Click for Next Slide! Personal Data Your own sensitive information stored on MyBoisestate, Broncomail or in your office Name Address Social Security Number Banking Information Insurance Information Family Information

6. © 2012 Boise State University6 Click for Next Slide! Institutional Data Any data that is subject to state or federal regulation, data that is required to be protected by contractual obligation, as well as all data created, collected, maintained, recorded or managed by the university, its staff, and agents working on its behalf. It includes data used for planning, managing, operating, controlling, or auditing university functions; especially data used by multiple university units; and data used for university reporting. University data also includes research data that contains personally-identifiable subject information, or proprietary university information and trade secrets From: Boise State Data Classification StandardBoise State Data Classification Standard

7. © 2012 Boise State University7 Click for Next Slide! Public Data Information that is available through open records requests While public information is generally available for viewing by the public, certain rules and conventions apply about how and when the information may be viewed.

8. © 2012 Boise State University8 Click for Next Slide! Intellectual Property Information developed through non-sponsored research: May be stored in computers, on media, in printed form, etc. May be copyrightable May generate income May be subject to laws and/or policies Intellectual Property Policy (1090) http://policy.boisestate.edu/wp-content/uploads/2011/05/1090_042508.pdf

9. © 2012 Boise State University9 Click for Next Slide! Research Data Information developed through sponsored research: All the characteristics of non-sponsored research, plus... May be subject to contractual obligations

10. © 2012 Boise State University10 Click for Next Slide! Copyrighted Materials Applies to printed material as well as audio, video, images and other media Copying or duplicating without permission may have serious legal and/or financial consequences Be aware of peer-to-peer file sharing enabled on your computer

11. © 2012 Boise State University11 Click for Next Slide! Confidential Data Students, Faculty, Staff, Donors, Contractors Financial Records Grades Credit Card Information Health Care Information Addresses Phone Numbers Insurance Records Social Security Numbers Protected By Law!

12. © 2012 Boise State University12 Click for Next Slide! Best Practices More Alphabet Soup PII P ersonally I dentifiable I nformation This is the Key Acronym!

13. © 2012 Boise State University13 Click for Next Slide! Best Practices Safeguard The Information on Your Computer And In Your Office Your Personal Information Student Information Your Research

14. © 2012 Boise State University14 Click for Next Slide! Best Practices How Can Data be Lost? Laptop or other data storage system stolen from car, lab, or office. Research Assistant accesses system after leaving research project because passwords aren't changed. Unauthorized visitor walks into unlocked lab or office and steals equipment or accesses unsecured computer. Unsecured application on a networked computer is hacked and data stolen.

15. © 2012 Boise State University15 Click for Next Slide! Best Practices What is the result of lost data? Loss of personal use of a computer Loss of funding Fines Bad Publicity Expose students, staff, contractors, donors to identity theft

16. © 2012 Boise State University16 Click for Next Slide! Best Practices Protecting Information If you print itgo get it right away Lock up sensitive informationincluding laptops Store sensitive information on file servers Consider whether you really need to store it Shred it if you can Data Retention Standards http://it.med.miami.edu/x1312.xml

17. © 2012 Boise State University17 Click for Next Slide! Best Practices Protecting Information Use strong passwords Change passwords often Use different passwords on different systems Never share your password Password protect your screensaver Manually lock your screen whenever you leave your desk

18. © 2012 Boise State University18 Click for Next Slide! Best Practices Protecting Information Be sure your computers operating system and anti-virus software are up-to-date Never open unsolicited email from an unknown source or click on unfamiliar web addresses Follow computer salvage proceduresfor disks, too!

19. © 2012 Boise State University19 Click for Next Slide! Universities in the News! University of Idaho 70,000 Donor Records University of Texas at Austin 225,000 Student Records UCLA 500,000 Student Records

20. © 2012 Boise State University20 Click for Next Slide! Idaho in the Cybersecurity News But not in a good way! August 14 2007 Idaho Army National Guard A small computer drive containing Social Security numbers and other personal information about every Army National Guard soldier in Idaho has been stolen. 3,400 records Mar. 10, 2007 University of Idaho A data file posted to the school's Web site contained personal information including names, birthdates and Social Security numbers of University employees. 2,700 records Dec. 7, 2005 Idaho State University, Office of Institutional Research ISU discovered a security breach in a server containing archival information about students, faculty, and staff, including names, SSNs, birthdates, and grades. Unknown number of records

21. © 2012 Boise State University21 Click for Next Slide! University NOT in the News! Boise State University Zero Lost Records So Far! Go Broncos!

22. © 2012 Boise State University22 Click for Next Slide! What To Do! Know who to call! I think my computer is infected, what do I do? Call the Help Desk 6-4357 I think I lost the USB drive I used to take some sensitive files home to work on, what do I do? Call the Information Security Office 6-5501

23. © 2012 Boise State University23 Click for Next Slide! Information Security for Faculty & Researchers Information Security Services Website With links to laws and recommendations for protecting information http://oit.boisestate.edu/security/