Student Level Security

1
HOW SECURE IS YOUR SECURITY
NASU CONFERENCE July 15, 2001
Marty Prosser The Ohio State University
2
Why Student Level Security?

• To restrict access to compliant sensitive student
  athlete records (NCAA)
• Prohibit staff from viewing or updating
  individual or family members records
• Prohibit staff from updating known problem
  student records

3
Getting Started

• Determine the population of students who you want
  to restrict access
• Develop a coding scheme to populate the BIOCAT
  field on BU3
• Develop security policies to determine which
  users have access to update/view selected
  populations

4
(No Transcript)
5
OSU Defined BIOCAT Codes

• D Directors Hold
• A Athlete
• S Special Hold
• Q QAP
• E SFA Student Employee

6
Update Security Profile for Users

• YU2B security screen must be updated
• for all users whose access will be restricted
• Restrict access similar to AIDYR and AIDID

7
(No Transcript)
8
Modified Sigma Programs

• ASDZUS Storage for Masking Security library
• ASPZUS Masking Security library
• ASCBA1 Biographic Access
• ASMYU5 Security Maintenance Map
• ASCYU5 Security Maintenance Program
• ASCYY2 Security Access Program
• FACFC1 Function Control

9
Modified Sigma Programs cont.

• FACDB1 ADS Browse
• FACLX1 Function Control
• FACAB1 Direct Lending Browse

10
OSU Requested Modifications

• MU Memo Updates
• OSU needed all users regardless of BIOCAT
  restriction to have the ability to query and
  update MEMO
• MA Baby Audit query
• OSU needed all users regardless of BIOCAT
  restriction to have the ability to view audit data

11
How has this benefited OSU

• Compliance issues for athletics
• Confidentiality issues for staff
• QA
• Special cases

12
Challenges

• Ensuring individuals who are granted access are
  trained to perform necessary functions
• Applying same security policies to internal web
  applications

13
Questions OrOther Security Related Issues

• Ability to copy user profiles