2. Information Security Measures

Information security measures are carried out after all physical, human, and technical security perspectives have been taken into consideration. Refer to the Procedures for details.

i. Physical Security

(a) Installation Sites and Administrators

Critical information system devices and memory storage media, including server consoles, must be installed within a controlled area (a place separated physically and monitored 24 hours a day by monitoring equipment and for which a record of authentication and room entry/exit is kept). Equipment administrators must be assigned to these information system devices and controlled installation areas. An equipment administrator is authorized to manage specific equipment and areas and is responsible for carrying this out. Physical locations inside such controlled areas must not be opened to anyone other than the equipment administrator(s) assigned to the server equipment in question.

(b) Master Copies and Completeness of Information

Master copies of information for which completeness must be maintained are to be stored in a form that cannot be overwritten to guarantee the authenticity of these master copies. The information administrator for each type of information is responsible for this guarantee.

(c) Information Backups and Availability

Data stored in server devices and other such locations must be backed up on a regular basis. The back-up schedule is to be determined based on the importance of the server device in question. The media on which data is to be backed up must be stored inside a controlled area in a room for which entry and exit is managed through authentication. The equipment administrator is responsible for these backups.

(d) Information Deletion and Confidentiality

Information eventually becomes unnecessary as time passes. The information administrator is responsible for deleting information that is no longer needed while giving consideration to the maintenance of confidentiality. This responsibility is particularly important when the information is private in nature. The information administrator must establish rules for the number of years that managed information is to be kept before being deleted. Information devices and storage media will eventually grow old and require disposal. The disposal of information devices and storage media (including the deletion of stored information) is the responsibility of the equipment administrator and requires the approval of the information administrator.

ii. Personnel Security

(a) Awareness of Responsibilities by the Entire Membership

The entire membership of the university must be aware that anyone can either cause or suffer from information security problems. To avoid both, all members of the university must be aware of their responsibilities with respect to maintaining the information infrastructure and acquire the knowledge and maintain the skills necessary to do so. All users of information systems are obligated to maintain information security. The Information Security Committee publicizes policies among all members of the university while clarifying who has what authority and which responsibilities through awareness-raising and educational activities designed to ensure information security.

(b) 24-Hour Operation and Maintenance of the Information Infrastructure

The university's information infrastructure network (the university network backbone) is designed based on the assumption that it will operate 24 hours a day, 365 days a year. The System Administration Committee must run and maintain the university's information infrastructure network based on this assumption and secure the personnel needed to do so.

(c) Security Awareness at Each Organization

Every university organization must internally publicize the security levels of each type of information that it handles and manage the information accordingly while reporting to the Information Security Committee in writing regarding important information. In addition, organizations must review this management system on a regular basis.

Prohibition against Actively Wrongful Conduct

Regardless of whether he/she is from inside or outside the university, no person who is subject to this Policy may infringe upon the information of any research or educational institution, company, organization, group, individual, or other entity. Also, each law, agreement, or stipulation established by this university and other rules regarding information security must be observed.

iii. Technical Security

The System Administration Committee takes necessary measures to control and manage access to information networks to prevent the theft, falsification, or destruction of information that can be caused by unauthorized access, whether from inside or outside the university.

(a) Networks

The University System Administrator is responsible for managing university networks. Chronological records (logs) of firewalls and intrusion detection systems must be kept for a fixed period of time. Permission must be obtained from the Information Security Committee before university networks can be modified.

(b) Network Connection Devices

An equipment administrator must be assigned to each device that is allowed to connect to a university network. Minimal security standards that must be met by devices that are allowed to connect to university networks are stipulated in the Procedures. Any device that does not meet or comply with these standards may not be allowed to connect to university networks. Each device connecting to university networks must have some method that allows it to authenticate users. (Physical methods, such as restricted room entry/exit, are also permissible.) The equipment administrator must be able to identify the users of installed devices.

(c) Servers

Server equipment administrators must maintain a record of access to the servers and save this record for a set length of time. These access records (logs) must be analyzed on a regular basis to check them for problems, such as attempts to infiltrate the system.

(d) Personal Computers

Personal computers that connect to university networks and personal computers or memory storage devices that store university information in memory, whether temporary or not, must always have an assigned equipment administrator. This equipment administrator must also be a system administrator (superuser) for the personal computer in question. Also, each user of an administered personal computer must have his/her own user ID and password, and the personal computer must be set up so that logging in is not possible until a user ID and password are entered.

iv. Emergency Responses

If unauthorized access is detected, whether from inside or outside, or if an act, such as sabotage, takes place that interferes with the operation of the information infrastructure system, the university system administrator or department system administrator must follow emergency procedures established by the Information Security Committee. In such cases, the system administrator has both the authority and obligation to block the communication in question or separate and disconnect the information device involved as an emergency measure. Restoration of the disconnected communication or device must occur only after the Information Security Committee's assessment of the situation and within a set period of time. 　If unauthorized access or sabotage continues to occur, the Information Security Committee must take measures to deter the problem, such as by halting routine use of the information device or network connected to the device in question, to protect the university's information infrastructure system.