Confidential Data - Storing and Sharing

As a custodian of confidential information, you are responsible for the data sent, stored, or shared on the information technology (IT) software, services, and devices -- whether personally owned or CCE-owned -- that you use. This responsibility includes choosing appropriate solutions to manage data.

Description

This article explains the requirements and approved methods for storing, transmitting, and sharing confidential data securely. The guidance provided ensures confidential information is protected from unauthorized access while maintaining necessary access for authorized users. All Cornell Cooperative Extension (CCE) staff may use the services described in this article.

Approved Methods for Transmitting and Receiving Confidential Data

Note: Confidential data should never be sent or received directly through email.

The following service is approved for securely transmitting and receiving confidential data:

• Secure File Transfer (SFT): https://sft.cornell.edu

Note: Storage of confidential data on local servers and computers is not secure. Be sure to remove confidential data from these devices once your transfer with SFT is complete.

Approved Storage Options for Confidential Data

Contact your Shared Business Network (SBN) IT Lead for more information and pricing on the following approved storage options:

• Cornell Managed File Servers - Extra Tier service: Provides firewall protection and two-factor authentication.
  https://it.cornell.edu/cornell-stack-managed-servers-static-hosting-storage-farm/fees-and-billing-managed-servers
• Cornell Shared File Service: Includes confidential data storage option with Common Internet File System (CIFS) audit logging.
  https://it.cornell.edu/shared-file/monthly-billing-shared-file-services

Training Resources

The following video provides a walkthrough of Secure File Transfer and its use with confidential data:

• https://vod.video.cornell.edu/media/SFT%20and%20confidential%20data/1_qpa2m5nh

Related Policies

• CCE IT-002 Information Security: https://staff.cce.cornell.edu/units/it/policies
• Cornell Policy 5.10 Information Security: https://policy.cornell.edu/policy-library/information-security

Additional Resources

• Document and Data Storage and Handling at CCE: https://staff.cce.cornell.edu/units/it/document-storage
• Security of Scanned Documents (Best Practices): https://cornell.app.box.com/s/oycrx0l53mauvdzcjgk83hgnmquebz39
• Scanning for Sensitive Data with Spirion: https://tdx.cornell.edu/TDClient/58/Portal/KB/ArticleDet?ID=998
• Secure File Transfer - About: https://it.cornell.edu/secure-file-transfer
• Consequences of Mishandling Sensitive Data: https://it.cornell.edu/security-and-policy/consequences-mishandling-sensitive-data
  • Securing data involves costs; however, the consequences of compromised confidential data are significantly greater:
    • The minimum cost of a level 1 breach is at least $20,000.
    • Damage to reputation is substantial and long term.
• Regulated Data Chart and Storage Options: https://it.cornell.edu/regulated-data-chart-0
• Requirements for Storing Confidential Information:
  • Cornell Shared File Service: https://it.cornell.edu/shared-file/confidential-or-sensitive-data-share
  • Cornell Managed File Servers: https://it.cornell.edu/managed-servers/security-tiers?utm_source=sidebar
• Adobe Sign Permitted Data Uses for E-signature: https://it.cornell.edu/e-sign/permitted-data-uses-e-signature?utm_source=sidebar
• Cornell Data Storage Finder Tool: https://finder.research.cornell.edu/storage