Statement and Purpose

Privileged Access

Privileged access, commonly referred to as supervisor, system administrator, admin, or root access, grants an individual non-standard elevated access to the resources and data to perform system / data administration job duties.  University staff with privileges or access used to administrate systems or data is considered a user with privileged access.

Requirements for Privileged Access

• Privileged access is  is only be granted to employees requiring special elevated access to perform their documented job responsibilities. 
• CIS may require an in person meeting and/or technical skills assessment to demonstrate competency prior to granting privileged access.
• Eligible employees are required to sign and agree that they have read, understand it, and will comply with the policy prior to being granted privileged access. Signed agreements will be kept on file by the CIO in the department of Computer and Information Systems.
  

Agreements by Privileged Users:

Privileged users agree to use privileged access appropriately, respect privacy, protect institutional data, and enforce security and legal compliance, as more fully described below.

Use Privileged Access Appropriately

1. Administrative credentials are not to be used as a primary login for non-privileged access and activities.
2. Privileged access may access may only be used when performing administrative job duties that require elevated permissions.

Respect Privacy

1. Never Privileged users should never “browse” through the another persons personal data or institutional data while using the powers of privileged access, unless such browsing is a specific part of their job description (e.g. computer auditor); is required during file system repair, management, or restoration; is necessary to investigate suspicious or system-impairing behavior; or is specifically requested by, or has the approval of, the person who authorized the privileged access. 
   1. Investigative activities must be authorized by the SPU president, provost, VP or the CIO. See CIS Privileged Account Audit and Usage Policy for details. 
2. Take responsibility to Privileged users should protect the confidentiality of any information they encounter while performing their duties.Never disclose, .  Unauthorized disclosure of confidential information could seriously and adversely impact SPU, its students, and other individuals and organizations associated with SPU.
3. Privileged users should never disclose to any unauthorized person , computer information any institutional data observed while operating with privileged access.
4. Not

   Privileged users should not copy any

   computer information

   institutional data observed while operating with privileged access for any purpose other than those authorized under their defined job responsibilities.

Protect Institutional Data

1. Not Privileged users should seek to protect institutional data and should not intentionally or recklessly damage or destroy any institutional data.Not Institutional Data. See Institutional Data Policy for details.
2. Privileged users should not take actions on computer systems under their charge that will impair the integrity or security of that system or other University systems.
3. Not

    Privileged users should not modify or delete institutional data unless it is done in accordance with

   SPU policies

   SPU policies and procedures.

Enforce Security and Legal Compliance

1. Use

   Privileged users should use all available protections to safeguard computer system(s) under their charge from unauthorized access by any person or another computer.

2. Report

   Privileged users should report all suspicious requests, incidents, and situations regarding an

   SPU computing

   SPU computing resource to an appropriate member of management or the CIO.

3. Comply

   Privileged users should comply with all computer security standards and policies in force at SPU.

4. Not

   Privileged users should not attempt to gain or use privileged access outside of assigned responsibilities, or beyond the time when such access is no longer required in job functions.

5. Not

   Privileged users should not tell or disclose to any unauthorized person the information required to gain privileged access,

   or to

   and should not engage in careless practices that would reveal that information to unauthorized persons.

6. Not

   Privileged users should not change or develop any computer software in such a way that would (1) disclose computer information to unauthorized persons

   ,

   or (2) make it possible to retain any special access

   privileges

   privilege, once that authorized privilege has been terminated by management

   or (3) create "backdoor" access that subvert in place security mechanisms

   .

7. Not

   Privileged users should not do special favors for any user, member of management, friend, or any other person regarding access to SPU computing resources

   in a manner

   that would circumvent prevailing security protections or standards or would otherwise violate this policy.

8. Maintain

   Privileged users should maintain awareness and responsibility for complying with all applicable laws, regulations, policies, and procedures.

Granting of Permissions

Many Privileged Users have the ability to grant access SPU systems and/or Institutional Data they administer, including the ability to grant others privileged user access to that system. Privileged Users are responsible for permissions they grant as  privileged users have the ability to grant access to SPU systems and/or institutional data they administer, including the ability to grant others privileged user access to that system. Privileged users are responsible for permissions they grant as follows:  

When granting permissions,

privileged users are responsible for:

1. Following any policy or procedure governing the granting of permissions or access related to the system in question.

2. Receive

   Receiving authorization from a system owner, supervisor, or other administrator authorizing the granting of permissions.

3. Questioning the requester and/or approver to ensure appropriate access is being granted.

When

granting privileged access, privileged users are responsible for:

1. Following all the above noted responsibilities for granting permissions.
2. Referring new privileged user users to training materials, documentation, and/or policy relevant to their new access.
3. Receiving Obtaining a copy of this policy, signed by the requester, (i.e., the individual requesting privileged access), the department approver, and the approving IT department head or director.
4. Following a least privileges methodology, granting on only access required by the grantee's job duties and nothing more.

When granting permissions,

approvers are responsible for:

1. Following any policy or procedure governing the granting of permissions or access related to the system in question.
2. Verifying with the grantor that the access/permissions are appropriate for the requester.

Revocation of Privileged Access

Users with privileged access Privileged users must always be aware that these privileges place them in a position of considerable trust. Users Privileged users must not breach that trust by misusing privileges or failing to maintain a high professional standard.

Definition of Terms

Related Policies and Procedures