SPICE Information
The following is the UF HSC SPICE guide for information security on personally managed computers. For more information, please visit http://security.health.ufl.edu
Intro || Essentials || Anti-Virus || Email, HTML Pages, URLs || Spyware & Adware Data Backups || Internet || System Patches || Social Engineering
As a staff member, student or Resident at the UF HSC, you have responsibilities to protect confidential information. The stakes are higher and serious consequences apply.
These types of information are protected by Federal and State laws on privacy, and are classified by the UF HSC as Restricted. Whenever you have this information in your custody, you must protect it from accidental disclosure and you must not share it without authorization.
- Protected Health Information (PHI):: Health information combined with name, or med record #, or address, or key dates, or family members, or any other information that would link a person to their health condition
- Personal Identification Information:: Names combined with SSN, State ID #, Driver’s License #, Financial Account #’s, or any information that could be used to commit identity fraud
- Student Records:: Name or UF ID combined with grades, demographics, or any information shared by faculty and staff about students
Federal State and University penalties and sanctions apply to inappropriate uses and disclosures. Make sure you know how to use these information types legally.
Never store Restricted information on removable media such as thumb disks, memory sticks, or CD’s. They’re too easy to lose track of
- Never put Restricted information in email or in an instant message
- Never leave laptops or personal digital assistants (PDAs) unattended and unlocked, not even for a minute. They’re highly desirably and very easy to steal
- Use a strong password (minimum of 8 characters containing at least 1 letter, 1 number, 1 capital, 1 lower case, and 1 special character) on your computer so it cannot be easily guessed
- Ensure you have set an inactivity timeout on your computer so it automatically locks requiring a password to unlock
- Your computer activity and patient record accesses are tracked by HSC Information Systems. We know where you’ve been.
- Always wear your Gator 1 ID badge. It helps us determine when someone else is in a place they should not be.
- If you’re not sure about appropriate handling of Restricted information, ASK FOR HELP!
Anti-virus protection is needed to fend off viruses or worms that can cause your computer and software to fail and cause you to lose data. Your computer may have come with anti-virus software pre-loaded, but it may not stay current if you don’t pay a subscription fee. Anti-virus software that is not current is useless. UF has purchased McAfee Anti-Virus software for all faculty, staff, and enrolled students to use. Here’s what you can do to protect your computer from viruses at no additional cost to you:
- Download a copy of McAfee Anti-Virus software from http://www.software.ufl.edu/mcafee
- Follow all download and installation instructions carefully, even downloading VPN software which is safe
- Enable ‘AutoUpdate’ and schedule it for daily updates
- Enable ‘Scan All Fixed Disks’ and schedule for a scan at least weekly when you know the computer will be on
Note: If you are having trouble getting McAfee Anti-Virus software to work, and if you have another anti-virus product installed on your computer, the problem could be related to compatibility issues between the two products. Use the Add or Remove Programs feature in your Control Panel to remove the other product.
Email Attachments, HTML Pages, URLs
Opening attachments, displaying HTML pages and clicking on URLs sent to you in an email are the most common ways to contract viruses and worms.
- Delete email from unknown senders
- Call and verify if you receive an unexpected attachment, HTML page, or URL from someone you know before you open it
- Legitimate email can always be sent again
- Regardless of who sends it, do not open files that end in .exe, .bat, .vbs, .pif, or .com
- If it sounds too good to be true, it is
Spyware is software deposited on your computer that seeks to gather private information about you. There is a free and safe software utility called Spybot Search & Destroy that helps control spyware.
- Download Spybot S&D on your computer from http://www.safer-networking.org/en/download
- Use the advanced features of Spybot to enable Automatic Updates and Schedule Scans at least weekly to keep your include files and Spybot version up to date
Adware is software deposited on your computer that gathers information about what web sites you visit and your buying habits, and sends it to a company for marketing uses. It subsequently causes pop-up ads on your computer screen, which are annoying and somewhat invasive. There is a free and safe software utility called Ad-Aware SE Personal that helps control adware.
- Download Ad-Aware SE Personal on your computer from http://www.lavasoft.de/software/adaware
- Unfortunately, updates cannot be automated with the free version of Ad-Aware
- Check for and download ‘Definition’ files and program updates at least weekly and run an Ad-Aware system scan thereafter.
Backup your important files and folders regularly and consistently to protected file space that UF provides on network servers. We want you to be productive at the University of Florida. Don’t risk losing your data. Accidents WILL happen. Your hardware WILL eventually fail.
Safe web sites and trustworthy internet users are not apparent. Exercise these internet use cautions:
- Be judicious about picking legitimate web sites to visit; stick to those that are widely known businesses or institutions, and those that you have visited before without security issues
- Make sure the controls listed in this reference guide are in place on your computer
- Never offer up private information in email, instant messaging or on a web site that has been unexpectedly solicited from you
- Email and instant messaging are no place for Restricted information in any event
- Again, if it sounds too good to be true, it is
System patches are operating system software updates intended to fix bugs and weaknesses in the Windows operating system that have recently been discovered. It is easy to have them automatically installed on your computer so you don’t have to remember to do it yourself, and it is so important to the health of your computer.
- Go to this safe link to sign up: http://www.microsoft.com/microsoftupdates/
- Follow the download instructions carefully
- Set the updates to automatically check and install daily
Social engineering is best described as a con man who is trying to dupe you into doing something you wouldn’t ordinarily do. You might get official looking email asking you for your password or financial account number for “security” purposes. You might get an enticing email indicating you have won an extravagant vacation, telling you to click a URL and enter personal information to collect your prize. You might be downloading software and be prompted to accept the terms of a lengthy license agreement with language permitting the company to install spyware or adware on your computer with the software you want.
- Be wary of unsolicited offers and notifications asking for personal information. Never give up personal information on your computer due to an unsolicited email or notification
- If you think an unsolicited notification asking for personal information is legitimate, call the institution rather than conducting the exchange on your computer
- Be wary of license agreements that are discouraging to read, but contain language permitting the installation of spyware or adware programs on your computer. Of course it won’t be called spyware or adware in the license agreement.
- Finally, remember, if it sounds too good to be true, it is
Location: http://www.obgyn.ufl.edu/it/security.shtml