Each member of the University, including staff members, students, contractors and other third-parties, that are contractually engaged with the University are responsible for the security and protection of information resources over which he or she has control. He or she is obliged to adhere to the University’s information security policies, standards, guidelines, and procedures, and protect information resources from unauthorized intrusions, malicious misuse, or inadvertent compromise; and to preserve physical and logical integrity of these information resources.
The following bodies in the University are responsible for the governance of the Information Security in the University:
Download Information and IT Asset Inventory and Ownership Standard
An inventory list of important assets associated with information resources must be properly documented and maintained for record-keeping and auditing purposes.
The establishment of roles, responsibilities and accountabilities are needed for proper management and protection of the University’s information assets.
All information and IT assets obtained by the University, used for work-related purpose, or storing the University’s Information are subject to the University’s control. They can only be disposed in accordance with the requirement defined in Section “4) Information Classification and Handling” policy of this document.
Download Acceptable Usage Standard
The University values academic and intellectual freedom and encourages the use of the University’s information resources to support the University’s affairs and its mission of education, service, and research. Priority must be given to the use of the information resources for the official affairs of the University.
The University recognizes the trend and demand of “Bring Your Own Device” (BYOD). Regardless of the ownership, “Information resources” means all information and communications technology; hardware and software; data and associated methodologies; infrastructure and devices that are:
Information resources include but not limited to:
The use of information resources, including their handling and storage, must be legal and must be of the highest ethical standards, and must not involve with activities and/or material(s) unacceptable to the University’s environment which include, but not limited to acts of a malicious or nuisance nature, invasion of privacy, violation of copyright and licensing, harassment, bullying, hacking, altering the settings on any information resources without authorization, plagiarism, impersonation/identity theft, spoofing, or cheating in an examination.
Download Information Classification and Handling Standard
The University must classify all its information into appropriate levels (e.g. restricted, confidential, internal and public) to indicate the need, priority and degree of protection required.
The following classification levels shall be used for classifying the University’s information assets:
Every member of the University has responsibilities to consider security during the entire life cycle of information in the course of their works.
The University has defined retention periods for certain kinds of information. Each member of the University shall observe these requirements. Section “16.2) University Policies and Regulations” of this document listed some sources of the University’s Policies.
Each University Unit should establish procedures appropriate to the information held and processed by it, and ensure that all staff members and students are aware of those procedures.
Download Human Resource Security Standard
5.1. Prior to Employment / Engagement
The University’s staff members, students, contractors and third-party users must understand their responsibilities and must be suitable for the roles they are considered for in handling or use of information assets. The University must implement appropriate controls to reduce the risk of theft, fraud or misuse of the University’s information assets and resources.
5.2. During Employment / Engagement
The University’s staff members, students, contractors, and third-party users shall be aware of information security threats and concerns; and of their responsibilities and liabilities; and are expected to be properly equipped to support the University-level ISPS in the course of their normal work or studies, and to reduce the risk of human error.
5.3. Terminations or Change of Employment / Engagement
The University’s staff members, students, contractors, and third-party users shall exit or change employment / engagement relationship with the University in an orderly manner.
Download Physical Access Security Standard
The equipment, records, and data comprising IT operations represent a critical asset for the University and they must be protected adequately commensurate with their value, confidentiality, and criticality of the information or data stored or accessible and the identified risks. Physical access control over the University’s information resources must be implemented and should include the following implementation elements:
These apply to all information processing facilities and premises, including data centre, general offices and premises of contractors performing service for the University.
Download Environmental Security Standard
Environmental security is important for the University to ensure its investment is capable of meeting its performance and uptime objectives. The University’s premises should be protected physically against damage from fire, flood, wind, earthquake, explosion, civil unrest, theft, robbery, vandalism, and other forms of natural and man-made risk.
Environmental monitoring of the following conditions must be carried out for all critical business systems and are strongly recommended for all other hosts and server systems:
The relevant faculties, controllers or custodians are responsible for ensuring that these conditions are complied with.
Download Communications and Operating Management Standard
The University must ensure that the operational procedures for correct and secure handling of information resources are documented and made available to appropriate staff members and contractors. The level of detail should match the criticality of the information being processed and complexity of the operations concerned.
