Responsible Computing
A Manual for Staff

University Information and Policy

Individual Responsibilities

Protect Personal Information

Managing Systems in Your Care

Computing Resources Acceptable Use Guidelines

Electronic Communications

Copyright: Your Rights and Responsibilities

For More Information

Related Policies

University Information and Policy

The information of any organization is one of its most valuable assets. As an employee of the University of Delaware, you have a responsibility for securing these assets. Information Security Policy (No. 1-15) establishes employee responsibility for protecting University information from unauthorized access, modification, destruction or disclosure. The Policy for Responsible Computing (No. 1-14) requires University students, faculty and staff to make responsible use of computing and information resources and to guard against abuse. Together these policies form the cornerstone of responsible computing at the University of Delaware. This manual, along with other related University information policies, provides implementation guidelines for complying with these requirements. If you haven't already, you need to become familiar with these policies and indicate your understanding and compliance with them at Understanding of Employee Computing Responsibilities and Notice of Monitoring.

Read and understand these policies and take time to see how they apply to your work responsibilities. Ask questions if you are unsure of what is expected of you. Ask your supervisor or send e-mail to the Help Center.

Remember that these policies apply to you just as they apply to all other employees.

Individual Responsibilities

When you power up the PC on your desktop each morning, or login to work from home, you have opened a window to University information. Responsibility for the security of that information is not delegated to a few select departments and administrators. If you have access to University information, you are also responsible for securing it. You could be a weak link in the security chain, potentially exposing the University's information system to those who would misuse it.

At the end of the day, when you log off from the network and then shut down your PC, you close the window. But, a lot of the information you worked with is still in your care. It may reside on your home or office PC, USB flash drives, CDs, or on an office file server. The following guidelines should be used by you to set specific practices for your department, office or when working from home; they are not exhaustive, but are intended to serve as a guide.

Protect Personal Information

Disclosing personally identifiable, non-public academic, financial or health information without permission is prohibited by the University's Information Security Policy (No. 1-15), Personal Non-Public Information Policy (No.1-22), and Federal laws including the Family Educational Rights and Privacy Act (FERPA), the Gramm-Leach-Bliley Act (GLBA), the Health Insurance Portability and Accountability Act (HIPAA), and the Disposal Rule, a part of the Fair and Accurate Credit Transactions Act of 2003 (FACTA). Safeguarding personal non-public information - especially Social Security numbers (SSNs), is also critically important because these data pose a high risk of identity theft or financial loss to the individual if improperly disclosed. According to the Social Security Administration, the SSN is confidential and a key piece of personal information for perpetrators of identity theft. Identity theft was the most-reported complaint to the Federal Trade Commission in 2006, accounting for 36% of the 675,000 complaints filed. Credit card fraud was the most common form of reported identity theft, followed by phone or utilities fraud, bank fraud, and employment fraud.

A spreadsheet, web site or other posting with grades, financial or medical information linked to social security numbers or any other personally identifiable information would violate one or more of the aforementioned laws and University policy. The Department of Education has even ruled that using the last four digits of SSN for grade postings violates FERPA, so no portion of the SSN can be used as an identifier. Contact the University Registrar for more information on secure ways to post grades.

Unless required by law, or needed to perform core departmental activities which cannot be immediately facilitated by other means, SSNs or other high risk personal non-public information must not be collected or stored. Personal non-public information should not be stored on systems in your unit or on personally owned computers. Whenever possible, centrally administered systems must be used to retrieve, process or store personal non-public information. University departments must re-evaluate their acquisition, use and safeguarding of personal, non-public information for conformance to these guidelines at least annually.

If you have personal non-public information on a system in your unit, a personally owned system or a portable storage media it must be encrypted and you must safeguard it from unauthorized disclosure, alteration and destruction as outlined in the system management section below. You are required to notify all persons whose information may be disclosed if your system is compromised and you have unencrypted high risk personal non-public information stored on it. Be wary of, and verify all requests for personal non-public information from unfamiliar persons. Social engineering is the use of subterfuge to gain access to confidential data. Never send or confirm personal non-public information over the phone or by e-mail, even if the requesting party provides it.

Managing Systems in Your Care

Unless your department has designated someone else to manage your personal computer/workstation, you are its system administrator. As a system administrator, you are responsible for safeguarding your computer’s stored information and for keeping it safe from unauthorized users and processes (e.g., worms, bots, viruses, etc). You may also be responsible for a departmental server, computing site or subnet. System administrator responsibilities can range from a single laptop or office pc to a multi-processor server.

