Enhanced PC User Privilege Procedure FAQ

In fall 2012, at the request of President Driscoll, university IT leadership began an intense research project into best practices for information security in higher education. The goal of the initiative was to determine how the university could improve protection of sensitive data and other digital assets and preserve the concepts of academic freedom, exploration, and scholarship within the constraints of the current economic climate.

One key finding of this research was that IUP did not adhere to a "Critical Security Control" recommended by the SANS Institute: "minimize administrative privileges and only use administrative accounts when they are required." As a result, a new procedural framework for requesting and granting enhanced privileges was created by IT leadership, approved by President Driscoll, and submitted to a team of faculty and IT leadership who developed the procedure's logistics and this FAQ.

Enhanced PC privileges create added risk to the university. For example, malicious software often uses these privileges to compromise sensitive data, allows an intruder to gain control of the PC, or violate the integrity of the university computing network. Even if no malicious software is involved, enhanced privileges may allow a user to inadvertently perform actions that compromise the computer's security or stability, or install or use software in a manner that does not comply with its license.

The establishment of the standard privilege baseline greatly reduces the likelihood of such events occurring, and may ease IT support efforts by ensuring that the software environment of most PCs they support will not contain non-standard software, processes, or services. Finally, it is beneficial to the university community to establish a uniform procedure through which all employees with legitimate need for enhanced privilege can request and gain such access.

Desktops and laptops purchased by the university after March 31, 2014, and assigned to an individual will be deployed using the new procedure, as will current PCs when assigned to a different employee. This procedure will also be used for PCs purchased before that date if the employee desired to have their privilege changed.

The term "enhanced privilege" encompasses any additional user privilege above the standard user privilege regardless of the operating system. The use of this term is also used in recognition of the fact that future security options might become available offering more user options while preserving university protections.

Yes. Any user who believes they have a need for enhanced privilege and is willing to formally accept the additional responsibility may request it.

This option exists for situations in which a user has specific tasks that require this privilege, and the issues of upgrade/patch installs will be addressed with the user's IT staff support person at the time the temporary privilege is granted.

Yes, although other operating systems may result in variations of procedure logistics and will be handled with the user on a case-by-case basis.

This procedure has no impact on current methods for supporting shared desktops and laptops, and current procedures will apply.

The Enhanced PC User Privilege Procedure is available to all users who have been assigned a university-owned desktop or laptop for their individual use.

No. IUP currently uses its Mobile Device Guidelines to consider best practices in securing these devices.