UNIVERSITY OF CALIFORNIA, RIVERSIDE ANNUAL INVENTORY OF SYSTEMS CONTAINING PERSONAL PROTECTED DATA SEPTEMBER Organization

Transcription

1 UNIVERSITY OF CALIFORNIA, RIVERSIDE ANNUAL INVENTORY OF SYSTEMS CONTAINING PERSONAL PROTECTED DATA SEPTEMBER 2012 Form to Submit Info about a System with Protected Data There are two methods of help for getting help and understanding the type of input desired for each field. The first is available on the status bar located on the bottom of the document. To display the status bar, on the Tools menu click Options, click the View tab, and then select the Status bar check box under Show. When you click a highlighted field with the cursor, help text, if available will be displayed. If additional information is desired for a field, select the field by clicking and press F1 for Help. If a section needs additional space (such as multiple OSs running on the same physical box), simply go to the Tool Bar -> Tools -> Unprotect Document (not password protected) then copy and paste sections requiring additional input. Organizational Unit Department Data Proprietor(s) Date of Submission Organization Type of Protected Data Social Security Number Driver s License Number Financial Account or Credit Card number in combination with any password that would permit access to the individual s account. Medical Information Health Insurance Information Select level of Sensitivity High Describe sensitive data. Type of Sensitive Data General System Information The following section is referring to the System information including current location, IP address(es), system name(s), system custodian(s) and requests for information about the Operating System and installed software. Location/Physical Security Building Floor Room Number Describe the physical security for this system. Is this system a laptop?

2 If yes, please describe methods used to ensure physical security of the laptop. General System Information Enter IP address(es). Please include additional address if using multiple nic cards for the same physical system. e.g Enter the system's fully qualified host name. e.g. TANG.UCR.EDU Please list all the DNS aliases or URLs associated with this host. Describe this system s use or purpose. System Custodian.UCR.EDU First/Last Name Address(es) Work Number Additional Numbers Additional contact information Operating System Windows Version Solaris Check Type of Operating System FreeBSD Linux Version Other If Other, enter name Version System's NetBIOS (WINS) name. Services and Applications The following questions regard system services and applications. A "Service" is functionality offered to the end-user/customer like a web server, SSH, SMTP, SQL or Exchange. Whereas an "Application" would be, Internet Explorer used to browse the network or Eudora to read mail. Service Version/ Application Version/ e.g. HTTP Apache e.g. Microsoft Internet Explorer 6.0 e.g. SMTP Sendmail e.g. Microsoft Office 2003/SP2 Host-Based Security Does this system have a host-based firewall? 2 of 5

3 What software, including version, is used for the host based firewall? How frequently are firewall logs reviewed? What is the most frequent incident found in these logs? How many people have administrative rights to your systems? Administrative Access Controls Are logs kept of administrative access? Are they reviewed periodically? Please describe the logging procedure. Include log location, retention period, frequency of review and the contact information for the person responsible for the review. 3 of 5

4 Database Information The following section pertains to the database administration on the system. In the event there are multiple databases with different data custodians (such as multiple Databases running on the same physical system), go to the Tool Bar -> Tools -> Unprotect Document (not password protected) then copy and paste sections requiring additional input. Data Custodian First/Last Name Address(es) Work Number Additional Numbers Additional contact information Database Access Controls How may people have access to databases on this system Has the Data Proprietor authorized all of the people No Do any of the people with access use a that contain protected data? with such access? shared password? Are logs kept of all database accesses? No If yes, please describe the logging procedure. Include log location, retention period, frequently of review and the person responsible for the review. Software Development Controls Do you use change management when you develop applications that interact with or use restricted and/or essential data? No If yes, please describe your change management system and procedures. If you are using a vendor product for change management, include the product name and version. Backups/Data Security Are your information resources backed up? No What is the backup media? In detail, please describe the schedule for performing backups. (Mon-Thurs perform incremental backups, Friday Full/Image backups) Are backups kept locally or sent off-site. Please describe. Please describe the method for performing backups. For example: Remotely via Veritas NetBackup. What is the retention period for keeping backups? Do you transfer or make copies of restricted data to other systems? Do you use encryption when transferring restricted data to other systems? If, describe encryption cipher method and key management. Is this system behind a network firewall? Network Security Who is the person responsible for managing the network based firewall? 4 of 5

5 address. phone number(s) What appliance is used as the network firewall? Please include platform, version of code, and a brief description of the ruleset. How frequently are firewall logs reviewed? What is the most frequent incident found in these logs? Managerial Controls Are you familiar with UCR s IS-3 escalation Are user s required to have background checks prior to procedure? accessing protected data? What is done to ensure timely removal of accounts for users who no longer require access? Disaster Recovery Do you have a disaster recovery plan for this system? No Please describe. Has this plan been tested? No If yes, what were the results? 5 of 5