Page tree
Skip to end of metadata
Go to start of metadata

Security Plan

1. Policy Statement

Creating a secure environment in which to operate is an important part of establishing the level of stability required of a trusted digital repository. Scholars Portal recognizes that there are two main areas of vulnerability to consider: the vulnerability of the information systems and data, and the vulnerability of the physical space in which the servers housing the Scholars Portal systems and data reside. The Scholars Portal Operations Team uses industry best practices and a strict evaluation of necessary access in order to mitigate risk associated with unauthorized access to these resources.

2. Security Implementation

2.1. Information Systems Security

Except as necessary to provide external access to the Designated Community, SP servers are located on an internal network to which only SP staff machines and other servers have access. In addition, SP IT staff enforce strict control over user privileges within all SP systems. Any SP staff who needs to work with production SP systems in the course of his or her work only has access to do the tasks specific to his or her duties.

Finally, once a storage volume is full, it is remounted on each server as a read-only volume. At that point, changes to any of the material, whether intentional or accidental, are only possible from the SAN console itself.

2.2 Physical Security

All Scholars Portal services and data are housed on servers located in a secure computing facility at the University of Toronto.  Access to this space is restricted only to authorized individuals, is subject to monitoring by staff during business hours, and is monitored by a series of motion detectors and alarm systems during non-business hours. These alarm systems are connected to library security and a contracted security firm, who can escalate calls to either campus or municipal police.

3. Document History

Version

Date

Change

Author

0.1

10/26/11

First Draft

Steve Marks

0.2

12/20/11

Added IS Security

Steve Marks

  • No labels