-
UIT Help Center
Chat Live Chat
Email support@uh.edu
Submit a help form
Call 713-743-1411
Visit the Tech Commons-
Policies and Guidelines
Departmental IT Best Practices - Information Security
Last Updated: April 15, 2011
Reviewed: January 11, 2010
Reviewed: January 11, 2010
- Who does it apply to?
- Departmental Management
- Why is it important?
- To ensure confidentiality, integrity, and availability of information resources.
Practices
Controlling Access to Information
- What is it?
- Controlling access to information through owner identification and user authentication.
- WHAT NEEDS TO BE DONE:
- Identify data owners, privileges to be granted to users, and implement security controls to authenticate users.
Existing Guideline(s):
- Texas Administrative Code (TAC) 202.71, Section C: "Management and Staff Responsibilities"
- TAC, 202.7, Sections A, B, C: "Information Resources Security Safeguards"
- IT Security Manual: "Information Ownership"
- IT Security Manual: "Data and Software Access Control"
- IT Security Manual: "Password Control"
- IT Reference Guide: "Logical Security; D. Confidential Information and Logical Security"
- IT Reference Guide: "Logical Security; E. Local System Protection, 1. Firewalls"
- IT Support Standards: "Data Security"
- IT Support Standards: "Password Use and Computer Account Security"
Rotating and Separating Duties
- What is it?
- Separating and rotating data processing duties to minimize the risk of fraud.
- WHAT NEEDS TO BE DONE:
- Periodically rotate assignments for those individuals who work with sensitive data.
Existing Guideline(s):
Ensuring Individual Accountability
- What is it?
- Ensuring any file/date modifying activity is traceable to the individual initiating it.
- WHAT NEEDS TO BE DONE:
- Ensure each computing resource identifies an individual before access is granted.
Existing Guideline(s):
Reporting Security Violations
- What is it?
- Ensuring computer users know their responsibility to report computer abuses to an appropriate UH official.
- WHAT NEEDS TO BE DONE:
- Ensure computer users know their responsibility to report computer abuses.
Existing Guideline(s):