Information security

Information security

The University is committed to ensuring its’ information is always managed securely and in accordance with the best practice requirements of the NSW Standard on records management. The standard requires that the University’s records are protected from unauthorised or unlawful access, destruction, loss, deletion or alteration.

The University’s Data Classification Standard provides the framework for the protection of University information based on its’ sensitivity as defined by type, importance and usage. This framework is further informed by both the Record Security Guideline and the Data Handling Guidelines.

RAMS data classification

When capturing records to the University’s recordkeeping system RAMS, the information being captured can be mapped to one of the UNSW Data classification levels: Unclassified, Private, Sensitive and Highly Sensitive; to define its sensitivity and to enable controls appropriate to the level of sensitivity to be put in place.

These controls are applied in RAMS through the use of Access Control, an opt-in method of specifying access rights to electronic records captured within the system. Access Control is based on organisational units or pre-defined Access Groups, and provides the primary means by which to control access to University records in RAMS.

This process of data classification should be an inherent part of the capture of records, whenever creating a new records container, or when records of a higher sensitivity are to be captured to a container, or evidence of a new business activity is required to be captured.

Record classification

This table maps the University’s Data classifications against the required controls in RAMS, whether transmission of this information by email is appropriate and how frequently the security controls of this information should be reviewed. More information on these Data Classifications is available here.

Personal information

Passwords

It is not permitted to capture records containing passwords to RAMS. RAMS must not be used for the capture and storage of passwords.

In line with UNSW’s Cyber Security guidelines on Identity and Access Management, passwords must never be stored in clear text. Please refer to the Cyber Security Guideline – Identity and Access Management which establishes the minimum standards related to user account management, including passphrase management.

In particular, section 3.3.3. Account passphrases must not be stored in clear text, displayed on the screen in clear text, printed in clear text, or transmitted in clear text. [Risk: Medium, High. Role: IO].

For advice on best practice management of passwords, please contact Cyber Security.

Personal information

Personal information is defined as, “Information or an opinion about an individual whose identity is apparent or can be reasonably be ascertained from the information or opinion”.

Special consideration needs to be given to the management of personal information contained in records being captured and managed using the University’s business systems. This information will frequently be classified as Sensitive, sometimes Highly Sensitive, and should always be destroyed as soon as it is appropriate to do so. Capture and correct classification within RAMS ensures this is managed at a system level.

Legacy RAMS Security Controls

Security Levels

Security Levels provided the primary method for restricting access to hardcopy University records. Any document has an inherent level of security based on its content. Any container would inherit the security level of its most restricted content, as would all other records within the same container.

To view records of a certain security level, a staff member is required to have the same, or a higher level of security applied to their profile.

Security Caveats

Security Caveats provided a secondary means for the restriction of hardcopy records. The Security Caveats that may be applied to hardcopy records can be seen below. They enable a container to be restricted to a specific subset of staff based on role, such as limiting access to Human Resources (HR) records to HR staff only.

Their primary use at UNSW is for the control of access to hardcopy legal, personnel and student records.

A security caveat may be applied with a Security Level, and a user seeking access to the record would be required to meet both sets of criteria (Security Level, Security Caveat) to locate and to view the container.

All staff members receive automated access to relevant Security Levels and Caveats based on their position. Any staff member wishing to confirm their access may contact records@unsw.edu.au for further information.