Management of Data as Responsible Use ICPL 2005

Information Privacy and Security As usual in higher education, different institution will have, and take, different approaches to the protection, preservation, and proper use of their IT resources and assets: –Hardware –Software –Data

Privacy and Security Security and Privacy Security –Administrative Program –Logical Availability Integrity Confidentiality –Physical Locks and Keys Privacy –Transparency Data collected/stored Relevancy –Disclosure Notice –Control Correct Mistakes Opt-In or Out –Security Administrative Logical Physical

Data… Is at the core of the intersection between security and privacy, not least in the experience of information technologies.

Comprehensive Information Security Policies UC-Berkeley Framework – UCOP – Princeton – SecPolicy pdfhttp:// SecPolicy pdf Chicago – computers/policy.shtml

Data Classification and Stewardship Classification – sification/classification_of_data.htmlhttp:// sification/classification_of_data.html Stewardship – ppendixa.htmlhttp:// ppendixa.html – og/institutional/data_digest/datadigest.htmlhttp:// og/institutional/data_digest/datadigest.html

Cornell IT Policy Framework work-chart.html

Security of Information Technology Resources Every user responsible for security of devices connected to the network Five Categories of Users/Obligations IT Director: coordinate security program Unit Heads: oversee (for their unit) Security Liaisons: effectuate (unit risk assessment) Local Support Provider: implement (desktop) User: know who you are and don’t share password!

Responsible Use of IT Resources Every user must manage the data on their IT devices Five Categories of Users/Obligations IT Data Director: coordinate Stewards: oversee (policy) Data Liaisons: effectuate (inventory/flows) Custodians: implement (secure that web page!) Users: know who you are (and don’t infringe copyright!)

Conclusion Protection, preservation and appropriate use of institutional IT assets and interests requires comprehensive information data and security programs. That an institution have such programs is a given; how they are constructed goes to the history, culture and tradition of the institution.