Information Security
Use Identity Finder to reduce the risk of sensitive data breaches
Faculty and staff can use Identity Finder to take an active role in reducing the University's risk of accidentally exposing sensitive information to hackers. Identity Finder for both Macintosh and Windows computers is available at UDeploy.
You can improve the University's security posture by scanning your computers and external storage devices (e.g., hard drives, USB thumb drives) for Personally Identifiable Information (PII)—such as Social Security numbers (SSNs)—and then deleting or encrypting that information. To date, your colleagues have used Identity Finder to uncover a variety of sensitive information on their computers:
- class rosters and grading spreadsheets from the 1990s (with student SSNs)
- Social Security forms (with parents', children's, or employees' SSNs)
- SSNs and credit card information in old receipts.
If you find sensitive information, decide whether it should be securely erased or retained. Reminder: If a document with PII needs to be transmitted or retained, University policy states it must be encrypted.
For more information, read the Identity Finder help files, consult with your college or departmental IT staff, or contact the IT Support Center.
DHS risk and vulnerability assessment
In June 2015, the Department of Homeland Security (DHS) National Cybersecurity Assessment and Technical Services (NCATS) team conducted a risk and vulnerability assessment of the University’s network. Starting from both on- and off-campus Internet addresses, the DHS NCATS team scanned the entire University network for vulnerabilities. The team reported that, particularly given the challenges posed by an academic environment, "[University of Delaware] IT staff [are] doing an exceptional job at securing the numerous web applications that exist on the network as well as retaining good situational awareness about the network as a whole." The report also delineated recommendations for improving the University's IT security. The University is taking steps to follow those recommendations, including:
- promoting use of 2FA for logging in to UD services
- improving endpoint (computers and devices used by faculty and employees) security
- enhancing campus awareness of spear phishing attacks.
UD IT security training for departmental and college IT staff
Over the summer, IT-Client Support and Services (IT-CS&S) offered desktop security training to departmental and college IT staff. In June, IT staff offered a session about securing and managing client desktops using Active Directory and Group Policies, laying out a logical organizational unit (OU) structure. In July, IT staff led a deep-dive session on Applocker, a follow-up to an overview session held in early spring. Applocker can block a client desktop from using software that has known security vulnerabilities. These workshops are part of ongoing training that began with a "Desktop Security Tools, Techniques, and Best Practices" workshop in February and that will continue during the coming school year.
UD Financials move behind CAS: A step towards a standard security interface
UD Financial systems’ users began logging in using the UD CAS screen on Sept. 9. UD employees who use the reporting (FIRPT) and production (FIPRD) parts of UD Financial systems now log in through the same CAS screen they see when using applications such as Web Forms, Web Views, or My UD Business.
Moving more UD applications behind CAS allows the University to move towards a standard security interface for all UD applications. In addition, UD CAS supports two-factor authentication, a more secure way of logging in to UD resources, thereby reducing the risk to University information.
For more information, contact the IT Support Center.
