IT Credentials

Layout for printing
Policy Number:
UW-528
Responsible Office:
Division of Information Technology (DoIT)

University Policy

Rationale/​Purpose:

The purpose of this policy is to protect information services and resources used for UW-Madison purposes. Many cybersecurity threats and vulnerabilities involve compromised credentials. Maintaining up-to-date practices in digital identity, IT credentialing, and authentication greatly reduces cybersecurity risk. The user community’s acceptance of and participation in digital identity practices relies on the availability of appropriate infrastructure and training/education support.

Definitions:
Access Control
A combination of identification, authentication, authorization and audit that seeks to assure that only authorized entities are able to access protected resources.
Authentication
The process by which a presented identifier is proved, validating identity. Authentication is usually accomplished through the presentation of tokens.
Credential
A combination of an identifier and an authenticator (and in some cases additional information) that can be used for access control. A username and password pair is a credential.
Identification
The process by which an entity makes itself known for purposes of access control.
Identity
An attribute or set of attributes that represents an organization’s understanding of an individual as unique from other individuals.
Identity Management
Management of business processes, applications and electronic services involving identification.
Risk
The possibility that a negative consequence may result from an action, event or circumstance. The probability of occurrence and severity of the consequences are usually considered in assessing risk.
Standard
A measurable criterion for consistency.

For additional definitions please see the IT Policy Glossary.

Scope:

This policy applies to all UW–Madison-owned and non-UW–Madison-owned devices and services that are used for UW–Madison purposes, as described in the UW System Board of Regents policy 25-3 “Acceptable Use of Information Resources.” It applies to all persons or entities authenticating to access UW–Madison information services or other information resources and to all providers of information services and other information resources used for UW–Madison purposes.

Policy:
  1. Adoption of Evidence-Based, Peer-Reviewed Standards

    Specific Standards adopted under this policy will be based on evidence-based, peer-reviewed research and standards, except when there are legal, regulatory or contractual requirements to adopt other standards for specific use cases.

    1. Reference Standard

      NIST SP 800-63 is adopted as the reference standard for implementations and use-case standards under this policy. When appropriate, a newer reference standard to replace NIST SP-800-63 may be adopted through the designated approval process.

  2. Specific Use-Case Standards

    UW–Madison will develop and maintain Standards for specific use cases. The Standards will describe how to apply this policy based on the adopted Reference Standard.

    1. Adaptations

      NIST SP 800-63 and other adopted standards may be adapted to appropriately respond to unique UW–Madison requirements.

    2. Use-Case-Specific Standards and Implementations

      When it is not technically possible or practical to comply with the Reference Standard, as adapted, a Use-Case-Specific Standard may be developed. Use-Case-Specific Standards and associated system implementations may include additional security controls if appropriate. Use-Case-Specific Standards and system implementations will be developed by appropriate IT staff in collaboration with the Office of Cybersecurity and will be guided by the reference standard. Use-Case-Specific Standards and system implementations will apply appropriate security for the risk of the specific use case.

    3. Authorization and Documentation of Use-Case-Specific Standards and Implementations

      Use-Case-Specific authentication and authorization Standards and implementation for any IT system must be documented. Documentation must be provided for review as part of any relevant risk assessment and the risks associated with the Use-Case-Specific Standard and implementation must be accepted by the designated Risk Executive, as defined in UW–503 Cybersecurity Risk Management.

  3. Required Considerations for Acquisition, Design, and Other Key Activities

    The following must be considered by UW–Madison information service providers when acquiring, designing, building, documenting, deploying, communicating, and evaluating the IT credentials, IT systems and services, and related practices used to protect UW–Madison information resources.

    1. The need to protect UW–Madison information services and other resources, constituent privacy, and institutional reputation should always be balanced with the need to support and expedite research, teaching, and learning.
    2. Appropriate authentication should be used to protect all information services and devices used to conduct UW–Madison business or to access, manage, process, or store UW–Madison data.
    3. Information service providers should use a risk-based approach to determine the minimum authentication strength required for their service. Users should be able to elect for stronger authentication than the minimum required to access a service.
    4. Institutionally managed and common authentication and authorization systems should be used. Alternatives must be documented and approved by the responsible risk executive. Additional controls may be considered as part of the authentication process.
  4. Advisory Group

    The Vice Provost for Information Technology (VP-IT) and Chief Information Officer (CIO) will designate an appropriate credentials and authentication Advisory Group. This group will advise the VP-IT (CIO) and other responsible leaders on:

    • Interpreting the required considerations outlined in Section III of this Policy
    • Adopting, developing, and revising standards under this policy
    • Monitoring and evaluating the effectiveness of the requirements for IT credentials that protect IT resources
    • Revising and updating this Policy and the Implementation Plan as needed

    Final decisions on these matters will be made by the VP-IT (CIO) or other appropriate campus leadership, in consultation with the Information Technology Committee (ITC).

  5. Implementation Support

    The VP-IT (CIO) will support this policy by providing:

    • Authentication/authorization solutions for systems and services that fall within the scope of this policy
    • Appropriate tools, documentation, training, and support for IT service providers, end-users, and decision-makers
Related UW-Madison Policies:
Related UW–Madison Documents, Web Pages, or Other Resources:
External References:

Policy Administration

Approval Authority:
Chief Information Officer & Vice Provost for Information Technology
Policy Manager:
Chief Information Security Officer
Contact:
IT Policy Writer and Analyst -- Heather Johnston, itpolicy@cio.wisc.edu
Retrieved:
04-27-2024 06:42:32