Data Security

The EDUCAUSE/Internet2 Computer and Network Security Task Force (STF) provides a focal point for the academic community to join together to strengthen the ability of the higher education sector to respond to growing threats to information security and to protect the privacy of our community members. This strategic plan is intended to set forth a vision for the higher education community and provide a concise roadmap to guide the efforts of the STF. This roadmap emphasizes continuous and evolutionary community investment in converting our understanding of risks and issues into solutions based on effective practices, as well as the urgent need to build the national capability across the higher education sector to respond quickly and effectively as a community to new threats and vulnerabilities.

Two of the entries on the long list of data breaches in higher education are Georgetown University and UCLA. Timothy Lance recently talked with the IT policy officers at these two institutions to identify some of the policy implications of handling data breaches.

The purpose of this policy is to protect the confidentiality, integrity, and availability of Pima Community College data.

The Data Classification Toolkit is a compilation of resources pertaining to data classification in higher education. Although data classification is just one component of a comprehensive program to protect data, it is an important foundation. This Toolkit consolidates resources from the EDUCAUSE web site as well as from other sources, and organizes them into four basic steps.

Identity and access management (IAM) at USC has been a policy-driven, grassroots effort for the past five years. During that time collaborative committees with representatives from many academic and administrative units have enabled the accelerated growth of applications relying on identity data while governing the release of that data. With the backing of the university data stewards in the offices of the registrar, provost, and personnel services , policies have been implemented regarding the release of identifying sensitive information to both internal departments and external vendors. The speakers will discuss the composition of these committees, the governance policies that have been implemented, and some of the dozens of applications that have been enabled securely through this process.