Cloud Server Technical Control Requirements Policy

Version 1.4

For Students, Faculty, Staff, Guests, Alumni

Purpose

The purpose of this policy is to inform the University community of the technical security control requirements for Internet-exposed cloud servers owned and managed by the University, which meet specific criteria enumerated below.

Scope

This IT policy, and all policies referenced herein, shall apply to all members of the University community, including faculty, students, administrators, staff, alumni, authorized guests, delegates, and independent contractors (the “User(s)” or “you”) who use, access, or otherwise employ, locally or remotely, the University’s IT Resources, whether individually controlled, shared, stand-alone, or networked.

Policy Statement

• Security controls may be in the form of an Intrusion Prevention System (IPS), Web Application Firewall (WAF), and Security Management Tools (SMT) for all Internet-exposed cloud servers regardless of the service provider (e.g., Microsoft™ Azure, Amazon™ AWS) if the business partner requires one or more of the elements listed below.
  • As technology changes, these security controls may change, or other methods may be implemented. 
• There will likely be costs associated with the implementation of security controls.
  • IT and business partners must be aware of these potential costs and adjust their budgets.
  • IT and business partners must accept the cost associated with the selected level of service.
• The control requirements and risk evaluations involving the Office of Information Technology’s Information Security and Assurance, DevOps - Platform Services, DevOps - Application Services, or Educational Technologies, and the business partners are outlined in the table below:

*Fordham Sensitive Data is the default data classification and should be assumed when there is no information indicating the data should be classified as protected or public. See the Data Classification Guidelines.

Definitions

Fordham Protected Data is any data that contains personally identifiable information concerning any individual, as well as any data that contains personally identifiable information that is regulated by local, state, or federal privacy regulations, and any data designated or described by any voluntary industry standards or best practices concerning the protection of personally identifiable information that Fordham chooses to follow. See the Data Classification Guidelines.

Fordham Sensitive Data is based on departmental/internal standard operating procedures (e.g., budgets, payroll, or properties that Fordham may be interested in purchasing). See the Data Classification Guidelines. 

High Availability refers to systems that are durable and likely to operate continuously without failure. The term implies that parts of a system have been thoroughly tested and, in many cases, that there are accommodations for failure in the form of redundant components.

Intrusion Prevention System (IPS) is a form of access control. Its intent is not only to detect a network attack but also to prevent it. It neither requires nor involves human intervention to respond to a system attack.

IT Resources include computing, networking, communications, applications, telecommunications systems, infrastructure, hardware, software, data, databases, personnel, procedures, physical facilities, cloud-based vendors, Software as a Service (SaaS) vendors, and any related materials and services.

Operational risk summarizes the uncertainties and hazards Fordham University faces when it attempts to do its day-to-day business activities.

Reputational Risk refers to the potential for negative publicity, public perception, or uncontrollable events that may damage Fordham University’s reputation, and thereby may affect its revenue, accreditation, current enrollment, or future enrollment.

Security Management Tool (SMT) is a tool provided by the cloud platform that analyzes, assesses the security of the cloud service continuously, and offers immediate feedback on potential security risks. These tools are cloud-specific (e.g., Azure Security Center for Microsoft Azure, Inspector for Amazon Web Services).

Web Application Firewall (WAF) is a system or service that filters, monitors, and blocks HTTP traffic to and from a website to protect it from attack.

Related Policies and Procedures

• Acceptable Use of IT Infrastructure and Resources Policy
• Data Classification Guidelines
• Firewall/Network Access Control Policy
• Multi-Factor Authentication Policy