This guideline serves as a supplement to the Information Resources Use and Security Policy, which was drafted in response to Texas Administrative Code 202 and UT System UTS-165. Adherence to these guidelines will better assure the confidentiality and integrity of the university's sensitive data should data encryption be used as an information protection control.

 

The objective of these guidelines is to provide guidance in understanding encryption and the encryption key management required for maintaining the confidentiality and integrity of the university's sensitive data, should data encryption be used as an information protection control.

These guidelines apply to all devices, physical or virtual where university data is classified as Confidential, Controlled, or Published (see Data Classification Standard).

 

4.1.1. Transmission: In order to protect the confidentiality and integrity of the university's sensitive data; any data classified as Confidential data, and having a required need for confidentiality and/or integrity, shall be transmitted via encrypted communication to ensure that is does not traverse the network in clear text. It is further recommended, but not required, that data classified as Controlled be transmitted via encrypted communications when possible. See the university Data Classification Standard for further clarification on the classification of university data. Applications of encryption for data transmission include, but are not limited to, those identified in APPENDIX-A.

 

4.1.2. Storage: In order to protect the confidentiality and integrity of the university's sensitive data; any data classified as Confidential data, and having a required need for confidentiality and/or integrity, shall be stored encrypted in systems and/or databases and/or portable media. Controlled or Published data classifications do not require such encrypted storage. See the university Data Classification Guidelines for further clarification on data classification. Applications of encryption for data storage include, but are not limited to, those identified in APPENDIX-B.

 

4.1.3. A combination of business practices and technology can act as mitigating factors and could significantly reduce the risk of unauthorized data exposure, thereby offsetting the specific need to implement data encryption. Examples of such mitigating factors include, but are not limited to, those identified in APPENDIX-C.

 

 

4.2.1. The symmetric algorithms referenced in APPENDIX-D shall be used for encrypting Confidential information.

 

4.2.2. The algorithms referenced in APPENDIX-E shall be used for public key asymmetric encryption of Confidential information.

 

4.2.3. The encryption services referenced in APPENDIX-F shall be used for digital signature purposes when Confidential information is involved.

 

4.2.4. Digital signatures shall be used to associate a user or entity with a respective public key.

 

4.2.5. Digital certificates shall apply recognized standards (e.g., X.509v3) and shall at least:

 

 

 

4.3.1. Encryption keys used to protect Confidential data shall also be considered Confidential data.

 

4.3.2. Professional key management is critical to prevent unauthorized disclosure of Confidential data or irretrievable loss of important data. A centralized campus key management infrastructure shall be made available to all university users to ensure appropriate controls are applied. The university data managed by all key management infrastructures shall be considered both Confidential and mission critical.

 

4.3.3. All university key management infrastructures shall create and implement an encryption key management plan to address the requirements of these encryption guidelines, other university and UT-System regulations, and applicable State and Federal law. UT-Austin Internal Audit shall approve such plans.

 

4.3.4. All symmetric encryption keys used on systems associated with Confidential data shall be randomly generated according to industry standards. Acceptable standards include, but are not limited to, those referenced in APPENDIX-G.

 

4.3.5. Where symmetric encryption is used to protect Confidential data:

 

4.3.6. When asymmetric encryption is used, the operational period of asymmetric keys associated with a public key certificate are defined by the encryption key management plan of the issuing certificate authority.

 

4.3.7. Encryption keys shall be stored within an encrypted key store or an otherwise encrypted form using approved algorithms; or the keys may be stored on a security token (e.g., a smart card). The encryption keys shall never leave the device if stored on a security token.

4.3.8. Encryption keys are confidential information, and access shall be strictly limited to those who have a need-to-know. The owner(s) of data protected via encryption services shall explicitly assign responsibility for the encryption key management that should be used to protect this data. If keys are transmitted over communication lines, they shall be sent in encrypted form. The exchange of keys should employ encryption using a stronger algorithm than is used to encrypt data protected by the keys.

 

4.3.9. Encryption keys that are compromised (e.g., lost or stolen) shall be reported immediately to the Information Security Office (security@utexas.edu), the key manager, and the information owner of the data being protected. The key shall be revoked or destroyed and a new key generated. Key re-assignments shall require re-encryption of the data.

 

 

4.4.1. Encryption keys that are generated by a university production certificate authority (CA) and used to control access to the CA server or used by the CA to perform functions shall be stored on Hardware Security Modules (HSM).

 

4.4.2. All HSMs used within the university shall adhere to recognized standards (e.g., FIPS 140-3).

 

4.4.3. University CAs must be designed such that all CA administrator functions are accounted for in detail. Ideally, no single administrator shall obtain full access to the CA encryption keys (e.g., separation of duties, dual control, etc.)

 

4.4.4. University CAs within the university must adhere to a respective encryption key management plan and create a documented Certificate Practice Statement (CPS).

 

 

The encryption systems used by the university must comply with applicable laws and regulations. Any export or import of encryption products (e.g., source code, software, or technology) must comply with the applicable laws and regulations of the countries involved, including those countries represented by foreign nationals affiliated with the university. The United States Department of Commerce provides additional guidance specific to such encryption export controls, http://www.bis.doc.gov/encryption/.

 

5.1.1. Development and maintenance of the university Data Encryption Guidelines.

 

5.1.2. Assess the secure installation and maintenance of all equipment supporting encryption controls at the university.

 

5.1.3. Assess the performance and security monitoring for all elements of the encryption control processes.

 

5.1.4. Assess all related key management processes.

 

5.1.5. The Information Security Office, acting on behalf of the university, reserves the right to refuse any encryption request that may compromise the security of the university's networks or sensitive data.

 

 

5.2.1. Adherence to the university Data Encryption Guidelines and related policies established by the university.

 

5.2.2. Ensure secure installation and maintenance of all respective equipment supporting encryption controls.

 

5.2.3. Ensure performance and security monitoring for all respective elements of the encryption control process.

 

5.2.4. Ensure all related key management processes can be accounted for in detail and, if possible, that no single key management supporting staff member can individually obtain full access to master keys or CA encryption keys (e.g., separation of duties, dual control, etc).

 

5.2.5. Undergo a background check and complete the Acceptable Use Policy Acknowledgement form.

 

 

5.3.1. All users shall adhere to the university's Data Encryption Guidelines and related policies established by the university.

 

5.3.2. All users shall be familiar with the university's Minimum Security Standards for Data Stewardship.

 

5.3.3. All users shall acknowledge a key escrow agreement, which will identify the required escrow of the subscriber's private key. This requirement will be established for the benefit of the user, the university, and to comply with state and federal law.

 

5.3.4. All users must manage the storage and transmission of data files in a manner which safeguards and protects the confidentiality, integrity, and availability of such files.

 

5.3.5. Questions about the classification of a specific piece of data should be addressed to the local supervisor or respective IT Owner. Questions about these guidelines should be addressed to the Information Security Office.