The University shall segregate the duties and areas of responsibility of staff members and contractors to reduce the risk of unauthorized or unintentional access, modification, or misuse of information assets. The level of segregation should match the confidentiality and security requirements of the information being processed.
Download Change Management Standard
The University must ensure changes to its information systems, telecommunication equipment, software, and other information resources will not result in adverse impact on the confidentiality, integrity, and availability of the University’s IT environment unless a written approval on exemption being granted was obtained from the Information Strategy and Governance Committee (ISGC). All changes must be documented, authorized and in line with the University’s operational and security requirements. In particular, the following items should be recorded:
The University should ensure that personnel responsible for change development and production migration are properly segregated. When duties cannot be separated, compensating controls should be implemented, for instance, a supervisory level employee should review the system regularly and/or after change.
The University should assign dedicated resources to monitor the change processes. Periodic system migration log checking of production systems should be performed by personnel with sufficient technical knowledge and independent from the change promotion teams responsible for the systems.
Download Network and Platform Security Standard
10.1. Network Segregation
The University shall properly protect all networks with appropriate security measures and appropriate equipment. Network addresses, network configurations and related systems or network information shall be properly maintained and shall only be released to authorized parties.
The University shall segregate the Campus Network into separated network environments according to the usage, classification of information and services hosted in the network:
The University shall manage and control the networks to maintain network security. Staff members, students, contractors and third-party users shall not connect unauthorized devices into the networks or by any means to lower the security levels of the University’s networks. Connections between networks must not compromise or downgrade the security of information processed in the networks.
The University shall document, monitor, and control wireless networks with connection to its network. Staff members, students, contractors and third-party users are prohibited from connecting unauthorized wired/wireless network devices and/or setting up peer-to-peer or ad-hoc wireless network with connection to the University’s networks, and sharing the University’s networks to uncontrolled devices.
Proper authentication and encryption security controls shall be employed to protect data communication over wired/wireless networks with connection to the University’s networks.
10.2. Internet and External Network Security
Centrally arranged Internet gateways are managed by Central IT. The University Units may arrange and manage their own Internet gateways according to University’s prevailing policy and regulation.
All gateways (including Internet gateways and gateways to External Networks between the University, partners of the University and/or the remote sites of the University) must be approved by and registered with Central IT, and all Internet access shall be channelled through registered gateways. All gateways must also conform to the “Network and Platform Security Standard” of the University.
All Inbound and outbound traffic to and from the University’s networks and systems must pass though the registered gateways.
“RESTRICTED”, “CONFIDENTIAL” and “INTERNAL” data must be encrypted when transmitted over an untrusted network, including the “Campus network” of the University.
In circumstances where it is not feasible to fulfil the standards or the network is designed to meet special purposes (e.g. research in network security, setup of honeypot, etc.), the department shall isolate the network from the other networks of the University. The owner shall register the network with Central IT; shall implement appropriate security control and must not connect this network to the other systems of the University.
10.3. Application, Service and Platform Security
The owners, controllers or custodians of Information Systems must ensure that their Information Systems are protected from threats and must implement the following:
Download Logical Access Control Security Standard
Access control to critical, important information assets based on functional and security requirements of the University is essential to safeguard the confidentiality, integrity, and availability of information assets within the University.
11.1. Access Control Policy
The University must implement the following:
University Units shall regularly review access privileges to services and data granted to roles and users; to ensure the appropriateness of privileges possessed by the relevant roles and individuals.
11.2. Password and Screen Lockout Policy
All accounts of the University’s information systems must be password protected to help maintain the confidentiality, integrity, and availability of the University’s data as well as to help protect the University’s information resources.
Each member of the University’s campus community is responsible for ensuring that strong passwords are used, and the passwords are maintained according to the University’s password standard. This is to reduce overall risks to the University by helping authorized users reasonably avoid security and privacy risks that result from weak password choices.
The University shall also enforce screen lockout policy on user desktops of all staff members and students, except desktops designated or special purpose, e.g. monitoring console for network performance, tutor’s terminal in teaching studio.
Download Information System Acquisition Development and Maintenance Standard
The University must ensure that information security is considered throughout the lifecycle of any system that holds and processes the University’s information assets, from conception and design, through creation and maintenance, to ultimate disposal. This policy outlines the basic requirements and responsibilities to achieve this.
