WVU Information Security Program Charter & Interim Policy

Goals, Mission, and Service (January 2006)
View PDF

West Virginia University (WVU) is a student-centered learning community meeting the changing needs of the people of West Virginia and our nation through learning, research, service and technology.

The WVU Strategic Plan uses the academic mission as a centerpiece for growth in other areas of the University – from enrollment to research dollars – and identifies five goals. Those goals are: to attract and graduate high-quality students; recruit and retain high-quality faculty; enhance the educational environment for student learning; promote discovery and exchange of knowledge and ideas; and improve West Virginia’s health, economy and quality of life.

The Information Security Program Goals

The WVU Information Security Program will support the University Vision and Strategic Plan through the accomplishment of the following goals:

The Information Security Program Mission

West Virginia University (WVU), recognizing the vital role that information resources play in the mission critical operations of education, research, service and administration, has established an Information Security Program to foster an environment that will protect and preserve the availability, confidentiality and integrity of these resources. Information resources include numerous forms of data as well as the media, software, hardware, facilities and personnel that support the collection, recording, processing, transmission, storage and presentation of the data. The WVU Information Security Program cultivates this protective environment by following three basic tenets of information security:

Organization
All members of the WVU community share in the responsibility for protecting University information resources. Accordingly, the Information Security Program forms partnerships with WVU community members to achieve information security objectives. To ensure a coordinated, enterprise-wide application of information security policies, standards and guidelines, while maintaining a position of independence and objectivity, the Information Security Program Director reports to both the Provost and Vice President for Academic Affairs and Research, and the Director of Internal Audit.

Services
To advance the information security objectives, the Information Security Program will:

  1. Maintain an information resource risk management program to identify critical information resources, determine and evaluate information security threats and vulnerabilities within the University environment, and recommend effective and economical strategies to manage the risks associated with these threats and vulnerabilities.
  2. Provide direction for information security policies, standards and guidelines to ensure the consistent and comprehensive implementation of information security controls throughout the University.
  3. Lead efforts to institute an information security awareness, education and training program to help WVU community members understand the importance of information security, as well as their responsibilities related to the protection of information resources.
  4. Coordinate and or lead information resource assessment and monitoring activities to identify vulnerabilities and threats within the University environment and make recommendations to address those threats and vulnerabilities.
  5. Provide security-related guidance for the development/acquisition, design, implementation, maintenance and retirement of information systems to ensure the incorporation of security controls concurrently with the system development life cycle phases and provide definitive reference points for validation, verification and audit activities.
  6. Collaborate with WVU Internal Audit to establish an information security compliance program to ensure that departments implement and maintain procedures that are consistent with University polices and standards, and comply with external regulations.
  7. Participate in investigations of information security incidents and violations, and evaluations of the WVU incident response to incidents to assist WVU information resource stewards with the evolution of a formal incident response process. In addition, deliver recommendations to enhance the University’s state of preparedness and ability to respond effectively to information security incidents and violations.
  8. Sponsor forums for communication of information security related activities, concerns and regulations that could impact University operations, as well as making recommendations to implement new and / or revise existing university policies to provide a secure environment for WVU information resources.
  9. Serve on University committees responsible for the oversight of administrative and academic information management systems and projects impacting those systems.

Contents

Interim Policy (2003)

Executive Summary
View PDF

West Virginia University (WVU) acknowledges that information resources are vital assets requiring protection commensurate with their value. Information assets such as verbal, written and electronic communications, data, applications, systems, networks and data centers must be actively managed to ensure the continued confidentiality, integrity and availability of these resources.

In recognition of the critical role that information resources play at WVU and its regional campuses, this policy offers an initial framework or foundation for constructing a comprehensive information security infrastructure. The development and maintenance of an information security function is a dynamic, evolving, iterative process. Therefore, WVU information security policies, standards, and procedures must be evaluated and updated on an ongoing basis to reflect the current information systems environment, combat the growing number of information security threats and meet prevailing requirements imposed by external agencies.

