#!/usr/local/bin/perl
#
#   header.cgi
#
#   Output standard CNS Security webpage headers (call using SSI include
#   directive in shtml file)
#

use warnings;
use strict;
use lib ('lib');
use CGI qw/:standard/;
use SecHdr;

print header;				# HTTP headers (even though SSI
					# include, Apache will expect this)

#SecHdr::header('printpage.js');				# Security headers
SecHdr::header();				# Security headers



<h4>Data Security for Faculty and Staff</h4>

<p> University of Florida employees are required to keep restricted 
information safe from unauthorized access.</p>

<p>Restricted data is defined as, but not limited to:</p>
<ul class="narrow">
<li>Social security numbers</li>
<li>Bank, credit card, or other financial account numbers including PIN</li>
<li>Drivers' licences numbers</li>
<li>Student Grades</li>
<li>Student Date of Birth</li>
<li>Student schedules</li>
<li>Class rosters</li>
</ul>

<p>Please read the<a
href="http://www.it.ufl.edu/policies/security/uf-it-sec-data.html"> UF IT Data
Security Standard</a> for more information on Restricted, Unrestricted and
Sensitive classification.</p>

<p>Legislation establishes personal and institutional liability and fines for
breach of private data.</p>

<p>Employees working with health related information must also be aware of <a
href="http://www.hsc.ufl.edu/itcenter/news/hipaa.shtml">HIPAA issues</a>.  For
more information, see the <a href="http://privacy.health.ufl.edu/">UF Privacy
Office</a>.</p>

<p>The UF IT Security Team strongly advises against the transfer and storage of
restricted data on personally managed machines.</p>

<p>Below are things you should do to help protect the data you work with.</p>

<h5>Three things you should always do...</h5>
<ul>
<li><a href="passwords.shtml">Use a strong password</a></li>
<li><a href="virus.shtml">Use anti-virus program</a></li>
<li><a href="updates.shtml">Keep your computer updated with current patches</a></li>
</ul>

<p>A lot of restricted information is stored on computers. By doing these three
things you significantly decrease your chance of giving an intruder access to
your data.</p>

<h5>Electronic Security</h5>
<ul>

<h6>Transmission of Data</h6> 

<p>Most users can use a Virtual Private Network connection to encrypt
communication from an untrusted network, such as from home or on a wireless
network. For more information on VPN and to download the UF VPN software, visit
<a href="http://net-services.ufl.edu/provided_services/vpn/">this link.</a></p>

<h6>File Storage</h6>

<p>If you must store restricted data on a computer, please take the necessary
steps to encypt it properly. The Health Science Center has a comprehensive
guide to encyption, you can <a
href="http://security.health.ufl.edu/eduguides/EG0007%20-%20Encrypting%20Data%20at%20Rest.pdf">download
the PDF here.</a></p>

</ul>

<h5>Physical Security</h5>

<ul>

 <h6>Lock or Turn Off Your PC When Away</h6>

<p>Everytime you step away from your computer, even if just for a minute, you
should lock your workstation.  If you're not sure how to do this please refer
to your operating system's manual or consult your Information Security
Manager.</p>

<h6>Strategically Place Monitors</h6>

<p>Set up monitors so that shoulder-surfing is difficult. If restricted
information is viewable from over your shoulder, then it's not secure.</p>

<h6>Safely Lock Up Equipment & Media</h6>

<p>All equipment with restricted  data should be locked safely away when not in
use or  unattended, whether behind doors or under locked cases.  Please advise
your department's Information Security Manager of all unlocked equipment.</p>

<h6> Dispose of  Sensitive Information Properly</h6>

<p>Restricted information in paper form should be shredded and electronic data
should be rendered unreadable.  Please visit the<a
href="http://fa.ufl.edu/am/destroy-data.asp"> Assets Management Services
page</a> to learn the best ways to detroy data.</p>

<h6>No Unauthorized Computer Changes</h6>

<p>Before allowing anyone to install new hardware and software on university
systems, please obtain approval and guidence from you department's Information
Security Manager. This also applies to personally managed computers that
contain university restricted data on it.</p>

<h6>Faxes, Printers and Photocopiers</h6>

<p>Immediately pickup sensitive material from faxes, printers and copiers.  
The longer this information is unattended the better chance for someone 
else to access it.</p>

<h6>Beware of 'Tailgaters' and Supervise All Visitors</h6>

<p>If you have a badge-protected room beware of persons following behind, or
'tailgating' on your entry. Make sure you know who they are, otherwise turn
them away.  When meeting with outside guests such as vendors, students,
visiting professors, etc.. make sure you are with them at all times. </p>

</ul>

#!/usr/local/bin/perl
#
#   footer.cgi
#
#   Output standard CNS Security webpage footers (call using SSI include
#   directive in shtml file)
#

use warnings;
use strict;
use lib ('lib');
use CGI qw/:standard/;
use SecHdr;

print header;				# HTTP headers (even though SSI
					# include, Apache will expect this)

SecHdr::footer;				# Security footers

This file last modified Monday, 24-Jul-2006 12:56:28 EDT
    </p>
</body>
</html>