Each system you administer is most likely connected directly to the internet via the University’s network. The University does not selectively monitor, filter or block information passing over its network to maintain the highest support for free and unimpeded exchange of scholarly information. With that freedom comes the responsibility to protect confidential University information against the inherent risks of being connected to a high-speed, open network.

Security Management Basics

• Learn how to properly secure your system and its stored data (permanently attached and removable media) from unauthorized modification, destruction or disclosure. An insecure system is vulnerable to being compromised, and then used remotely to attack other machines. By keeping your system free from hackers, you are also preventing possible accusations against yourself and the University.


• Keep your operating system up to date by configuring your system to automatically download and install patches. As the administrator of your personal computer or server, you are responsible for protecting it by keeping it up to date. Vendors, including Microsoft, routinely release security and other critical patches free of charge when vulnerabilities are discovered. Microsoft NEVER sends patches by e-mail. Beware of e-mail claiming to be from Microsoft with attached Windows patches (See How to Tell if a Microsoft Security-Related Message is Genuine). Microsoft does provide an e-mail alert service informing subscribers when security update announcements are released.


• Use current anti-virus software at all times, especially to scan e-mail attachments. Information Technologies requires McAfee anti-virus software for PCs and Macintoshes. The University has a site license for McAfee anti-virus software that can be downloaded free of charge.


• Use a firewall to protect your computer from unwanted, malicious probes by other systems. It’s like locking your doors at night to keep someone from just walking into your home. A new, unprotected computer can be infected within seconds of being connected to the internet, but turning on a firewall first can protect it while updates and current virus protection are obtained over the internet. Windows XP has a built-in firewall that is easily activated.


• Electronic communications (e.g., POP or IMAP e-mail, web files, login sessions and wireless) are not routinely encrypted over the University network or when working from home. The University's recommended web mail service is encrypted automatically. Although the probability of an Internet e-communication being intercepted (and falling into the wrong hands) is small, sensitive communications and documents -e.g., those containing personal non-public information - like Social Security numbers, credit card numbers, academic records and especially your passwords - should not be sent over the Internet without being encrypted. Recommended encryption protocols are described in more detail in Security 101. Contact the Help Desk at 831-6000 for more information about using encrypted protocols to secure electronic communications.


• Encrypt files containing personal non-public information. If the computer or removable media is compromised or stolen, the encrypted information will be unusable in the perpetrator’s hands. Contact the IT Help Center at x6000 for more information on encryption software.


• The risk to sensitive information stored on a computer increases as its exposure to people, other computers, and the range of duties assigned to it increases. The number of users, both inside and outside the University, connections to other computers including web surfing, and types of applications running (e.g., database and web surfing) all must be considered when assessing whether a system is configured to adequately safeguard the information it contains. Be cautious of freeware and shareware as these programs can introduce processes that compromise your system’s security. Peer to peer applications can be especially dangerous if personal or confidential information resides on the system. These applications can inadvertently disclose sensitive, personal or confidential information residing on the host system to anyone who finds it via a simple query. Peer to peer applications should not be installed on any system containing PNPI. Read more...


• Choose passwords for your computer accounts, including the administrator accounts on your PC that are not easily guessed.  Sound passwords are combinations of letters and numbers or special characters – the longer the better. Commit them to memory and never write them down or tell them to anyone. If you tell someone your password or PIN, you are potentially giving that person access to information that was entrusted specifically to you. If you write down your password or PIN, choose a password that is easy to guess, or transmit it in clear text when you log on from the office or from home you run the same risk. To encrypt your password or PIN and all other information sent to, or received from University systems, you should use a SSH terminal client. Contact the Help Desk at 831-6000 for more information about using SSH to encrypt your computing sessions.


• E-mail messages may be stored as files on centrally administered storage. The e-mail messages you send become the possession of the receiver and can easily be re-distributed or seen by others. In this sense, they are not private. They are unlike face-to-face or unrecorded telephone conversations in this regard. When the confidentiality of a message is of the utmost importance, only a person-to-person conversation may be sufficiently secure.


• Log off your computer when you leave your desk, or set it up to require a password after a pre-set amount of inactivity. Keep information displayed on your screen confidential, just as you would keep confidential printed material on your desk or in your files away from wandering glances.