Shared group resources - security and good practice

[wwarriner]

What would you like to see added?

Discuss security and good practice responsibilities of shared group resource owners in a central location.

Periodic review of membership, permissions and access control.

• More frequent is more secure, at least once per year and at certain events.
• Events which initiate a review:
  • Security incidents
  • Someone leaves the owner's group (e.g. a student leaves a lab group, or moves to a different project)
  • Someone moves to a role with greater permissions or responsibilities within the owner's group (e.g. a staff member takes on a data stewardship role, needing to see all data)

[wwarriner]

• Account Responsibilities (terms of use?) Command Center
  • For all account holders
    • UAB Code of Conduct: https://www.uab.edu/compliance/code
    • IT policies (https://www.uab.edu/it/home/policies)
      • Acceptable Use (https://secure2.compliancebridge.com/uab/portal/getdoc.php?file=300)
      • Data Access (https://secure2.compliancebridge.com/uab/portal/getdoc.php?file=301)
      • Data Protection and Security (https://secure2.compliancebridge.com/uab/portal/getdoc.php?file=302)
      • Data Classification (https://www.uab.edu/it/home/policies/data-classification/classification-overview)
      • Password Standard (https://www.uab.edu/it/home/policies/password-passphrase-standard)
      • Remote Work (https://www.uab.edu/it/home/policies/remote-work-policies)
    • Responsible Conduct of Research training (https://www.uab.edu/research/home/responsible-conduct-of-research)
    • Annual account certification (https://docs.rc.uab.edu/account_management/cheaha_account/#account-requires-certification)
  • Also for account holders working with PHI
    • HIPAA policies (https://www.uab.edu/it/home/policies/compliance/hipaa)
    • HIPAA training (https://www.uab.edu/compliance/areas-of-focus/privacy/training)
  • Also for Project Owners and Stewards
    • Periodic review of project membership and access control. At least annually.
    • FERPA training is available: If your project(s) are accessible by students, be aware metadata about your project(s) may contain FERPA-protected sensitive data. (https://www.uab.edu/registrar/ferpa/faculty-staff)