Data Security

Data Security for Faculty and Staff

University of Florida employees are required to keep restricted information safe from unauthorized access.

Restricted data is defined as

Data in any format collected, developed, maintained or managed by or on behalf of the university, or within the scope of university activities, that are subject to specific protections under federal or state law or regulations or under applicable contracts. Examples include, but are not limited to medical records, social security numbers, credit card numbers, Florida driver licenses, non-directory student records and export controlled technical data.

Please read the UF Data Classification Policy for more information on the Restricted, Sensitive, and Open classifications. The UF Data Guide can help you understand the classification of data you work with, along with appropriate tools for each data type.

Legislation establishes personal and institutional liability and fines for breach of private data.

Employees working with health-related information must also be aware of HIPAA issues. For more information, see the UF Privacy Office.

The UF Information Security Office strongly advises against the transfer and storage of restricted data on personally managed machines.

Below are things you should do to help protect the data you work with.

Three things you should always do…

A lot of restricted information is stored on computers. By doing these three things you significantly decrease your chance of giving an intruder access to your data.

Electronic Security

Transmission of Data

Most users can use a Virtual Private Network connection to encrypt communication from an untrusted network, such as from home or on a wireless network. For more information on VPN and to download the UF VPN software, visit this link.

Disk Encryption

UF Policy requires that all portable computing and storage devices that are used with University Data, regardless of ownership, must be fully encrypted. This means that even personal smartphones, tablets, and laptops used by faculty and staff must be encrypted if they use them to conduct university business. We have extensive resources to assist in encrypting personal devices. Portable USB ‘flash drives must also be encrypted – more information.

Physical Security

Lock or Turn Off Your PC When Away

Every time you step away from your computer, even if just for a minute, you should lock your workstation. If you’re not sure how to do this please refer to your operating system’s manual or consult your Information Security Manager.

Strategically Place Monitors

Set up monitors so that shoulder-surfing is difficult. If restricted information is viewable from over your shoulder, then it’s not secure.

Safely Lock Up Equipment & Media

All equipment with restricted data should be locked safely away when not in use or unattended, whether behind doors or under locked cases. Please advise your department’s Information Security Manager of all unlocked equipment.

Dispose of Sensitive Information Properly

Restricted information in paper form should be shredded and electronic data should be rendered unreadable. All old computers should be turned over to unit IT staff for proper disposal. The Information Security Office offers a Media Disposal Service to ensure that electronic media is securely disposed of.

No Unauthorized Computer Changes

Before allowing anyone to install new hardware and software on university systems, please obtain approval and guidance from your department’s Information Security Manager. This also applies to personally managed computers that contain university-restricted data on them.

Faxes, Printers, and Photocopiers

Immediately pick up sensitive material from faxes, printers, and copiers. The longer this information is unattended the better chance for someone else to access it.

Beware of ‘Tailgaters’ and Supervise All Visitors

If you have a badge-protected room beware of persons following behind, or ‘tailgating’ on your entry. Make sure you know who they are, otherwise turn them away. When meeting with outside guests such as vendors, students, visiting professors, etc. make sure you are with them at all times.