- To protect our important data from being stolen or compromised.
- To comply with regulatory requirements.
Data Security is of great concern to the College of Education. To ensure our students’ and employees’ data is secure, we are in the process of formulating recommendations on how to better comply with university policy and federal regulations.
Computer Data Security recommendations
- Recommendation: Add all college of education desktop workstations and laptops to the ACN Domain.
- Purpose: In order to comply with NMSU Policy 18.104.22.168.3 Section E. Being on the ACN enforces good password policies, enables updates of the operating system, virus protection and other systems policies. Adding encryption to the device will also be much simpler and encryption recovery keys will be centrally managed.
- Problems – none identified, however this will take a while to complete. It is not difficult or time-consuming to update each computer, but there are a lot of computers to do.
- Recommendation: Enforce whole disk encryption on devices that hold any PII (Personally Identifiable Information) or any other sensitive data which falls under FERPA or HIPAA laws.
- Purpose: Can mitigate data leakage in the case of lost or stolen devices. Complies with NMSU Policy 22.214.171.124.3 Section D
- Problems – most of the CoEd computers have Windows 7 Professional not Windows 7 Enterprise OS so they don’t have Bitlocker. Changing the operating system is a non-trivial task and will take time to do all admin computers.
- Suggestions – keep all PII on the server if possible (do not save locally), and encrypt individual files and folders that have PII.
- Recommendation: Prohibit storage of sensitive data on mobile devices (to include laptops, iPads or other portable devices) unless it is secured using encryption.
- Purpose: to prevent data leakage on mobile devices.