The WVU Information Security Policy incorporates the Institution’s polices, standards and procedures in the area of information security. Activities, actions or behaviors in this area must comply not only with the above-mentioned policy, but also with any other institutional policies and procedures, as well as any federal and state laws and regulations governing the use of information resources, including all records of customer information.

Why Do We Need An Information Security Policy?

First, a strong information security infrastructure, supported by comprehensive policies, standards, and procedures, provides mechanisms that help ensure the continued availability of mission critical services to our customers, which includes, but is not limited to students, faculty members, researchers, employees and state constituents. If information resources were unreliable or unavailable for an extended period, the University could suffer damage to its reputation, as well as incur serious financial and operational losses.

Second, polices and standards provide a clear and definitive way for the University administration to demonstrate and communicate that information security is vital for the protection of information assets. Accordingly, formal policies and standards provide employees with instructions and guidelines to reference as they fulfill their responsibility to safeguard mission critical information resources.

Third, liability for data and privacy losses due to enterprise security breaches are potential risks for all organizations. If information were disclosed or published in an inappropriate, unauthorized manner, University customers could incur substantial harm or inconvenience. In the event of litigation, the establishment of information security polices and standards can serve as influential evidence that management is concerned about and is promoting sound information security practices throughout the organization. Also, information security policy and standards provide direction for the collection, publication and maintenance of confidential customer information.

Fourth, formal policies and standards will assist in the achievement of a consistent and complete information security infrastructure. The lack of clear and consistent direction for information security could lead to disparate and competing policies and standards, which could potentially weaken security rather than strengthen it.

Finally, the initial efforts to establish an information security policy should provide a “return on investment” by helping the University define an information security infrastructure and prioritize current and future investments in information security efforts. An information security infrastructure provides a relatively inexpensive approach to preventing and minimizing the effects of a major information security breach.

The Information Security Infrastructure

This information security policy framework recognizes seven components, which are essential to an effective information security infrastructure:

One of the most critical and dynamic components of information security is the technical and functional information architecture that details the specific information resources employed throughout the organization. The architecture is critical because it identifies all information resources, assesses threats to and vulnerabilities of those resources, and evaluates the contribution of specific resources to the overall information security function. As WVU moves forward with establishment of a comprehensive information security function, the information resource owners and providers should develop and maintain technical and functional information resource architecture diagrams and narratives.

The information security function requires the necessary resources and organizational structure or infrastructure to maintain the information security plan. These resources include individuals, departments and councils responsible for developing, approving, and implementing information security policies, standards, procedures and programs. New information security roles and responsibilities will need to be defined throughout the organization. Existing roles and responsibilities must be evaluated and restructured or redefined to support the information security infrastructure. At a minimum, this policy recommends an infrastructure supporting the following roles and responsibilities:

To establish a comprehensive information security infrastructure, WVU needs formal information security directives that include policies, standards and procedures.

Additionally, the infrastructure must provide vehicles or programs to promote information security awareness and education, perform periodic risk assessments, conduct compliance reviews, provide oversight for the procurement of service providers, and present guidelines for managing information security issues. These programs are necessary to implement the directives issued through policy and standard statements.

In this document, polices are considered to be mandatory business rules, management instructions, or guiding principles to direct employees in the decision making process. Although policies vary from organization to organization, they typically include general statements of scope, objectives, and employee responsibilities. Standards provide specific requirements or levels of performance necessary to achieve policy directives. Procedures are the detailed steps, both automated and manual, required to achieve a standard or comply with policy. The Information Security Officer will approve and issue information security policies and standards. WVU entities will develop procedures and recommend polices and standards to achieve university-wide information security objectives.

As stated above, this policy document offers a foundation for building a comprehensive information security infrastructure by providing recommendations for the formation of an information security function; roles and responsibilities within that function; guidelines for the development of information security risk management, education and compliance programs; and some general standards for common WVU information resources.

