Printable Version (HTML)

Table of Contents

• Reason for Policy
• Statement of Policy
• Compliance
• Who Should Know This Policy
• Related Documents
• Contacts
• Definitions
• History and Update

Reason for Policy

Controlled access to IT Resources is essential for Purdue University to continue its mission of learning, discovery, and engagement. This policy describes a comprehensive approach to Authentication and Authorization that can support current needs for electronic access and accommodate future services and technologies by employing standardized mechanisms for Identification, Authentication, and Authorization.

This policy is guided by the following objectives:

1. To ensure that Purdue can, without limitation, operate and maintain its IT Resources;
2. To ensure that Purdue can, without limitation, protect the security and functionality of University IT Resources and the data stored on those resources;
3. To protect the University's other property, rights, and resources;
4. To preserve the integrity and reputation of the University;
5. To safeguard the privacy, property, rights, and data of users of University IT Resources;
6. To comply with applicable existing federal, state, and local laws; and
7. To comply with existing University policies, standards, guidelines, and procedures.

Statement of Policy

Access Control. Identification, Authentication, and Authorization are controls that facilitate access to and protect University IT Resources and data. Access to non-public IT Resources will be achieved by unique User Credentials and will require Authentication.

Purdue University will assign a Purdue University Identifier (PUID) and User Credentials for Identification and Authentication purposes to each individual that has a business, research, or educational need to access University IT Resources.

Authorization for University IT Resources depends on the individual's relationship, or relationships, to the University and the requirements associated with that relationship. In all cases, only the minimum privileges necessary to complete required tasks are assigned to that individual. Privileges assigned to each individual will be reviewed on a periodic basis and modified or revoked upon a change in status with the University.

No Unencrypted Authentication. Unencrypted Authentication and Authorization mechanisms are only as secure as the network they use. Traffic across the network may be surreptitiously monitored, rendering these Authentication and Authorization mechanisms vulnerable to compromise. Therefore, all University IT Resources must use only encrypted Authentication and Authorization mechanisms unless otherwise authorized by the director of the Identity and Access Management Office.

Compliance

Users of University IT Resources must comply with this policy and related standards and expiry periods issued by the University in support of this policy.

Centralized and departmental IT units and IT Resource owners are responsible for ensuring appropriate enforcement of this policy and related standards on University IT Resources within their areas of responsibility. The formal Security Policy/Procedure Exception Form must be filed and approved by the director of the Identity and Access Management Office for any University IT Resource that is unable to comply with these policy requirements.

Violations of this policy or any other University policy or regulation may result in the revocation or limitation of IT Resource privileges as well as other disciplinary actions, or may be referred to appropriate external authorities.

Who Should Know This Policy

This policy covers students, faculty, staff, and all individuals or entities using any University IT Resources and all uses of such IT Resources.

Related Documents

University IT Policies are available at:
www.purdue.edu/policies/pages/information_technology/info_tech.html

Standards supporting the implementation of this and other University IT Policies are available at:
www.purdue.edu/securepurdue/bestPractices/

Request for Security Policy/Procedures Exception is available at:
www.purdue.edu/securepurdue/bestPractices/deviationProcedure.cfm

Contacts

For questions regarding this policy, contact:
Director, Identity and Access Management Office
iamo@purdue.edu

Definitions

History and Update

June 16, 2009 — Updated URL in Related Documents section.