Theft or loss of a computing device that may contain Personally Identifiable Information (PII) whether or not such device is owned by KSU
Unauthorized access to data
Computer infected with malware (examples include a worm, virus, Trojan Horse, or botnet)
Reconnaissance activities (such as network or vulnerability scanning, or hacking/penetration testing)
Data Breach
Misuse of Information Resources or Systems
Denial of Service attacks
Security vulnerabilities (such as an un-patched or vulnerable system)
Any data, information, or system used by KSU. This includes, but is not limited to, procedures, equipment, facilities, software, and data that are designed, built, operated, and maintained to create, collect, record, process, store, retrieve, display, share, and transmit information. This may include, but is not limited to, any and all computer printouts, online display devices, mass storage media, and all computer-related activities involving any device capable of receiving email, browsing websites, or otherwise capable of receiving, storing, managing, or transmitting data, including, but not limited to, servers, personal computers, notebook computers, handheld computers, mobile devices, pagers, distributed processing systems, telecommunication resources, network environments, telephones, fax machines, printers, and hosted services.
Any electronic system that processes, stores, or transmits information.
Per KRS 365.732, this is defined as an individual's first name or first initial and last name, combined with any one (1) or more of the following data elements, when the name or data element is not redacted:
Social Security number;
Driver's license number; or
Account number or credit or debit card number, in combination with any required security code, access code, or password to permit access to an individual's financial account
It is the policy of KSU to implement security measures to prevent unauthorized access or destruction of Information Technology resources and systems. The security measures will ensure the confidentially, integrity, and availability of Information Technology resources and systems. By implementing this policy, KSU will address:
Acceptable Use
Awareness and Training
Access Control
Audit and Accountability
Data Classification
Business Continuity and Disaster Recovery
Incident Response
Enforcement