Level 4

Designate users with permission to access applications

 Owners/managers of applications dealing with Level 4 information must designate which employees have permission to access the application from outside the Harvard wired network or other Harvard strongly authenticated and encrypted wireless network.

Configure firewalls appropriately

The firewall between the Level 4 server and networks that include user computers must be configured to only permit outbound traffic that is required properly operate the service provided by the Level 4 server

Securely overwrite or destroy physical media

Securely overwrite disk drives in servers at a block level or physically destroy when the server is removed from service or disk drives are permanently removed from servers.

Report possible breach, loss or theft of confidential information

Follow instructions posted on the Information Security Website to start the incident reporting process. The University CISO and the OGC will be informed as appropriate of any known or suspected breach of a server containing confidential information. In addition, the University maintains a whistleblowing policy. The policy is intended to encourage all members of the Harvard community to report suspected violations of law or Harvard...

Read more about Report possible breach, loss or theft of confidential information

Use software to review logs

Use software (e.g. Splunk) to periodically review the server and application logs to see if the system is under attack (e.g., many bad password guesses) and that the users are following documented practices (e.g., not logging as root).

Identify user and time of access

User and administrator access to servers and applications must be logged, whether the system is managed directly by Harvard or via contract with a third-party service provider for Harvard's use.