Deans, department heads, PIs, data owners, and others in leadership positions with control of resources can play a critical role in the implementation of computer and information security in their areas. They can

• Make computer and information security a priority, providing staffing and funding to ensure the security of computer systems in their units. PIs can specify security costs as a direct cost in grant proposals.
• Make staff members aware of UB computer and information security policies
• Communicate to staff members that they are responsible and accountable for the security of their computer systems and for following the standards and best practices outlined in the information security policies
• Ensure that their staff and system/network administrators take action when systems in their area become compromised

University at Buffalo IT Security Policies and Procedures

• Information Security Policy Process
• Description of Process:
  1. Information Security Policies are developed by an Information Security Policy Advisory Group, which includes UB executive leadership and faculty, staff, and student representation.
  2. Draft policies are then vetted/reviewed by key stakeholders and the UB Institutional Policy Committee.
  3. Draft and approved policies are placed on the http://www.itpolicies.buffalo.edu web site with notes on their status.
• Policy Flow Chart
  • Under development

• UB Computer and Network Usage Policy
• Guidelines and user responsibilities for the use of UB computer and network resources
• UB Identification and Authentication Systems Policies
• UB IT Account Policies
• Security Policy for Network Connected Devices
  • University network and Internet connectivity can be jeopardized by computers/workstations, servers, and other devices that are not adequately secured and protected from attack by hackers and malicious software. This policy defines responsibilities and the process by which compromised machines may be temporarily disconnected from the network if there is a risk to the network.
• DMCA Policies
• Distribution of copyrighted material, including music, games, and movies, for which you do not have the owner's permission is a violation of federal law (DMCA) and University policy. The DMCA policies provide information on notifying the campus DMCA agent about violations, how UB responds to DMCA notices, and an FAQ which answers questions about the use of the UB network for peer-to-peer file sharing and downloading copyrighted materials.
• NY State Information Security Policy
  • This umbrella information security policy is based on ISO 17799 information secu rity standards. The policy sets forth the minimum requirements, responsibilities and accepted behaviors to establish and maintain a secure environment. Although this policy is mandatory for state entities, it is not mandatory for SUNY institutions.
• NYS Cyber Incident Reporting Procedure
• Policy on Email Servers Connected to the Network
• NYS Web Accessibility Policy
• New York State has issued a policy, June 21, 2004, mandating that all state agencies make their web-based information accessible to persons with disabilities.
• NYS Electronic Signatures and Records Act Guidelines
• UB Electronic Commerce Policy (TBD)
• UB Domain Name System Policy (TBD)