This policy applies to all faculty, staff, student employees, and any third parties designated as agents authorized to handle institutional data and/or access University computing systems.

The following are general password policies applicable for network, system resources and internet access use:

1. Users must abide by policies state in the WSU Computing and Telecommunications Account Policy Statement
2. CAMPUS passwords and user logon IDs should be unique to each authorized user.
3. CAMPUS passwords will follow the standard set forth on the WINGS portal: http://wings.wright.edu
4. CAMPUS passwords will be kept private i.e., not shared, coded into programs, or written down.
5. CAMPUS passwords will be changed every 180 days. Systems will enforce password change with an automatic expiration and prevent repeated or reused passwords.
6. CAMPUS user accounts will be locked after 9 failed logon attempts. All failed login attempts will be recorded.
7. Successful systems logons should display the date and time of the last logon and logoff.
8. Logon IDs and passwords are suspended if a client is not authorized during current term unless authorized by Computing and Telecommunications Account Policy Statement.

1. Operating System updates are small programs or files that patch operating systems (such as Windows) from known problems. These updates are crucial in defending against new viruses and attacks. Hackers are constantly looking for vulnerabilities in operating systems and programs, and can easily find and infiltrate a computer that has not been properly patched.
2. For CaTS managed computers on the Wright State University network (normally defined as faculty, staff, and administrative computers), security updates are automatically installed from our update server. For students living in the residence halls, or home users, your computer should be setup to automatically download and install critical updates. For specific directions on how to do this for your particular operating system, Do IT Wright website, located at http://www.wright.edu/security/.
3. All systems connected to the WSU's network should have a vendor supported version of the operating system installed.
4. All systems connected to the WSU's network must be current with security patches.

1. Spyware is any software that watches your computing activity and collects personal data without your permission. It can be hidden in programs that you download from the Internet. Once you install that program, the spyware can monitor your activity and send that information to someone else. Email addresses, web browsing habits, usernames, and passwords are just some of the data that spyware can collect. This data can then be used for identity theft, marketing, spam, and other activities. Along with the ability to steal your information, spyware also consumes large amounts of memory on your computer, making it more unstable and prone to crashing.
2. To reduce the amount of spyware on your computer, all computers connected to the Wright State University network are required to have actively updated spyware protection software installed if available for that operating system.

Keep in mind that email is not secure. Never put sensitive information, such as Student Grades, Social Security Numbers, Credit Card information, or Bank Account Numbers into any part of your email or email attachments unless the email and attachment are encrypted.

1. Faculty and staff: Please note that any attachments containing ePI (electronic personal information) must be encrypted before being sent via email.
2. When sending an encrypted message through email, never place the password to unlock the file in an email.
3. Do not forward documents or emails containing institutional data to outside email accounts without first checking with your manager and/or the Department of Information Security.
4. In addition to the above security concerns the following apply:
   1. Forgery (or attempted forgery) of electronic mail messages is prohibited.
   2. Attempts to read, delete, copy, or modify the electronic mail of other users are prohibited.
   3. Attempts at sending harassing, obscene and/or other threatening email to another user are prohibited.
   4. Use of electronic mail services for purposes constituting clear conflict of WSU interests or in violation of Policy for Responsible Use of Information Technology is expressly prohibited.
   5. The use of email in any way to facilitate the conduct of a private commercial purpose is prohibited.
   6. The contents of email messages will not be considered private and are subject to the Sunshine Laws.
   7. Users may not use WSU CaTS' mail servers for any purpose prohibited by this policy or applicable state and federal laws.

Protecting the integrity of data is another very important step in the overall health of the university's information. You can do this in a number of ways, most notably through using data encryption methods, backing up the data on a regular basis, and using Virtual Private Network (VPN) software when connecting to university information from remote locations.

For more information concerning CaTS VPN go to: http://www.wright.edu/cats/policy/security/vpn_policy_printable.pdf

1. Encryption

   Encryption is the process of transforming information from clear or plain text into a non-readable format so that only the intended reader can understand or change the message content. Encryption ensures privacy. It is a way to keep prying eyes from reading confidential information that is sent across the public internet.

   Certain software applications have encryption methods embedded in them for sending and receiving secure information and for the storage of information. There is also third party software available that can be used to encrypt information. For directions on encrypting files, check out the "Encryption" area on the following website: http://www.wright.edu/security/itwright/habits.html#integrity

2. Backups

   One of the most important steps you can take to ensure that the integrity of your data is protected is to backup your files on a regular basis. Data loss can come at any time and for a number of reasons:

   1. Theft of computer
   2. File corruption
   3. Hard drive failure
   4. Accidental deletion of a file or files
   5. Viruses
   6. Natural disasters

3. Perform a backup of your files at least once a week, and backup critical files more often if they change. If you need assistance in backing up your files, contact the CaTS Help Desk at (937) 775-4827 and they will be glad to assist you. If files are stored on the network shared drive or network personal storage space, backups are performed by CaTS on a nightly basis.

4. Mobile and Cellular Devices

   Information stored on laptop computers, personal organizers (e.g. Blackberry, Palms), cellular phones, thumb drives, and other similar mobile devices is susceptible to equipment failure, damage, or theft. Information transmitted via wireless connections is not always secure—even networks using certain types of encryption are vulnerable to intruders. The following rules apply to all mobile devices:

   1. Encrypt documents containing sensitive information before they are placed on portable devices, unless the entire drive or data storage of the device is encrypted.
   2. Smart phones capable of receiving email should be configured to connect to our server via secure IMAP—Post Office Protocol is not to be used.
   3. Protect and secure mobile devices from theft at all times.
   4. Use CaTS VPN when transmitting sensitive information via wireless technologies.
   5. Use personal firewalls on laptops that will access the WSU Network from a remote location.
   6. Password protect mobile devices when not in use.
   7. Report any loss or theft of a mobile device containing sensitive information to the Department of Information Security.
   8. Backup the data on your mobile devices on a regular basis—backup media should be stored in a secure location or the backup should be encrypted.
   9. Bluetooth wireless is to be disabled to protect mobile devices from unauthorized access.
5. Security of Surplus Equipment

   When university owned computer systems reach the end of their usefulness in your department, you have the option to surplus that equipment through ESPM. However, this presents its own share of security risks that need to be addressed. Due to the significant risk of sensitive Information leaving the university on hard drives that have not been properly erased, all computer (desktops and laptops) that are being sold through ESPM must have their hard drive removed by CaTS before being processed through ESPM. CaTS will ensure proper disposal of the drive. To arrange a removal, contact the Cats Help Desk at (937) 775-4827.

6. Security of Physical Media

   Ensuring the confidentiality of information requires that all physical media (CDs, floppy disks, hard drives, etc) be disposed of properly. This means that, in addition to being properly erased before being discarded, hard drives must also be erased before being returned for any type of warranty work. Additionally, other media such as floppy disks, CDs, DVDs, and paper must also be carefully destroyed if they contain confidential information. Floppy disks should be destroyed by breaking the disk in half, and cutting the center ring with scissors. CDs and DVDs should be broken into multiple pieces, and paper documents should be shredded. If assistance is needed in properly disposing of any physical media, contact the CaTS Help Desk at (937) 775-4827.