Vice President - Administrative Services

• Skip to Main Content
• Administrative Procedures Handbook
• Board of Trustees Regulations
• Civil Service Handbook
• Faculty Policy Manual
• Official University Policy Manual

Official University Policy Manual

File code: TECH.DATAWAREHOUSE.POL
Approval Date: 4/29/2009
Approved By: President

Database, Data Mart, Data Warehouse Policy

• There should be only one authoritative source for electronic university records. Because of the strength of RACF security and the technology available on the mainframe to support encryption at rest, it is recommended that the one authoritative source be the Mainframe.
• Proper use of sensitive data begins by evaluating your business processes for the need to take in or store sensitive data and if indeed it is needed ensure that appropriate protection (obfuscation, masking, one-way hash, encryption, etc.) is applied throughout the data lifecycle. Sensitive data must never exist on University systems unprotected.
• The requirement to protect sensitive data extends to backup copies of sensitive data especially when this data is outside University control such as with a vendor, in transit or stored off University property.
• Direct access to data from the Internet must be disallowed. Instead requests for data should be proxied between a requesting segment and a segment hosting the data.
• Don’t use default database administrative accounts, such as SA in Microsoft SQL, to access data.
• It is recommended that the default communication port be changed to limit communication between application and data source to approved parties or IP addresses.
• It is recommended that communication between requesting server or application and data source be encrypted.
• It is recommended whenever possible to separate duties between database administrators, application developers, web administrators, etc.
• Database management should be done over secure channels such as SSL or SSH.
• When developing and configuring applications, do not connect to a database as a user with superuser-like authority or as the database owner. Instead, make use of customized users with appropriate limited privileges.
• Some Database Management Systems grant, by default, a number of "public" privileges to each user. It is better to revoke these privileges when possible and grant them as needed.
• Do not grant unnecessary privileges to users and review regularly for continued appropriateness.
• Data accuracy and consistency is important; a unified approach to data governance is highly recommended.
• Every program or every collection of programs implementing a single business function must have unique database credentials.
• Any passwords stored within the database must be encrypted or hashed with an appropriate algorithm.
• It is recommended that developer groups have a process in place to ensure that database passwords are created, controlled and changed in accordance with the university password policy or sooner (in the case of a key resource departure).

Vice President - Administrative Services
Sherman Hall 200 • 1 University Circle
Macomb, Illinois 61455
Phone: 309/298-1800 • E-mail: VPAS@wiu.edu