Contents

I. Introduction
View PDF

West Virginia University (WVU) relies on numerous, diverse information resources to support the mission critical operations of administration, education, research and service. If information resources were unavailable, unreliable or disclosed in an inappropriate manner, the University could suffer damage to its reputation and incur serious financial and operational losses. Accordingly, WVU acknowledges that information resources are vital assets requiring protection commensurate with their value. Information assets such as verbal, written and electronic communications, data, applications, systems, networks and data centers must be actively managed to ensure the continued confidentiality, integrity and availability of these resources.

The obligation to protect information resources is shared by every member of the University community. The WVU Information Security Policy was developed to educate information resource users about the value of information resources and the importance of safeguarding these resources. Additionally, this document provides a broad security policy for WVU, as well as standards offering direction for the development of central and departmental information security procedures and programs to protect University information resources.

All WVU information resource policies, standards and procedures must be reviewed on a periodic basis to determine if they need to be expanded or modified to remain effective in a dynamic environment. Accordingly, the WVU Information Security Policy shall be evaluated and updated on an ongoing basis to reflect the current information systems environment, combat the growing number of information security threats and meet prevailing requirements imposed by external agencies.

Contents

II. Information Security Objectives

Information security objectives seek to establish controls and practices to prevent, detect, correct and minimize the risk of loss or damage to information resources, disruption of access to information resources and unauthorized disclosure of information. These objectives are achieved through the implementation of effective policies, standards and procedures, which focus on the three primary components of information security: integrity, confidentiality and availability.

Integrity refers to the accuracy and completeness of information, as well as to the validity in accordance with business rules. The principle of integrity, as it relates to security, is used to determine the level of protection or restriction required to safeguard information resources from unauthorized access and modification. Keys to achieving information integrity include:

Confidentiality addresses the protection of information resources from unauthorized access or disclosure. The University is obligated to protect private, proprietary and other sensitive information resources from those that do not have the right or need to access the resource. To help employees and other University authorized parties manage information resources appropriately, these resources must be classified according to levels of confidentiality. At a minimum this confidentiality classification should include the following levels:

Availability is the assurance that information resources are accessible by authorized individuals as needed and when needed. From a security perspective, availability addresses the implementation of controls to prevent denial of service situations, recovery of information resources following a disaster, and similar situations that have the potential to interfere with the delivery of information resource services. Information resources should be ranked according to priority of restoration following a significant interruption in service. Resources identified as mission critical or unique typically require more stringent security measures than supplemental or common resources that can be easily replaced. An availability framework and security measures for restoration plans should be further addressed in a business continuity plan. Availability categories include the following levels:

Contents

III. Information Security Policy Scope

This policy applies to University students, faculty, and employees granted use of WVU information resources. It equally applies to individuals and other entities that, by nature of their relationship with WVU, are entrusted with access to University information resources. Examples of such individuals and entities are contractors, consultants, external auditors, vendors and governmental agencies. Typical information resources covered in this policy include written, printed or electronic documentation, all forms of data, applications/software, storage media, personal computers, servers, minicomputers, mainframes, peripherals and data centers that are used for administration, research, education or other purposes supporting the University mission.

The WVU Information Security Policy incorporates the Institution’s polices, standards and procedures in the area of information security. Activities, actions or behaviors in this area must comply not only with the above-mentioned policy, but also with any other institutional policies and procedures, as well as any federal and state laws and regulations governing the use of information resources, including all records of customer information. Accordingly, the use of information resources is subject to the usual requirements of legal and ethical behavior within the WVU community. Users of WVU information resources must comply with federal, state and other applicable governmental laws; rules of the Higher Education Policy Commission; the State of West Virginia Information Security Policy; and applicable contracts and licenses. Additionally, information resource users must follow specific WVU Policy statements regarding information resources supported by the President’s Office; The Division of Administration, Finance, and Human Resources; Institutional Advancement; Student Affairs; Academic Affairs and Research, HSC Finance and Administration; Office of Information Technology (OIT); and other WVU entities.

