Tasks for Medium Risk Data

Now that you know your risk level, it's time to implement appropriate tasks to protect your data. Work with your departmental IT support resource or IS&T to undertake reasonable steps to complete these tasks. If implementing a particular task prevents you from completing your work, contact security@mit.edu—it may be acceptable to mitigate the risk using other methods. Some of the tasks might not be applicable to your situation. You may filter the list to show tasks applicable to your role – User, Data Owner, or System Administrator. If you are handling regulated information or have signed a data use agreement there may be some tasks that are absolutely required.

Your current IT support may already have many of these tasks implemented as part of their service. You can also contact the Service Desk for assistance with securing information.

Access Control

Task Applies to Service or Tool
Information is accessible only for authorized purposes and shared only with those authorized to receive it.
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Media

Any portable data storage method such as paper hard copies, external USB hard drives, CDs/DVDs, etc.

,
Server

A host that provides a network accessible service.

Encryption, Touchstone Authentication Learn how
Use separate accounts for user and administrative permissions.
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Server

A host that provides a network accessible service.

Learn how
Enable your operating system's firewall.
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Server

A host that provides a network accessible service.

Learn how
Enable a screen lock that requires a password to unlock after 15 minutes of inactivity.
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

Learn how

Configuration and Vulnerability Management

Task Applies to Service or Tool
Use vendor supported applications and operating systems.
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Server

A host that provides a network accessible service.

Software Patches and OS Updates Learn how
Configure automatic download and application of software and operating system updates.
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Server

A host that provides a network accessible service.

Software Patches and OS Updates Learn how

Data Minimization and Retention

Task Applies to Service or Tool
Anonymize information whenever possible and separate access to identified and de-identified data sets. For physical media store identified information in a separate locked file cabinet.
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Media

Any portable data storage method such as paper hard copies, external USB hard drives, CDs/DVDs, etc.

,
Server

A host that provides a network accessible service.

Learn how
Observe applicable data retention policies upon project completion. Securely delete the information if possible. If you must retain a copy of information at this level, ensure that it remains secure.
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Media

Any portable data storage method such as paper hard copies, external USB hard drives, CDs/DVDs, etc.

,
Server

A host that provides a network accessible service.

Learn how
Destroy devices and media that are no longer needed in a way such that no information can be recovered.
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Media

Any portable data storage method such as paper hard copies, external USB hard drives, CDs/DVDs, etc.

,
Server

A host that provides a network accessible service.

Learn how

Governance

Task Applies to Service or Tool
Promptly report actual or suspected compromise, including loss, theft, improper use, modification of, or access to information to security@mit.edu.
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Media

Any portable data storage method such as paper hard copies, external USB hard drives, CDs/DVDs, etc.

,
Server

A host that provides a network accessible service.

Learn how
If you are developing (or contracting a vendor to develop) applications processing this level of information, include security as a design requirement.
Application

Software running on a server that is remotely accessible, including mobile applications.

Learn how
If you are developing (or contracting a vendor to develop) applications processing this level of information, review code and correct flaws prior to deployment.
Application

Software running on a server that is remotely accessible, including mobile applications.

Learn how

Identification and Authentication

Task Applies to Service or Tool
Create a unique, non-privileged, account for each user. Assign a different password for user and administrative accounts.
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Server

A host that provides a network accessible service.

Learn how
Use strong passwords. Change authentication keys e.g., password, certificate, regularly - at least annually.
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Server

A host that provides a network accessible service.

,
Application

Software running on a server that is remotely accessible, including mobile applications.

LastPass Enterprise, Passwords Learn how
Do not reuse passwords for multiple services. Do not use your Kerberos password for non-Kerberos enabled systems.
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Server

A host that provides a network accessible service.

LastPass Enterprise, Passwords Learn how
Change passwords immediately if a compromise is suspected.
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Server

A host that provides a network accessible service.

Passwords Learn how
Enable password protection at startup.
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

Learn how
Store and transmit only encrypted passwords.
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Server

A host that provides a network accessible service.

,
Media

Any portable data storage method such as paper hard copies, external USB hard drives, CDs/DVDs, etc.

,
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

Encryption, Passwords Learn how
Change default or vendor-supplied passwords and remove default accounts.
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Server

A host that provides a network accessible service.

,
Application

Software running on a server that is remotely accessible, including mobile applications.

Passwords Learn how
Utilize multi-factor authentication for remote access.
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

Duo Security Learn how
Utilize multi-factor authentication for remote interactive user and administrator logins
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Server

A host that provides a network accessible service.

Duo Security Learn how

Physical Security

Task Applies to Service or Tool
Lock hard copy information records in a file cabinet within a locked office.
Media

Any portable data storage method such as paper hard copies, external USB hard drives, CDs/DVDs, etc.

Learn how
Fax records to a non-public fax machine only if arrangements have been made so that the intended recipient will take the copies off the machine immediately upon receipt.
Media

Any portable data storage method such as paper hard copies, external USB hard drives, CDs/DVDs, etc.

Learn how
Remove information on copiers, fax machines, or other shared devices promptly.
Media

Any portable data storage method such as paper hard copies, external USB hard drives, CDs/DVDs, etc.

Learn how
Use appropriately secure means when transferring physical media containing information. Track transfers to confirm that they reached the intended recipient.
Media

Any portable data storage method such as paper hard copies, external USB hard drives, CDs/DVDs, etc.

Learn how

Protective Technology

Task Applies to Service or Tool
Install malware protection applications, if available for the platform.
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Server

A host that provides a network accessible service.

CrowdStrike, Sophos Anti-Virus, Virus Detection and Prevention Learn how
Set up and perform regular backups.
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Server

A host that provides a network accessible service.

CrashPlan, TSM (Tivoli Storage Manager) Learn how
Backup solution encrypts information in transit and at rest.
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Server

A host that provides a network accessible service.

CrashPlan, TSM (Tivoli Storage Manager), Backup, Encryption Learn how
Enable whole disk encryption on portable devices.
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

BitLocker (Windows), FileVault (Mac) Learn how
Information at this level is transmitted over an encrypted connection.
Application

Software running on a server that is remotely accessible, including mobile applications.

,
Endpoint

A computer device such as a desktop workstation, mobile phone, tablet, or laptop.

,
Server

A host that provides a network accessible service.

Learn how
CSV