Statement and Purpose
Privileged Access
Privileged access, commonly referred to as supervisor, system administrator, admin, or root access, grants an individual non-standard elevated access to the resources and data to perform system / data administration job duties. University staff with privileges or access used to administrate systems or data is considered a user with privileged access.
Requirements for Privileged Access
- Privileged access is only be granted to employees requiring elevated access to perform documented job responsibilities.
- CIS may require an in person meeting and/or technical skills assessment to demonstrate competency prior to granting privileged access.
- Eligible employees are required to sign and agree that they have read, understand, and will comply with the policy prior to being granted privileged access. Signed agreements will be kept on file by the CIO in the department of Computer and Information Systems.
| Note |
|---|
Administrative credentials are not to be shared or disclosed under any circumstance, except with the express approval of the CIO. |
Agreements by Privileged Users:
Privileged users agree to use privileged access appropriately, respect privacy, protect institutional data, and enforce security and legal compliance, as more fully described below.
Use Privileged Access Appropriately
- Administrative credentials are not to be used as a primary login for non-privileged access and activities.
- Privileged access may only be used when performing administrative job duties that require elevated permissions.
Respect Privacy
- Privileged users should never “browse” through the another persons personal data or institutional data while using privileged access, unless such browsing is a specific part of their job description (e.g. computer auditor); is required during file system repair, management, or restoration; is necessary to investigate suspicious or system-impairing behavior; or is specifically requested by, or has the approval of, the person who authorized the privileged access.
- Investigative activities must be authorized by the SPU president, provost, VP or the CIO. See CIS Privileged Account Usage for details.
- Privileged users should protect the confidentiality of any information they encounter while performing their duties. Unauthorized disclosure of confidential information could seriously and adversely impact SPU, its students, and other individuals and organizations associated with SPU.
- Privileged users should never disclose to any unauthorized person any institutional data observed while operating with privileged access.
Privileged users should not copy any institutional data observed while operating with privileged access for any purpose other than those authorized under their defined job responsibilities.
Protect Institutional Data
- Privileged users should seek to protect institutional data and should not intentionally or recklessly damage or destroy any Institutional Data. See Institutional Data Policy for details.
- Privileged users should not take actions on computer systems under their charge that will impair the integrity or security of that system or other University systems.
Privileged users should not modify or delete institutional data unless it is done in accordance with SPU policies and procedures.
Enforce Security and Legal Compliance
Privileged users should use all available protections to safeguard computer system(s) under their charge from unauthorized access by any person or another computer.
Privileged users should report all suspicious requests, incidents, and situations regarding an SPU computing resource to an appropriate member of management or the CIO.
Privileged users should comply with all computer security standards and policies in force at SPU.
Privileged users should not attempt to gain or use privileged access outside of assigned responsibilities, or beyond the time when such access is no longer required in job functions.
Privileged users should not tell or disclose to any unauthorized person the information required to gain privileged access, and should not engage in careless practices that would reveal that information to unauthorized persons.
Privileged users should not change or develop any computer software in such a way that would (1) disclose computer information to unauthorized persons or (2) make it possible to retain any special access privilege, once that authorized privilege has been terminated by management.
Privileged users should not do special favors for any user, member of management, friend, or any other person regarding access to SPU computing resources that would circumvent prevailing security protections or standards or would otherwise violate this policy.
Privileged users should maintain awareness and responsibility for complying with all applicable laws, regulations, policies, and procedures.
Granting of Permissions
Many privileged users have the ability to grant access to SPU systems and/or institutional data they administer, including the ability to grant others privileged user access to that system. Privileged users are responsible for permissions they grant as follows:
| Note |
|---|
Supervisors and administrators approving or granting privileged access are accountable for any abuse of privileged access if proper procedures were not followed when granting said access. |
When granting permissions, privileged users are responsible for:
Following any policy or procedure governing the granting of permissions or access related to the system in question.
Receiving authorization from a system owner, supervisor, or other administrator authorizing the granting of permissions.
Questioning the requester and/or approver to ensure appropriate access is being granted.
When granting privileged access, privileged users are responsible for:
- Following all the above noted responsibilities for granting permissions.
- Referring new privileged users to training materials, documentation, and/or policy relevant to their new access.
- Obtaining a copy of this policy, signed by the requester, (i.e., the individual requesting privileged access), the department approver, and the approving department head or director.
- Following a least privileges methodology, granting only access required by the grantee's job duties and nothing more.
When granting permissions, approvers are responsible for:
- Following any policy or procedure governing the granting of permissions or access related to the system in question.
- Verifying with the grantor that the access/permissions are appropriate for the requester.
Revocation of Privileged Access
Privileged users must always be aware that these privileges place them in a position of considerable trust. Privileged users must not breach that trust by misusing privileges or failing to maintain a high professional standard.
| Warning |
|---|
Violation of the terms in this policy should be reported to the CIO, will be dealt with seriously, and may subject the employee to loss of privileged access, and/or disciplinary action, including but not limited to termination of employment. Illegal acts involving institutional data or other SPU computing resources may also be subject to prosecution by all applicable federal, state, and local authorities. |
Definition of Terms
| Term | Definition |
|---|---|
| Access | The ability to view, use, or change information in University databases, systems, or other computer resources. |
Confidential | Information that is very sensitive in nature and is, in some cases, protected by laws and statutes. These require careful controls and protection. Examples include: personally identifiable information, protected health information, employment records, student records, financial records, social security numbers, credit card numbers, legally protected University records, and passwords. |
| CIO | The University’s Chief Information Officer (i.e., the Assistant Vice President for Technology Services). |
| Institutional Data | Any and all data that is collected and maintained by Seattle Pacific University related any university operations. |
| Disclose | Make known, reveal, release, transfer, or provide access to any institutional data in any manner. |
Personally | Personally Identifiable Information (PII) is information that is a subset of individual and student information, including demographic, financial, or sensitive information collected from an individual and:
|
| Privileged User | Any individual granted privileged access to information, systems, or databases at at Seattle Pacific University that extends beyond access to one’s own self-service data. |
| Privileged Access | Access that allows the grantee non-standard or elevated privileges allowing access to administrate systems or data. This includes the ability to alter system configurations, mange software systems, grant access, etc. It also includes elevated access to Institutional Data enabling direct SQL querying, data management, data maintenance, or reporting. |
| Protected Health Information (PHI) | Protected health information means individually identifiable health information that is protected by HIPPA. |
| Safeguard | Protect or cover from exposure, using precautionary measures. |
| System Administrator | System administration duties consist of all aspects of managing a technology-based information system, including but not limited to, user administration, front-office and back-office hardware and software configuration and management, data base administration, and network, domain, and other technology infrastructure management. |