School of Medicine & Public Health – Endpoint Security

Layout for printing
Policy Number:
SMPH-6010
Old Policy Number:
60.10
Responsible Office:
SMPH Cybersecurity

School of Medicine and Public Health (SMPH) Policy

Rationale/​Purpose:

The purpose of this policy is to outline security requirements that ensure the safeguarding of all School of Medicine and Public Health (SMPH) IT infrastructure and data, including, but not limited to, Sensitive Data such as Protected Health Information (PHI) across all of SMPH and any of its departments, programs, centers, institutes, and other units.

Definitions:
Endpoint
Any device, virtual or physical, used to conduct SMPH-related business, that connects to the SMPH-managed network, and/or is used to access, manage, process, or store SMPH data. This includes devices purchased or obtained through SMPH or UW-Madison and personally owned devices that are used to conduct the work of SMPH. Examples may include desktop computer, laptop computer, tablet computer, server, or mobile device.
Multi-Factor Authentication (MFA)
A security system that requires more than one method of authentication from independent categories of credentials to verify the user’s identity for a login or other transaction.
Virtual Private Network (VPN)
A private network that connects computers over the Internet and encrypts their communications
Scope:

This policy applies to any device, virtual or physical, used to conduct SMPH-related business, that connects to the SMPH-managed network, and/or is used to access, manage, process, or store SMPH data. This includes devices purchased or obtained through SMPH or UW-Madison and personally owned devices that are used to conduct the work of SMPH.

Policy:
  1. Endpoints must be compliant with this policy before being used to conduct SMPH or university business. When an endpoint is discovered to be connected without authorization, access will be disabled for the device.
  2. Endpoints that are unable to meet any items of this policy may only be connected to university resources with a review from the UW-Madison Office of Cybersecurity or SMPH Cybersecurity and must have documented compensating security controls.
  3. No wireless access points or switches may be connected directly to the SMPH network without prior approval from the SMPH Network team.
    1. An unauthorized device connected directly to the SMPH network may not provide access to other devices.
  4. Endpoints that connect via wireless networks must use an encrypted connection such as a Virtual Private Network (VPN) solution to access departmental resources.
    1. All VPN solutions must use Multi-Factor Authentication (MFA).
  5. Only authorized staff with the appropriate job responsibilities will be allowed to manage SMPH or university owned endpoints.
  6. Owners of personal devices must ensure their personal device meets the requirements in this policy and the requirements of the SMPH Endpoint Standards.
  7. Endpoints must have controls implemented in the SMPH Endpoint Standards. If unable to implement a control from the SMPH Endpoint Standards, this must be documented and compensating controls in place.
  8. Endpoints containing restricted or sensitive data must follow additional UW-System, UW-Madison, and SMPH policies, in addition to Wisconsin state laws and federal regulation.
Related UW-Madison Policies:
Related UW–Madison Documents, Web Pages, or Other Resources:
External References:

Policy Administration

Approval Authority:
Dean, School of Medicine and Public Health
Policy Manager:
SMPH Cybersecurity Governance, Risk, & Compliance (GRC) Manager
Contact:
SMPH Cybersecurity Governance, Risk, & Compliance (GRC) Manager -- Amy Diestler, adiestler@wisc.edu, (608) 263-4623
Effective Date:
02-01-2018
Date Issued:
02-01-2018
Revised Dates:

10-27-2022

Retrieved:
12-10-2024 10:08:14