POLICIES AND PROCEDURES |Technology Services | 7.4 IS Security| 7.4.1 Procedure



Information Systems Security Procedure

Guidelines


User Access Authorization

Each Southeastern Community College Information Systems Network (SCCNET) user/object must have an approved Access Authorization record, which is obtained through the following procedure:

  1. For all new access, the supervising vice president/president electronically submits an IS Access Request Form, which defines all of the access requested for the new user. 
  2. Current IS access changes can be submitted by the supervising vice president /president through email to the director of information technology.  The email is electronically filed in the corresponding IS Access Authorization record. Current IS access can also be changed on the Annual IS Authorization Form submitted and signed by the supervising vice president/president.
  3. The IS Access Authorization database will be maintained and shows a current detailed record of each users’/objects’ authorized access.

Login/Password Protection

The IT staff builds each employees access on the system(s) for which the supervising vice president/president has authorized use. They also build or provide the information necessary to build student access. Users will be required to enter a unique username and password in order to gain access to the college’s information systems services/resources.

  1. The standard for an employee’s login identification (ID) is the initial of the first name and the full last name.  If that ID already exists on the SCCNET, then the next letter of the first name is added until a unique ID is created. If a unique ID cannot be created with this method, then a sequential number will be added starting at the number 1.
  2. The standard for student login identification (ID) is the first, middle, and last name initial plus the last four (4) digits of the student’s Datatel ID number. Their initial password is the first, middle, and last name initial plus their two (2) digit birth month and their two (2) digit birth day. The password should be set to change upon the first login.
  3. he employee’s name as it appears on the administrative software payroll record is used to create and maintain user identification on the SCCNET.
  4. The employee may request, through their vice president/president, that a different name be used to create their user identification on the SCCNET.
  5. Users are required to enter unique passwords the first time the data services are utilized.  For the following services, users are encouraged to use unique passwords that include alphanumeric, upper and lower case, and special characters rather than common predictable passwords such as the names of pets and family members, addresses, birthdates, or social security numbers.
    1. Novell Directory Services (NDS) network access
    2. CIS Administrative Software access
    3. GroupWise email access
    4. Voice Mail access
    5. Windows access
  6. A password life of 90 days is in effect on the NDS and the Administrative Software services.  Both services require a new, never-before-used password.  When the 90 days have expired, the user must change the password to maintain access.
  7. The GroupWise, Windows, and voice mail passwords are set during the user's initial training and are not configured to expire. However, users are encouraged to change them periodically and especially when they suspect their passwords have been compromised.
  8. All system level administrative login passwords are changed at least every 45 days.
  9. Additional layers of security exist in the Administrative Software.
    1. CIS security is controlled through the specific security system built into the Colleague software.
    2. The break parameter is disabled in all applications.
  10. No authorized users should provide anyone with their IDs or passwords, and no authorized or unauthorized users should use the IDs and passwords of another authorized user.
  11. Users who think their passwords may have been compromised should change them immediately.
  12. Multiple logins on any of the SCCNET services are discouraged.  However, multiple sessions may be opened within the Administrative Software services with each requiring authentication.

Inactivity Protection

Any workstation inactivity for 10 minutes will have a password-protected screensaver invoked. Any workstation with a CIS session inactive for an hour is automatically logged out of that session by the system. Inactive VPN connections will be automatically terminated after 30 minutes.


Physical Security

High tensile steel cables and Master locks physically secure IS hardware in public high traffic areas.

  1. All CPU’s, flat panel monitors, and printers are secured in instructional labs.
  2. All administrative network printers are secured.
  3. Computers designated for general use in public areas, e.g., the Internet, are secured.
  4. Telecommunication closets are secured by locks to which only the IT staff, the vice president of student development and technology services, and the maintenance manager have keys.
  5. The campus telecommunications demarcation room houses all outside SCCNET connections, servers, and server consoles access.  Access to this area is restricted to the IT staff and maintenance manager only.  The demarcation room has a combination lock that is changed periodically.

Private Data Security

It is critical that we protect the privacy of our customers whether they are students, patrons, vendors, or employees.  The essential element in maintaining the privacy of our customers’ information is vigilance on part of those employees entrusted with that information. The employees’ vigilance can best be supported by continuous reminders to that effect. Southeastern will provide privacy guideline reminders through its shared email folder at least quarterly.


Southeastern will also use appropriate technology to help assure that our customers’ information stays private. This technology will include such things as encrypting network data packets to assure that the information is unreadable if hijacked while in transit. The college will also utilize technology to encrypt data housed on mobile media such as laptop hard drives and USB Flash Drives.


All administrative laptops will have a fully encrypted hard drive that requires a boot password before loading the Windows environment. This will prevent the data, potentially our customers’ private information, from being accessed if the laptop is lost or stolen. All administrative laptops will also have a unique username that must be entered prior to accessing the Windows environment. If the laptop is stolen or lost, the user must immediately report it to the IT Department.


All USB Flash Drives used for administrative purposes (such as student, employee, financial, and other confidential information) will be provided by the IT Department. The provided USB Flash Drives will include at least 128bit password protected encryption that will be pre-set. A user with employee network access must request a USB Flash Drive through their vice president. The IT Department will provide the user with a fully encrypted USB Flash Drive and password when they receive the request from the vice president. The user is then responsible for the safe-keeping of the USB Flash Drive.  If the USB Flash Drive is stolen or lost, the user must immediately report it to the IT Department. The user must return the USB Flash Drive to the IT Department when they no longer need it or as part of their checkout when leaving the college’s employment.


Console Protection

The system consoles, housed in the campus demarcation room, are used only by IT staff. Off-campus access to the servers is occasionally necessary for support and maintenance purposes.  Access is gained through a VPN connection or through a secure remote control session. The VPN creates a very secure encrypted tunnel between the client’s computer and specific IP addresses on the inside network. The secure remote control session is setup through a secure tunnel via the Internet. The session must be accepted by the IT staff and monitored throughout the connection.


Once the VPN challenges are met, the user must enter valid Administrative Software or Novell NDS usernames and passwords.  In the case of accessing a Novell server, the user must know the server’s IP address, the secure port number, and the password set on that secure port. In the case of the CIS server, remote access by root is disabled.


Unauthorized Access

Any instance of unauthorized access or attempted access discovered by employees should be immediately reported to the IT staff.


User Termination

IS Access removal is part of the IS Access Policy.  The IT staff removes the user access from all systems at 5:00 p.m. on the user’s last day of employment unless otherwise requested by the supervising vice president.