POL-U3000.07 Securing Information Systems

WWU is committed to complying with state and federal laws regarding information systems. The WWU Information Security Program will reduce the risk of compromises to the computing resources and data held by the University. Compromises to the computing resources and data held by the University could result in an interruption of academic, business, housing, health and safety services.

WWU will establish an information security program (“Program”). The Program will promote, through policy, standards, and guidelines, a secure environment for protecting the integrity, confidentiality and availability of University data and for safeguarding University computing resources. The Program will have goals similar to those produced by applying the Washington State Office of the Chief Information Officer (OCIO) Standard 141.10, Securing Information Technology Assets. These goals include:

1. Appropriate levels of security and integrity for data exchanges and business transactions.
2. Effective authentication processes, security architectures(s), and trust fabric(s).
3. Staff security awareness trainings.
4. Staff support for interpreting and implementing security policies, standards and guidelines.
5. Compliance, testing and audit provisions.
6. Standardization on the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

Under the authority of WWU’s Chief Information Officer (CIO), the Director of Information Security is charged with developing and implementing an information security strategy to execute this policy in accordance with WWU’s legal and contractual obligations, institutional values, and overarching strategic direction. Information security covers the protection of University data in any form, and the safeguarding of IT resources. The protection of data (both physical and electronic) includes:

1. Safeguarding the confidentiality of Protected Data recorded on any type of media (paper, magnetic, electronic, whiteboards, etc.).
2. Protecting the integrity of data (preventing malicious or unintentional alteration).
3. Ensuring the availability of data (i.e., systems are up when expected and data is always accessible).
4. Protecting the infrastructure that houses and processes our data.
5. Enforcing the same high security standards for data handled, housed and processed by contractors, vendors, and cloud services providers.

All university employees (including student employees), interns, and other users who have access to University information systems, equipment, or infrastructure shall comply with information systems standards established by the WWU Information Security Program. Failure to comply with information systems standards could result in disciplinary actions per human resources policies.

University contracts with contractors, vendors, and cloud providers must include language that contains security provisions consistent with this policy and any related standards established by the WWU Information Security Program.

Supervisors shall:

1. Consult with the ISO to clarify requirements of this policy and associated standards and guidelines as needed.
2. Enforce University information security policies by applying appropriate corrective actions against employees and other system users (interns, volunteers, contractors, vendors, etc.) who fail to comply with those policies. The corrective actions should be consistent with Human Resources procedures.
3. Report malicious behavior and potential criminal activity to Human Resources, who may decide to involve the Chief Information Officer, the Information Security Office (ISO), and/or law enforcement.

The University relies on a combination of responsibilities spread among the ISO, IT employees (both under and independent from Information Technology Services), Supervisors, and end-users. Functions for centralized administration of University information security includes the following elements:

A. The CIO is tasked with:

1. appointing a Director of Information Security to administer the University’s Information Security Program. The Director also manages the ISO.

B. The Director of Information Security is responsible for:

1. Developing and maintaining the administrative policies related to the security of the University’s information and IT resources.
2. Coordinating and administering federal, state, payment card industry (PCI-DSS), University and other information security audits.
3. Developing and maintaining guidelines for Disaster Recovery Plans and testing procedures throughout the University.
4. Preparing and disseminating state and federal reports as required by statute.
5. Participating in the WWU IT Advisory Council (ITAC). This group provides the Chief Information Officer with timely input on IT planning, policies, and project portfolios.
6. Reviewing and approving proposed exceptions to this policy.

C. The ISO is responsible for:

1. Performing risk assessments for mission critical systems and those containing Personally Identifiable Information (PII), Protected Health Information (PHI), and other data specifically subject to state and federal laws.
2. Performing security assessments and disseminating the information to responsible parties for remediation.
3. Ensuring a comprehensive inventory of University computing and data assets is maintained.
4. Using security tools to monitor the University’s environment, reporting on findings, and offering strategies for remediation.
5. Performing security design reviews.
6. Providing consultative and advisory services to managers and users throughout the University on matters pertaining to information and IT resource security, risk analysis and disaster recovery.
7. Collaborating in University business continuity planning.
8. Providing oversight of IT security incident management.
9. Reporting key metrics to senior management.
10. Reviewing the Securing Information Systems Policy (this document) and related standards and guidelines annually.
11. Creating content and coordinating information security awareness training per POL-U3000.03, Training for End-User Information Security Awareness.
12. Supporting departments and business units with compliance with this policy.

D. WWU Information Technology Services (ITS) and non-ITS computing offices and personnel are responsible for key security systems and practices including and not limited to:

1. Providing an inventory of assets including systems, databases, and applications to the ISO.
2. Implementing proper physical and environmental controls for the data centers, data closets, plant, and workstations.
3. Network security including network segmentation, access control lists, and secure transport.
4. Access control and systems for authentication, authorization and accounting including multifactor authentication.
5. Permissions auditing for systems containing Personally Identifiable Information (PII) or any data specifically regulated by a state or federal regulation such as Protected Health Information (PHI).
6. Configuration management for virtual infrastructure (hosts and servers), physical servers, network equipment, other network-connected devices (HVAC, locks, i.e.), databases, and applications.
7. Complying with university security standards on the application of patches to systems and devices.
8. Enforcing mobile device management for devices handling sensitive or confidential information.
9. Securely managing cloud deployments.
10. Auditing of activity on systems with PII or any state or federally regulated data.
11. Encryption of data when mandated by state or federal regulations.
12. Monitoring of network, system, database, and application logs.
13. Secure Development Lifecycle processes including system acquisition, design, development, and maintenance.
14. Complying with standards for change and release management.
15. Backing up mission-critical and enterprise systems, systems of record containing personally identifiable information (PII), and systems required by state or federal laws and creating Disaster Recovery Plans (DRPs) for those systems.
16. Anti-malware deployment, administration and monitoring.
17. Providing secure electronic messaging, telecom, and other communication systems.
18. Responding to vulnerability scans, security assessments and audits, and remediating deficiencies especially for systems containing, transmitting, or accessing PII or any Category 3 or 4 data as defined in OCIO 141.10.
19. Collaborating in the detection, investigation, and reporting of IT-related security incidents with the WWU ISO.
20. Safeguarding information requiring special handling as per state and federal regulations and laws.
21. Assuring vendors implement security measures consistent with this policy and the WWU Information Security Program.

E. Supervisors are tasked with:

1. Tracking, classifying and protecting their data.
2. Understanding the different security roles within their systems and requesting appropriate access for their personnel.
3. Collaborating with Human Resources on personnel onboarding and departure and for changes in an employee’s duties.
4. Ensuring their employees receive ISO provided security training as per POL-U3000.03, Training for End-User Information Systems Awareness.
5. Fostering awareness of information security risks and best practices.
6. Cooperating with other WWU IT employees and the ISO to enhance the University’s security posture.
7. Verifying any information security incidents have been reported to the Help Desk and ISO.
8. Reporting known data breaches to the ISO.
9. Consulting with the ISO to identify and address security gaps.

F. All employees, student employees, faculty, interns, and contractors are responsible for:

1. Complying with University communications about information security and following best practices conveyed in security awareness trainings and University published security standards.
2. Reporting any suspected information security incident or data breach to their Supervisor and their Help Desk.

Situations may occur where implementing the policy or a related standard conflicts with business needs. An exception to policy may be requested in writing. This request must detail the business need for the exception, the technical steps to be taken to address any security concerns, and the process and timeframe for implementation. All requests will be addressed to the WWU Director of Information Security for approval.