Encryption Business Process - NIU - Division of Information Technology

      

   

Information Security

Encryption Business Process

Policy

Users are required to encrypt Sensitive and Restricted information, as defined by the Information Security Policy, for protection against inadvertent or unauthorized disclosure while in storage or in transit over data networks. The Division of Information Technology makes available software and protocols that provide robust encryption for devices that must store or transmit Sensitive or Restricted information, as well as the capability for properly designated University officials to decrypt the information, as required and authorized. Users encrypting information must use only the endorsed software and protocols

Procedure

Information Custodian:

Determine whether the information is Sensitive or Restricted Information as defined by the Information Security Policy.

  • If possible, use currently established and centrally administered processes and services when creating, accessing, storing, using, and/or transmitting Sensitive or Restricted Information.
  • If not possible to use centrally administered servers, request file or process encryption assistance by contacting the IT Helpdesk. Be prepared to answer the following questions:
    • Location of Device (building and room).
    • Host name and IP address of device.
    • Operating system utilized.
    • Lan Administrator name and contact information for device.
    • User name and contact information for device. This user name will be the only user with access to the data in question. If more than one user needs access, include all user names and contact information.
    • Type of information (data, files, processes) requiring encryption. Please include data and files that contain Sensitive or Restricted information and all processes/applications that access or use that Sensitive or Restricted information. Include processes which you use to transfer that information to other devices or locations.
    • Type of device(s) -- pc, macintosh, external storage (usb, etc), or other type of device.
    • Is the device part of a domain? If so, which domain?
    • Does the device use the ITS Novell Client and/or Zenworks?
    • Asset control number for the device or for the device the device is connected to most often.
    • Other pertinent information regarding this request for encryption. (Such as why you want to encrypt the data).
    • Provide other information requested by IT staff.