• Theft or loss of a computing device that may contain Personally Identifiable Information (PII) whether or not such device is owned by KSU
  • Unauthorized access to data
  • Computer infected with malware (examples include a worm, virus, Trojan Horse, or botnet)
  • Reconnaissance activities (such as network or vulnerability scanning, or hacking/penetration testing)
  • Data Breach
  • Misuse of Information Resources or Systems
  • Denial of Service attacks
  • Security vulnerabilities (such as an un-patched or vulnerable system)

Information Technology Resource

Any data, information, or system used by KSU. This includes, but is not limited to, procedures, equipment, facilities, software, and data that are designed, built, operated, and maintained to create, collect, record, process, store, retrieve, display, share, and transmit information. This may include, but is not limited to, any and all computer printouts, online display devices, mass storage media, and all computer-related activities involving any device capable of receiving email, browsing websites, or otherwise capable of receiving, storing, managing, or transmitting data, including, but not limited to, servers, personal computers, notebook computers, handheld computers, mobile devices, pagers, distributed processing systems, telecommunication resources, network environments, telephones, fax machines, printers, and hosted services.

Information Technology System

Any electronic system that processes, stores, or transmits information.

Personal Identifiable Information (PII)

Per KRS 365.732, this is defined as an individual's first name or first initial and last name, combined with any one (1) or more of the following data elements, when the name or data element is not redacted:

  • Social Security number;
  • Driver's license number; or
  • Account number or credit or debit card number, in combination with any required security code, access code, or password to permit access to an individual's financial account

PROCEDURES:

It is the policy of KSU to implement security measures to prevent unauthorized access or destruction of Information Technology resources and systems. The security measures will ensure the confidentially, integrity, and availability of Information Technology resources and systems. By implementing this policy, KSU will address:

  • Acceptable Use
  • Awareness and Training
  • Access Control
  • Audit and Accountability
  • Data Classification
  • Business Continuity and Disaster Recovery
  • Incident Response
  • Enforcement