Purpose
The purpose is to reduce the risk of a data exposure attributed to a WPI breach.
Background
Encrypting sensitive information increases overall information security, mitigates some financial risk and meets compliance guidelines for state and federal regulations. By reducing the risk of a breach we reduce an individual's risk of data exposure which could expose one to identify theft. WPI's financial risk is also reduced by not having security breaches which could result in adverse negative publicity, adversely impact WPI's competitive advantage, and break non-disclosure & other legal agreements.
Data encryption has become a standard by the Commonwealth of Massachusetts Consumer and Business Regulation Division to protect personally identifiable information.
Scope
The scope includes portable devices storing sensitive information. Portable devices include, but are not limited to, the following equipment.
- Laptops and other portable computers
- Desktops located off-campus
- Computers accessed by multiple people
- Computers located in unsecured locations
- CDs, DVDs, and USB storage
- Cell phones and PDAs
Standard
Computers/Systems
WPI provides services for Windows domains that can be used to encrypt specific directories and limit access to just that specific user on a system. This capability should be applied on high-risk systems like those that routinely leave the main campus, systems which have multiple users and computers in unsecured locations or large multi-person offices.
Data Storage
Users who have or handle sensitive information should utilize a personal encrypted drive to store sensitive data. WPI supports TrueCrypt, an open-source solution. Encrypted containers using this software can reside on CD-ROMs, DVDs, and USB storage devices as well as on hard drives themselves. This is the recommended way of storing data in portable media for transport.
Cell phones and PDAs
Cell phones and PDAs storing WPI sensitive information, which may include email and user credentials, should have security PIN functions enabled and whenever possible should also use built-in encryption mechanisms to protect data on the device.
Questions and Help
For assistance, contact the Information Security Office at itsecurity@wpi.edu. They will also assist with the necessary technology to comply with this standard.
Revision:
December 2, 2008: The Information Technology Division endorsed this guideline.
October 2, 2009: The Information Technology Division added Cell phones and PDAs, and based on the MA Privacy Legislation, changed this from a guideline to a standard.