Tech Guides :: Securing Confidential Information
Protecting the Campus and Yourself
The Board of Trustees of the California State University (CSU), of which Humboldt State University (HSU) is a part, is responsible for protecting the confidentiality of information in the custody of the CSU; the security of the equipment where this information is processed and maintained; and the related privacy rights of the CSU students, faculty, and staff concerning this data. It is the collective responsibility of the CSU, its executives, managers, faculty, and staff to ensure:
- the integrity of the data;
- the maintenance and currency of the applications;
- the preservation of the information in case of natural or man-made disasters; and
- compliance with Federal and State regulations, including intellectual property and copyright.
Responsibility for implementing an information security program for each campus is delegated by the Board to the campus president. At HSU, the program is managed by an Information Security Officer (ISO) appointed by the President. The HSU security program is built on a set of locally developed principles known as the "Six Commandments" for information security:
- No appliance connected to the network without appropriate security.
- No unnecessary duplication of confidential information.
- No transmission of confidential information in the clear.
- No inactive electronic files containing confidential information.
- Secure non-electronic storage of confidential information.
- Secure disposal of confidential information.
Actual implementation of the University's information security "best practices" that will result in compliance with the Six Commandments is defined in a series of Security Memos that every user of HSU's network should read:
- Secure Connection to the Network
- Password Protection
- Information Protection
- Encryption
- Secure Destruction of Personally Identifiable and Confidential Information
- Incident Response
University employees who work with the University's information on their own computers (e.g., do work at home) are obligated to protect and dispose of that information at the same level of security as is required for working with the information on a campus-owned computer.
Further, contractors and consultants with access to the University's information are obligated to protect and dispose of that information at the same level of security as is required of University employees. Those awarding contracts to contractors and/or consultants must ensure that the contractors and/or consultants are aware of their obligations to protect the University's information.
Direct any questions to the campus Information Security Officer at x3815 or security@humboldt.edu.
