Re: research data security

[Doug Markiewicz <dmarkiew+educause () ANDREW CMU EDU>]

We've made some inroads on this front.  We were recently involved in a
research project where export control was a concern.  Through our
relationships with that IT staff in that college and with our Office of
Sponsored Programs, we were able to incorporate our data protection
framework into the technology control plan for that project.  It was a
success story both from the standpoint that it was one of the first
applications of our relatively new framework in a research area and from the
standpoint that an IT group that has historically operated independently was
interested in partnering with us.  With that being said, we've not conducted
an assessment to see how effectively they've implemented their controls, but
it's a start.  I think over the long haul, our relationship with the Office
of Sponsored Programs will be important since they probably carry more
weight than we do in the research arena.

Related to whether research should have a separate "protocol" for
safeguarding data, our strategy is to build a single "protocol" that works
for enterprise and research data.  I think one of the bigger challenges
we've seen is laying out roles and responsibilities so that they work
effectively in both areas.  The data steward/custodian roles and
responsibilities we've developed work fine in business units but start to
break down in colleges and amongst faculty.  Over time, we will hopefully
get that sorted out though.

Cheers!

Doug


> -----Original Message-----
> From: The EDUCAUSE Security Constituent Group Listserv
> [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Steve Brukbacher
> Sent: Thursday, February 18, 2010 11:30 AM
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: [SECURITY] research data security
>
> Hi,
> I'm trying to get my arms around our research data security situation at
> our institution.  I'm fairly convinced we need a separate "protocol" for
>   research data security, just like we all have an IRB requirement,
> requirements for animal care, etc.
>
> I know some will reply that this should "happen" in the IRB process, but
> unfortunately, a lot of data security detail is beyond the scope of what
> an IRB is tasked with doing.
>
> So my question is, does anyone feel like they have a success story to
> share in ensuring that researchers using data with high confidentiality
> requirements meet some sort of security standards?
>
>
> --
> Steve Brukbacher, CISSP
> University of Wisconsin Milwaukee
> Information Security Architect
> UWM Computer Security Web Site
> www.security.uwm.edu
> Phone: 414.229.2224