Compliance is nothing to fool around with, and it's imperative
that the UAM community understand its responsibilities for
safeguarding protected data. Protected data is any information that
could be use to identify an individual. Information protected by
legislation can include:
- Salary and fringe benefits (except for federal employees)
- Terms of employment (including performance and disciplinary
records)
- Academic and educational history
- Criminal investigation and arrest history
- Employment history (including general or security clearance
information)
- Biographical history
- Social Security information
- Identification codes
- Personnel profile (including home address and phone number)
- Medical history
UAM's network obviously contains and/or processes protected
sensitive information. Unauthorized disclosure of such sensitive
information could adversely impact UAM with both civil and criminal
liabilities. For protection of faculty, staff and students, it's
vital that you implement some extra precautions.
Administrator
responsibilities
Administrators have the responsibility of securing the network,
storage, and use of personal data subject to such legislation.
Failure to follow specific requirements can result in fines up to
$5,000 per violation, as well as misdemeanor charges. Appropriate
security safeguards will help protect data from the following:
- Inappropriate disclosure
- Improper use
- Access by unauthorized or unapproved users
- Data tampering
But don't forget that security measures, no matter how solid, are
only as good as the educated employee who wants to do the right
thing.
Employee
responsibilities
An organization's users are potentially the weakest link in
security efforts. You've heard it before, but it's worth repeating:
Educate your users.
To better protect sensitive data, train all users to do the
following:
- Label all media (e.g., disks and documents) containing
sensitive information.
- Securely store sensitive information.
- Immediately notify supervisors of any security breach.
- Do not send unencrypted sensitive information via e-mail.
- Log off or use a screen saver with a password when leaving
workstations unattended.
- Store data on network drives instead of workstations.
- Do not place sensitive data on unsecured websites
