At Washington University, security is critical to the physical network, computer operating systems, and application programs and each area offers its own set of security issues and risks. Confidentiality and privacy, access, accountability, authentication, availability, and Information Technology system and network maintenance are components of a comprehensive security plan. This plan identifies key concerns and issues faced by the University community at the application, host, and network level, and strives for a balance between the University's desire to promote and enhance the free exchange of ideas and its need for security of critical information and systems. This document establishes an overarching security policy and direction for Washington University. Individual schools and departments are expected to establish standards, guidelines, and operating procedures that adhere to and reference this policy while addressing their specific and individual needs.
Access defines rights, privileges, and mechanisms to protect assets from access or loss.
Accountability defines the responsibilities of users, operations staff, and management. Authentication establishes password and authentication policy. Availability establishes hours of resource availability, redundancy and recovery, and maintenance downtime periods. Information technology system and network maintenance describes how both internal and external maintenance people are allowed to handle and access technology. Many other categories of records, including faculty and other personnel records, and records relating to the University's business and finances are, as a matter of University policy, treated as confidential.