Office of Operations Review and Audit

Office of Operations Review and Audit Program Review Protecting Computer Networks and Data in the UW System March 2008 Table of Contents Page Executive Summary i Scope 1 Background 1 Discussion and Recommendations 2 Information Protection Laws and Disclosures 3 IT Organization and Staffing 5 IT Structures 5 Computer Security Function Staffing 6 Computer Security Policies and Procedures 10 Principal UW Computer Security Policy 10 Issue-Specific Institutional Policies 11 Computer Security Incident Response 12 Network and Data Access 13 Security Hardware and Software 13 Passwords 17 Physical Access to Data Centers and Network Equipment IT User Education 18 Conclusion 20 Appendix 22 EXECUTIVE SUMMARY Institutions of higher education rely on information technology (IT) for many of their critical operations, including admissions, financial aid, student records, research, and instruction. Increased use of IT increases the risk of unauthorized disclosure of confidential data. College and university IT leaders identify computer security as one of the top ten IT issues their institutions face. The Office of Operations Review and Audit reviewed efforts to protect computer networks and private electronic data in the UW System. The review examined: information protection laws, computer security staffing, policies and procedures related to ...