12.1. Security Requirement of Information Systems
Any department with requirements for IT systems must discuss them with Central IT at the project initiation stage.
Business requirement documentation for new systems or enhancements to existing systems must contain the requirements for security controls. Security vulnerabilities must be recognized from the outset through undertaking a risk assessment and the security requirements must be developed alongside the functional requirements.
Appropriate controls and audit trails must be designed into applications to prevent error, loss and unauthorized modification or misuse of information in application systems.
Application systems must implement input validation to ensure that data input is properly encoded and sanitized (i.e. filter all unaccepted and unsupported input, reject insertion and injection of codes, commands and instructions, eliminate buffer overflow and divided by zero, prevent path transversal, etc.). Input validation must be mandatory at server-side and client-side as appropriate.
12.2. Security in Development and Implementation
The University must ensure an IT system is comprehensively tested for all its functional and security features prior to the implementation in the production environment.
Any of the University’s data that is used during the development and test phase of preparing application software must be protected and controlled.
Security controls must be applied to the implementation of IT systems in the production environment.
Application must be tested for an extensive period against predetermined criteria and methodologies by personnel not directly involved in the development of the system.
Testing results must be documented and retained. Testing results must be accepted and approved by system owner before the application rollouts.
Download Supplier Management Standard
The University must ensure that purchase of equipment, supplies, products, services, and maintenance is conducted in a manner that is consistent with the University’s ISPS. Information systems and services used to store or process the University’s sensitive information will have significant impact on security of the University’s environment. The corresponding vendors should implement appropriate measures to meet the objectives below:
The University should assign dedicated resources to review the Service Level Agreements (“SLA”) of its vendors to confirm that they have satisfied obligations described above. Periodic monitoring of vendor service levels and performance should be performed by relevant University Units to ensure that any breaches of SLAs will be timely reported and investigated by the University’s Information Security Unit (“ISU”).
Non-disclosure Agreements (“NDA”) should be established between the University and vendors if sensitive information related to the University, its staff members, students, sub-contractors and/or other third parties is used, stored, and processed by the vendors.
The University management must evaluate existing vendors’ compliance and performance results based on the regular monitoring feedback at least annually or before the renewal of service contracts, whichever is earlier.
Download Information Security Incident Management Standard
As a key part of any organization’s overall information security strategy, it is essential to have in place a structured well planned information security incident management approach.
14.1. Responsibility
Information Security Unit (“ISU”) will manage all information security incidents with the assistance from all parties within the University, this include but not limited to the deans, department heads and the departmental IT support units.
An Information Security Incident Response Team (“ISIRT”) shall be established and led by ISU to provide the University with appropriate personnel for assessing, responding to, and learning from information security incidents, and providing the necessary co-ordination, management, feedback, and communication.
All staff members and students of the University have responsibilities to report any security incidents to CSC Help Desk or ISIRT.
Security incidents include but not limited to:
14.2. Information Security Incident Reporting and Response Procedure
The University’s staff members, students, contractors, and third-party users who come across any evidence of information being compromised or who detects any suspicious activity that could potentially expose, corrupt, or destroy information must report such information to his or her immediate supervisor, to CSC Help Desk or ISIRT. “Critical” or “Significant” security incidents should not be investigated by individuals without the authorization of the ISU.
An Information Security Incident Reporting Procedure must be defined to handle information security incidents. The procedure will include the following:
14.3. Post Information Security Incident Review Procedures
After information security incidents have been resolved or closed, the following review activities are necessary:
14.4. Information Security Awareness Training
Heads and supervisors of the University Units should ensure that appropriate information security awareness training is regularly conducted for their staff members and students of the University.
The training programs should:
Download Business Continuity Management Standard
Business Continuity Plans (“BCP”) and Disaster Recovery Plans are required to maintain the operations of the University in the event of an incident or a disaster.
Each University Unit must develop plans that will allow it to perform its core required operations in an alternative fashion as well as an appropriate disaster recovery policy and plans for their working environment.
Each information system of the University must have periodic backups of data, facilities for continuing critical operations available in case of an emergency, and disaster recovery plans in place. While the development of a BCP is a general business issue with the IT component as a part of the overall plan, having a BCP is a significant element in providing the “availability” component of the University’s Information Security.