WVU Information resource users should be aware that they are subject to the laws of other states and countries when they engage in electronic communications with persons or utilize information resources located outside the University’s domain. All users are responsible for ascertaining, understanding, and complying with the laws, policies, contracts, and licenses applicable to their particular purpose and use. Under some circumstances (e.g., audits, investigations, or legal requirements) the University may be required to provide information to external parties. The Information Security Officer and the appropriate representatives from the University Administration shall address such situations on an individual basis. The highest level of authority shall dictate the management of information in these circumstances.

Individual units within the University may supplement the Information Security Policy by developing standards, procedures or other “conditions of use” for information resources under their control. These directives shall provide additional detail, specific guidance or particular restrictions on the use of certain information resources. However, supplemental items must be consistent with the overall WVU Information Security Policy and other polices issued by higher levels of authority. To ensure that consistent polices standards and procedures are employed throughout the University, the Information Security Officer shall approve and coordinate the implementation of supplemental directives.

Contents

IV. Information Security Structure

Information security requires the active support and ongoing participation of individuals from various disciplines and management levels. This section of the policy outlines security roles and responsibilities for all members of the WVU community operating within the Information Security structure. These roles and responsibilities involve individuals who are responsible for developing, approving, and implementing information security policies, standards and procedures. Also, included are vehicles for promoting information security awareness and education, conducting periodic compliance assessments, and managing security issues as they arise. Primary roles and responsibilities within the information security structure include the Information Security Officer, Information Security Council, Information Security Liaisons, Information Resource Users, University Administration and Management, and Internal Audit. This structure must be reviewed and revised periodically as WVU experiences changes in the technical and information environments and encounters new information security risks.

Information Security Officer (ISO)

The Information Security Officer has overall, direct responsibility for establishing and administering the West Virginia University Information Security Program. The ISO function should be located at the policy development and enforcement level of the WVU organizational hierarchy. Accordingly, the ISO shall report to a cabinet level authority, serve as a member of the AIMS Executive Committee and coordinate the efforts of the Information Security Council. The ISO’s primary responsibilities are to:

Information Security Council (ISC)

The Information Security Council (ISC) coordinates information security efforts across multiple functional and technical areas throughout the University. This council is the primary vehicle for evaluating and responding to information security risks associated with existing, proposed, and new information resources, systems and applications. This council governs the Information Security Risk Management Program and the Information Security Awareness and Education Program. To be effective in a dynamic environment, the ISC should meet at least monthly and more often when circumstances dictate. The primary members of the ISC are the

The Information Security Council has the following responsibilities:

Information Resource Providers

The Information Resource Providers are those entities or parties which are responsible for the (1) management of functional business areas which utilize the information resources; (2) production, collection and maintenance of data; and / or (3) operation, maintenance and support of the technical applications and systems. There are numerous information providers, with widely varying responsibilities, at WVU. Therefore, for illustrative purposes, a general description of a few of these parties is described below.

One type of information provider includes departmental managers, assistant directors, directors or other designated persons who have the responsibility and authority to act on behalf of the administration. Typically, these providers are viewed as the custodians, and possibly owners, of specific information resources. Therefore, these providers are responsible for establishing the overall security strategy for those information resources, including the resource security classifications, definition of data access levels, and authorization for resource access.

Other information resource providers include those entities that actually operate, maintain and support the information resources. Examples include, but are not limited to, application administrators and coordinators, network administrators, data center personnel, application developers, database administrators, and the help desk consultants. To ensure an effective security strategy, all information resource providers must coordinate their operation, maintenance and support activities.

