University Workstation Security Standard for Remote Work

Overview

All workstations used for remote work must adhere to the University’s workstation security standards below.  Only University-managed devices may be used to process, store, or transmit Restricted Data. 

Category Standard
Physical
  • University-owned workstations may only be used by University employees and for business purposes only
  • Be conscious of your work environment and who may be able to see your screen or hear your calls
Operating System
  • Only supported operating systems may be installed
  • The operating system must be configured for automatic updates, so that patches are applied at least monthly
  • Only install and configure services that are required
  • No workstation should be configured to run as a server of any kind
Applications
  • Only authorized, supported, and properly licensed software can be installed
  • Any application updates and patches should be applied at least monthly
  • When possible, applications should be configured to update automatically
  • File sharing software must not be installed
Authentication
  • Enterprise Active Directory must be used for authentication whenever possible
  • All systems must have a password-protected screensaver configured to launch after a minimum of 15 minutes of inactivity
Malware Protection
  • All systems must use endpoint protection software that is kept up to date.
Network Protection
  • The workstation must use a wired ethernet connection or an encrypted wireless router
  • Public networks must be used with a VPN (GlobalProtect)
  • Ensure the default passwords for private wireless routers have been changed to a strong password
  • A host-based firewall should be installed and configured to block unnecessary inbound ports
  • The workstation should be disconnected from the University’s network when daily remote work is complete
Encryption
  • All laptops must utilize hard disk encryption such as BitLocker or FileVault
  • Removable media used to store high-risk data must be encrypted
Cloud Storage
Data Destruction
  • Any printed copies of high-risk data must be shredded before disposal
  • When no longer needed, hard drives and removable media must be securely sanitized or destroyed and not simply discarded 
Training

 

Request Help Print Article

Related Articles (1)

Technology Guidelines and Tips for International Travel
Technology guidance for University students, faculty, and staff traveling internationally. Covers what to do before, during, and after a trip to protect University devices, data, and accounts. Includes risk-tier calibration for different destinations, border-crossing considerations, and incident reporting.

Related Services / Offerings (1)

Security Awareness and Training (KnowBe4)
SECURITY CONSULTING AND EDUCATION KnowBe4 provides security awareness resources to train, promote and reinforce information security best practices.