Data Security Safeguards
DO review and follow the requirements and expectations set in the College’s data and technology policies and procedures (Volume 7).
DO NOT copy or download highly restricted data (e.g., Social Security Number (SSN), credit card numbers, electronic health records, or other personally identifiable information protected by law, contract or regulation, such as HIPAA, GLBA, FERPA, PCI, etc.) from the College’s administrative systems to your personal PC, laptop, smartphone, public web server, personal cloud systems, or any portable storage device. Storage of personally identifiable information on PCs, portable devices, personal cloud systems/services (e.g., Dropbox, etc.) is strictly prohibited.
DO NOT send or share such data via email. If sensitive or restricted data is sent to you via email, please handle appropriately, including removing/deleting attachments from emails sent to you. It is advisable to share this with others if there were multiple recipients to the email. Copies of attachments with sensitive information are stored in every mailbox that sends and receives them.
DO leave highly restricted data on enterprise systems. Restricted data, such as sensitive business data, grade books, etc., can be stored on institution-provided equipment and institution-provided cloud storage systems, such as Office 365 OneDrive for Business, Teams or SharePoint sites.
DO protect all sensitive data in printed form. Store in a secured cabinet, within an accessed-limited room or office designated space for storing sensitive documents.
DO shred sensitive data in printed form or securely delete and wipe digital media that needs to be disposed.
DO NOT leave sensitive data in printed form (hard copy) lying around, unattended on copiers, fax machines, or printers.
DO download only the data you need to complete your tasks.
DO NOT download data not intended for the immediate task at hand.
DO NOT share sensitive data with individuals who are not authorized to view it. This includes being mindful of what you access when in public places, such as cafes or other public places where others can peer over your shoulder.
Email Security Safeguards
DO double check each email prior to sending it to ensure no unintended email address are added in any recipient fields (e.g., “TO”, “CC”, “BCC”, etc.) and that no highly restricted data is attached.
DO NOT send emails without reviewing the content or attachment for highly restricted data, and unintended email addresses. Make sure to double check all attachments that may contain hidden data fields, such as spreadsheets where columns are set to hidden or multiple tabs with additional data fields.
DO follow requirements regarding the retention of emails that may be subject to Florida’s Records Law as most email may need to be retained for a period of 7 years.
DO NOT reply to emails or pop-up messages that ask for personal or financial information. No one at the College should ever ask you to submit personal information or credentials via return email or by clicking on a link.
DO leave your College emails on the College email system, Office365.
DO NOT forward your “business” emails to a third-party external email system, such as Gmail, Hotmail, Yahoo mail, or any third-party email system. Such action could potentially expose sensitive data and your personal email mailbox may be subject to Florida’s Public Records Laws.
DO look closely at links embedded in an email by hovering your mouse/pointer over it and cut and paste a link from the email into your web browser. Scammers can make links look as though they go to a safe site but will send you to a harmful website.
DO reporting potential phishing emails, or any suspicious email, to the service desk team. Feel free to send them to OITServiceDesk@valenciacollege.edu as we can assist you with getting the appropriate reporting completed. Please send suspected emails as an attachment. Or use the built-in feature in Outlook (desktop or web app) for reporting phishing emails. This will automatically report the suspicious email, with the email attached, to OIT and Microsoft.
DO NOT click on links in an email message or open file attachments from an unsolicited email.
DO confirm the source by contracting the sender before opening email attachments.
Secure Computing Safeguards
DO secure your workstation (lock or logoff of your session) every time you leave your desk. Make sure to disconnect from VPN when logging off of your computer.
DO NOT leave a logged-on workstation unattended.
DO NOT use a computer without having up-to-date anti-malware software running on it.
DO NOT dispose or transfer ownership of devices without making sure it is properly erased by OIT.
DO use anti-malware software and update it frequently to keep malicious programs off your computer.
DO NOT use wireless technologies for transmitting sensitive data without making certain end-to-end encryption is enabled (e.g., VPN, TLS, HTTPS, etc.), regardless of whether or not wireless encryption is used.
DO run the most up-to-date versions of your web browser, browser plug-ins (e.g., Adobe Flash, Java), email software, and other programs.
DO NOT download programs, documents, applets, and/or images from unreliable and unknown sources; your download may contain malicious software.
DO use a strong password that is difficult to guess, consisting of eight (8) or more characters, including lower case and upper-case letters, numbers, and special characters. Longer passwords, or pass phrases are in general more secure than shorter passwords.
DO NOT use easy-to-guess passwords that contain only numbers or letters.
DO use different passwords for your different online websites. Using the same password for all your online websites will put you at risk of an account compromise.
DO use a non-administrative account when using your computing devices. Administrative accounts are created for system management responsibilities and are not intended for regular use.
DO use College-provided VPN solution to securely connect to the College’s resources from remote untrusted networks, such as public Wi-Fi networks, hotels, Internet Cafes, etc. Make sure to disconnect from VPN when not in use.