Information Security Liaisons (ISLs)

The Information Security Liaisons (ISLs) shall coordinate and promote responsible information security practices for all information services delivered by WVU and its regional campuses. The ISLs, working under the direction of the Information Security Officer, will contribute to the Information Security Council. Each University organizational entity or business area (e.g. unit, department, division, and college) shall designate a person or persons to serve as Information Security Liaison. The individuals serving as ISLs must be familiar with or responsible for some aspect of information management (e.g., system administration, application coordination, or departmental computer support) within their respective business area. The number of liaisons appointed from each area will depend on entity size, scope of responsibility, involvement with information systems and complexity of operations. ISL representation could include Expert Business Officers, each major WVU application or system, the primary divisions in the Office of Information Technology and other academic or administrative entities as appropriate. The Information Security Liaisons shall have the following responsibilities:

Information Resource Users

Information users include any student, faculty member, employee, contractor, vendor, consultant or information resource provider who utilizes WVU information resources to perform their academic or professional responsibilities. They have been granted explicit authorization to access a WVU resource and are responsible for the day-to-day, hands-on security of that resource. Information users will be granted different and various levels of access to information resources depending on their specific functions. Users must be granted “least privilege” or the minimal level of access required to perform their normal duties. Occasionally users will require expanded access to resources. When these situations occur, requests for exceptions must be submitted in writing and shall be evaluated by the appropriate security officials on a request-by-request basis. All users of the information resources are responsible for informing the technical and functional information resource providers of their needs for the protection of information, especially for the confidentiality, availability and integrity of those resources. Information resource users have the following responsibilities:

Administration and Management

Each Dean, Director and Business Area Manager is responsible for the security of information resources under their jurisdiction and for implementing information security standards and procedures for their areas or responsibility. As part of this responsibility Deans, Directors, and Business Area Managers shall:

Internal Audit

WVU Internal Audit provides independent, objective assurance and consulting services designed to add value to the University’s operations. The primary responsibility of the WVU Internal Audit Information System Function is to assess security risks, measure compliance to security policies and standards, evaluate the effectiveness of security procedures and provide consulting services for the information security governance processes. A representative from the Internal Information Systems Audit Function shall serve on the Information Security Council. Additionally, the WVU Internal Information Systems Audit Function will contribute to the WVU Information Security Structure by:

Contents

V. Information Security Function

The implementation and ongoing maintenance of a comprehensive, effective Information Security Function will require a commitment of resources to numerous, but critical, information security roles and responsibilities. The Information Security Function will be responsible for establishing and enforcing information security polices, standards and procedures. To fulfill this responsibility the Information Security Function, which includes the ISO, ISC, and ISLs, provides awareness and education programs to promote information security; implement an information risk management program to identify critical security threats and vulnerabilities and reduce security risks to an acceptable level; and develop an ongoing compliance program to ensure that information security policies, standards, procedures, incident response scenarios and controls are functioning as intended.

Authorization and Authentication

Authorization is the positive determination by the owner of an information resource that a specific individual may access that information resource. Authentication refers to processes utilized to confirm the identity of an authorized information resource user.

West Virginia University is the owner of all institutional information resources that are developed by, used by or distributed to employees, students, faculty members or authorized representatives of outside entities. Additionally, WVU can serve as the agent or custodian of information belonging to other parties. Although WVU assumes ownership responsibility, certain administrators and managers are directly responsible for executing this responsibility. All administrative information systems and applications environments shall maintain consistent standards for establishing the accountability, authorization, and authentication of information users. These standards shall be compatible with WVU Information Security Policy.

Access to information resources shall be granted to University employees only in accordance with their specific jobs. Information resource owners, as part of their management responsibility, are required to review all requests for access to information resources and verify that all requests meet a legitimate business need.

Student access is primarily for work associated with their course of study and related activities. A student may access data if the data pertains to that student or, with prior special permission data related to work responsibilities, if that student is also an employee of WVU. Students, faculty, researchers and staff may use their access to University computers to use worldwide networks such as the Internet. As necessary, on a case-by-case basis, access may be granted to third parties, consultants or outside vendors.

As a condition of obtaining and maintaining access to any University computer system, all authorized users are required to sign a statement and / or acknowledge via electronic screens or banners that they have received a copy of and read these policies, understand them and shall comply with them. Authorized users understand that by using any University information resource, they agree to comply with all related University policies and standards and the regulations provided below:

Information Security Awareness and Education Program

An effective level of security awareness, including the training of information resource security liaisons, users, providers, and management, is one of the most effective means of reducing vulnerability to error and fraud, and must be continually emphasized and reinforced. Employees who are not informed of risks or of security policies are not likely to take steps to prevent the occurrence of violations.

