Protecting information for the future
Information is essential to almost every modern service. Universities depend on academic records, research data, financial information, employee records, instructional materials, healthcare information and administrative documents.
Data can be lost through ransomware, equipment failure, accidental deletion, natural disaster, theft, software corruption, or human error. As part of “Securing the Next 250,” organizations must protect important information and ensure it remains available when needed.
Backups support recovery. Encryption protects information from unauthorized access. Together, these controls strengthen resilience.
What Is a Backup?
A backup is a protected copy of data that can be used to restore information after the original is lost, damaged, deleted, encrypted by ransomware, or otherwise unavailable.
A strong backup process considers:
- What data must be protected
- How frequently it must be backed up
- How long backup copies must be retained
- Where the backups are stored
- Who can access or delete them
- How quickly data must be restored
- Whether restoration has been tested
A backup is only effective if it can be restored. Organizations should regularly test recovery procedures rather than assuming that a successful backup notification guarantees recoverability.
Cloud Synchronization Is Not Always a Backup
Cloud services provide valuable collaboration and storage capabilities, but synchronization is not necessarily the same as backup. If a file is deleted, corrupted or encrypted, the unwanted change may synchronize to other devices.
Some cloud platforms provide version history, retention, recycling or recovery functions, but those capabilities vary. Employees should store institutional information only in approved locations and follow established retention and backup requirements.
Do not create unapproved copies of sensitive data on personal devices, personal cloud services, removable media, or personal email accounts.
What Is Encryption?
Encryption changes readable information into a protected format that requires an authorized key or process to access.
Encryption can protect data:
- At rest: When stored on a computer, phone, server, cloud service, or removable drive
- In transit: When transmitted over a network or between systems
Encryption reduces risk if a device is lost, stolen, intercepted or accessed without authorization. However, encryption is not a substitute for access controls, strong authentication, secure configurations or data-handling requirements.
Handle Sensitive Data Carefully
Employees should:
- Store institutional data in approved systems.
- Follow the University’s data classification requirements.
- Share information only with authorized recipients.
- Confirm recipients before sending sensitive information.
- Use approved secure-sharing methods.
- Avoid copying sensitive data to personal accounts or devices.
- Report lost or stolen devices immediately.
- Encrypt approved removable media when its use is necessary.
- Follow records retention requirements when disposing of information.
Before sharing a file, verify both the recipient and the permissions. A link intended for one person should not be configured for unrestricted public access.
Ransomware and Resilience
Ransomware can encrypt files, disable systems, steal information, and disrupt essential operations. Reliable backups can reduce operational damage, but recovery may still require significant time and effort.
Employees can reduce ransomware risk by:
- Avoiding suspicious links and attachments.
- Keeping devices updated.
- Using MFA.
- Storing data in approved locations.
- Reporting unusual activity immediately.
- Avoiding unauthorized applications.
- Following information-handling requirements.
Remember!
Review where you store University information. Move work-related files from unapproved locations into approved university services and verify that sensitive information is shared only with authorized recipients.