The policy of the North Dakota State University Information Technology Division is to respect the privacy of all users of information technology services. This electronic privacy statement is intended to inform the The Division of IT clients of our information gathering and usage practices.
North Dakota University System Policy and Procedure, 1901.2, NDSU Policies and Procedures 158 and 710, federal and state laws, and the NDSU Information Technology Services Confidential Information Agreement take precedence over this privacy statement.
Use of Information:
Electronic records needed to support The Division of IT functions are retained, managed, and accessible in accordance with established records disposition authorizations to the extent permitted or authorized by law. Electronic records will be identified, managed, protected, and retained as long as they are needed to meet administrative, fiscal, or legal requirements.
Information security is an area of major concern in higher education; without it, an institution's private data and intellectual property could be compromised.
NDSU must continually reassess the threats and risks to private data, confidential information, and intellectual property, creating a secure electronic information environment on campus. Information safeguarding requires participation from everyone in the campus community and leadership at all levels, especially in the areas of policies, procedures, governance, and infrastructure. Information security, in today's world, is everyone's responsibility, just as it is to work safely in the workplace. Individual privacy rights and open access to information must be protected as much as legally and practically possible.
Electronic records stored and received by The Division of IT are subject to the access and confidentiality provisions of state and federal law. ITS provides security and privacy for information stored and received on its systems and services. In addition, the following information provided to us is protected from disclosure to the public: personal, copyright, research, trademark, and proprietary information; unless otherwise specified by the owner. Information not specifically addressed in this document may be disclosed pursuant to the North Dakota Open Records Law.
North Dakota law specifies in NDCC Ch.44-04-18 that "Except as otherwise specifically provided by law, all records of a public entity are public records, open and accessible for inspection during reasonable office hours." All information provided to, stored, or collected electronically that is not specifically exempted by state or federal law should be considered as an "open record" and may be released upon any request of the public.
Network Traffic Logs:
In the course of ensuring network security and consistent services for all clients, we employ software programs to do such things as monitor network traffic, identify unauthorized access to nonpublic information, enforce access rights and user quotas, detect computer vulnerabilities, and other software that might damage university computers. In the course of such monitoring, the information detected from these activities is used only for monitoring for compliance with law and policy and for the purpose of maintaining the security and performance of NDSU's networks and computer systems. Personally identifiable information from these activities is not released to any party without consent unless required or authorized by law.
In the course of ensuring network security and consistent services, it may be necessary to audit NDSU owned desktops regarding:
- Operating system installation and maintenance.
- Hardware installation, repairs, and upgrades.
- Software licensing, application installation and configuration.
In the course of such an audit, personal, copyrighted, research, trademarked or proprietary data on the client's machine will not be purposely or intentionally reviewed unless there is valid and/or legal reason to do so.
The Desktop Support Team may install and maintain an application that will enable efficient and remote management and maintenance of the user's desktop. The application may also be used for the followi
- Remotely turn computers on and off.
- Automatically update antivirus definitions.
- Edit the system registry.
- Automatically update the computers operating system.
- Inventory hardware and software.
- Install and remove software applications automatically.
At no time will personal, copyrighted, trademarked, proprietary, or research data on the client's machine be reviewed unless there is valid and/or legal reason to do so.
The Division of IT servers routinely collect and store information from online visitors to facilitate management and improve service of those server and services. This information may include Web pages visited, the date and time of the visit, the Internet address (URL or IP address) of the referring site, the domain name and IP address from which the access occurred, the version of browser used, the capabilities of the browser, and search terms used on the search engines. We make no attempt to identify individual visitors from this information; no personally identifiable information is released to external parties without consent unless required or authorized by law.
Collection of Information:
The Division of IT uses the collected information to respond appropriately to requests. Survey information collected may be used statistically to help us understand usage patterns and forecast requirements.
Information Voluntarily Provided by Clients:
In the course of using the NDSU Web site, the you may choose to provide us with information to help us serve you. Personally identifiable information will only be used for the purpose indicated. Requests for information will be directed to the appropriate staff, and may be recorded to help us update services to better serve your requests. We will not sell, exchange or otherwise distribute personally identifiable information without prior authorization except to the extent required or authorized by law. We also will not retain the information longer than necessary for normal operations. The purpose for all information will be disclosed through the appropriate media form.
April 15, 2014
The Internet was stunned to learn of a significant vulnerabilty to security this last weekend. OpenSSL, an application that is used by software and services throughout the Internet for authorization of legitimate websites was found to have a core flaw. Essentially anyone from anywhere could send a specially crafted packet to a service or site using OpenSSL, asking if the server is still accepting communications and the server would return up to 64 Kilobytes of what was in its memory at the time of request. This return could be username and passwords, or documents, or even security certificates. The OpenSSL foundation responded and fixed the core code of OpenSSL, but there are still hundreds of thousands devices, or services that still are running the old version of the software. Please check for updates on your devices, and change any passwords for sites you maybe concerned about. However, only change those passwords after a site has patched their services, and revoked their old security certificate and created a new one.
December 5, 2013
Over 2 Million passwords to popular webpages discovered.
In Mid June, Trustwave Spiderlabs researchers were able to view information in the Pony Botnet controller that indicated that there were over 650,000 website credentials that had been harvested by this particular botnet, which, is fairly widespread. On Tuesday they announced that upon a more detailed look that over 2 million passwords have been harvested by this botnet. Many of these services have now been notified and they are taking corrective action on those accounts that have been compromised.