The Information Security Officer, with assistance from the Information Security Council, shall develop and implement a formal security education program, which will include the following elements:

Information Security Risk Management Program

The Information Security Function shall be committed to working efficiently to ensure the appropriate protection of information resources through an information security risk management program. Accordingly, the Information Security Function shall employ a risk assessment strategy to analyze, and compare threats to and vulnerabilities in information resources with respect to their criticality and value to the University. The results of this risk assessment will be used to determine appropriate, cost-effective safeguards and countermeasures. The specific information security mechanisms and implementations will be established for appropriate information resources and will vary based on risk assessment results. All assessment findings and recommendations, as well as the safeguards, procedures and controls implemented, shall be documented and reported to the Information Security Council.

The Information Security Officer and the Information Security Council shall maintain an ongoing risk management program to test and evaluate the effectiveness of preventative, detective and corrective information security controls to ensure their continued effectiveness against evolving risks and threats. A risk assessment process should include the following elements:

Information Security Monitoring, Reporting and Enforcement

Monitoring

It is the responsibility of the information users, information resource providers, management, and the Information Security Council to identify and implement appropriate measures to prevent and detect attempts to compromise information resources. In order to protect the privacy, security and integrity of University information resources against unauthorized or improper use, and to protect authorized users from the effects of such abuse or negligence, the University reserves the right to:

Reporting

Individuals aware of any actual or suspected information security breach or vulnerability must report such situations to the appropriate Dean or Director, Information Security Liaison and Information Security Officer. In some circumstances, the OIT Helpdesk will receive the initial information about a security threat or violation. In these situations, the OIT Helpdesk Consultant will notify the Information Security Officer. The Information Security Officer, in coordination with appropriate University officers, shall examine the situation to determine if policy has been violated and if loss or damage has occurred. Also, the Information Security Officer shall determine the appropriate course of action according to the WVU Information Security Incident / Violation Response and Reporting Procedure. Results shall be reported through the proper administrative channels for any legal or disciplinary action regarding any University policy violations. The University Office of Public Safety, Legal Counsel, Internal Audit, outside law enforcement authorities or others may be involved in the response to an information security violation.

Enforcement

The University views the misuse of computers and information resources as a serious matter, and may restrict access to its facilities even if the user is unable to complete course requirements or work responsibilities as a result. Violation of the WVU Information Security Policy, as well as other applicable WVU, State and Federal regulations may result in:

Information Services and Service Provider Procurement Oversight Program

The Information Security Office® shall implement and maintain an information services procurement oversight program to provide direction in the selection of external or third party service providers. This program will outline an information services evaluation and selection process that shall consider the ability of a service provider to maintain appropriate safeguards over information resources, including confidential customer information. In addition, the Information Security Office® will work with Procurement Services, Legal Counsel and other designated institutional officials to develop and incorporate standard contractual protections applicable to third party service providers. Some basic controls which shall be included in contracts or other formal agreements with third party service providers, consultants or vendors, who will access or use WVU information resources, include, but are not limited to the following:

Policy Management

Request for waivers, deviations or exceptions to this policy must be thoroughly documented and presented to the Information Security Officer and / or the AIMS Executive Committee. Under normal operating conditions, The AIMS Executive Committee and University Information Security Officer must approve information security policy exceptions and exemptions. In the event of an emergency situation, the Information Security Officer shall determine the appropriate action or response to the exception situation. Questions about the contents of this policy or the applicability of this policy to a particular situation should be referred to the Information Security Officer.

Management and oversight for this policy shall be vested with the Information Security Officer and the AIMS Systems Executive Committee. The Information Security Officer, working with the Information Security Council, reserves the right to change this policy as necessary to

WVU Information Security Policy

Goals, Mission, and Services

Interim Policy

Acknowledgements