An effective business continuity management must include the following:
Download Compliance Management Standard
16.1. Legal and Regulatory Compliance
The University shall comply with laws regarding information security requirements. Dedicate resources (e.g. legal professionals, compliance staff or advisor) should be assigned or engaged by the University Units to monitor latest statutory and regulatory requirements that the University has to comply with. A formal management plan for each regulation should be developed and executed.
Currently, the University shall comply with all applicable laws, in particular with the following laws:
16.2. University Policies and Regulations
The University has a set of internal policies and regulations which its staff members, students, contractors, and third-party users must observe and comply with. The University must inform these parties about the policies and regulations and these parties shall get themselves familiar with the policies and regulations.
16.2.1. All Staff members, Students, Contractors and Third-Party Users
All members of the University must comply with the following policies and guidelines of the University:
16.2.2. All Students
All students of the University must comply with this set of ISPS and the following University’s policies and guidelines:
A comprehensive list of important policies and guidelines, which all students shall comply with, are maintained by the Academic Regulations and Records Office and available through the hyperlink below:
16.2.3. All Staff
All staff of the university must comply with this set of ISPS and the following University policies and guidelines:
A comprehensive list of important policies and guidelines, which all staff members shall comply with, are maintained by the Human Resource Department and accessible through the hyperlink below:
16.3. Other Contractual Compliance
Contractual requirements that were established with a third party shall provide assurances that the contracting third party will appropriately safeguard information in accordance with laws, regulations, and the University’s policies. When providing access to or passing confidential information to a third-party agent of the University, the written contractual agreements should include terms and conditions that:
Consideration should be given to limiting outside vendor access to sensitive information resources.
Download Information Security Internal Assessment Standard
Internal Audit Office of the University conducts Independent Internal Audits in the University. The roles and responsibilities of Internal Audit Office are defined by the Audit Charter of the University.
The University must ensure that all information systems and applications, which are critical to the University’s operations and financial reporting, or contain sensitive information of the University, and its related infrastructure, shall be evaluated as an ongoing process to improve the quality of its operations. This policy shall apply to all the Units of the University.
Periodic information system internal assessment should be performed to identify deficiency and improvement opportunities within the existing security framework of the University. These assessments will assess the University’s ability to mitigate identified information security risks from people, process, and technology perspectives. These assessments will be performed by qualified individuals who understand the University’s information security environment.
When requested and for the purpose of performing internal assessments, any access needed shall be provided to members of internal assessment team. These accesses may include but not limited to:
Management response regarding the remedial actions of the identified issues and opportunities for improvement must be obtained.
Download Password Management and Multi-Factor Authentication Policy (Internal, CityUHK login required)
The objective of this policy is to establish a standard for the creation of passwords with sufficient strength, the protection of those passwords, and the frequency of change. In addition to password management requirements, use of multi-factors authentication to uplift overall security level is required.
Download Cloud Security Standard (For Central IT) (Internal, CityUHK login required)
The purpose of this document is to establish a security standard for adopting cloud services and to outline the fundamental security control requirements in a cloud environment.
This standard applies to all cloud applications and cloud service adoptions at the University, including projects utilizing private or public clouds and any combination of Infrastructure-as-aservice, Platform-as-a-Service, and Software-as-a-Service cloud service models.
Download Cloud Security Standard (For Departments) (Internal, CityUHK login required)
The purpose of this document is to establish a security standard for adopting cloud services and to outline the fundamental security control requirements in a cloud environment.
This standard applies to all cloud applications and cloud service adoptions at the University, including projects utilizing private or public clouds and any combination of Infrastructure-as-aservice, Platform-as-a-Service, and Software-as-a-Service cloud service models.
Download Vulnerability Management Standard (Internal, CityUHK login required)
The purpose of this document is to establish a security standard for managing technical vulnerability found in campus network environment. This standard is based on National Institute of Standards and Technology (NIST) 800-53, specifically the Risk Assessment (RA-5) Vulnerability Scanning section. It provides a framework for performing vulnerability scans and corrective actions to protect the Campus Network.
This Standard applies to University Technology Resources connected to the Campus Network. It does not apply to content found in email or digital documents.
IT.ServiceDesk@cityu.edu.hk
