Workstation Security Standard

Overview

To reasonably protect  information resources (including data, systems, applications, user identities, communication platforms, and supporting infrastructure), UA has established and enforces minimum technical, administrative, and physical control standards. Additional or more rigorous controls may be applied, but the controls listed within this standard are the minimum UA adopted requirements. 

This standard is designed to align with applicable regulatory requirements, contractual obligations, and recognized industry best practices. Controls are determined based on the risk classification of the device, application, service, or data being accessed. 


Scope

Information Security and Assurance (ISA) Standards are mandatory and apply to the UA System and all users of UA computing resources.  This standard supplements and supports Board of Regents Policy & Regulation R02.07. These standards are reviewed and approved by the CIO Management Team (CMT), a system-wide governance group consisting of each university CIO, the System CITO, and the System CISO.  Business units maintaining their own security standards should utilize this standard as a baseline and may add additional requirements or detail as appropriate for their business needs, however, may not weaken any individual element of this standard without an approved Information Security Controls Exception.

This standard is periodically reviewed and updated to respond to emerging threats, changes in legal and regulatory requirements, and technological advances.

This security standard applies to all UA workstations.


Definitions

  • UA Workstation
    Any computing device either purchased with university funds, including grant funds, or acquired by other means in order to support the universities’ academic, research, administrative, or operational functions. A typical workstation could be described as a desktop or laptop computer running the Windows, Linux or MacOS operating system used to perform daily tasks.

  • Security Control
    A security measure, such as a tool, process, or guideline, that helps protect university information and systems. Security controls help ensure that UA data stays private, accurate, and available when it is needed.

  • University Approved Software

    Applications or services that have been approved through the UA Software Review Process.


  • PAW
    A Privileged Access Workstation (PAW) is a system designed with strict security controls and isolation mechanisms to reduce the attack surface for administrative tasks, like domain administration, system configuration, or managing critical infrastructure.

  • Sensitive or Regulated Data
    Information that must be protected by law or in accordance with industry best practices. At the University of Alaska, this data is classified as “Restricted” and includes multiple data types, including Personally Identifiable Information (PII), Family Educational Rights and Privacy Act (FERPA), Health Insurance Portability and Accountability Act (HIPAA), financial data, Criminal Justice Information Systems (CJIS),  International Traffic in Arms Regulations (ITAR), and others. For more information and examples, see “Restricted” data in Board of Regents Regulation R02.07.094. Data Classification Standards: Categories.

  • CIS Benchmarks

    CIS Benchmarks are best practices for the secure configuration of a computing system. Most CIS Benchmarks include multiple configuration profiles.

     

    • Level 1 profile

      Considered a base recommendation that can be implemented quickly, addresses common security risks, and does not significantly impact usability.

       

    • Level 2 profile

      Considered to be “defense in depth” and is intended for environments where security is paramount; these recommendations can impact usability.

  • System Risk Definitions

     

    • Low
      A UA Workstation that only processes, stores, or transmits information that is appropriate or intended for public release, including information that would be releasable without restriction or redaction in response to an Alaska Public Records Act request.

    • Medium
      A UA Workstation that  processes, stores, or transmits any information where a compromise would have moderate adverse effects on UA’s operations, assets, or individuals.

    • High
      A UA Workstation that  processes, stores, or transmits any information  where a compromise would result in serious to severe adverse effects on UA operations, security, legal standing, research integrity, or individuals’ privacy.
  • System Risk Levels

    System Risk Levels (Low, Medium, and High) are applied to systems based on the following risk levels.

    System Risk Level

    UA Assurance Level

    Examples

    Low

    Level 1

    • Library kiosk or public access computers
    • General use (public) computer lab workstations
    • Reception desk (shared)

    Medium

    Level 2

    • Faculty or Staff workstations
    • Student Employee workstations

    High

    Level 3

    • Principal Investigator (PI) workstation
    • Privileged Access Workstation (PAW)
    • HIPAA-covered entity workstation
    • Financial Admin workstation



  • UA Assurance Levels

    UA Assurance Levels, which set the rules for verifying who someone is and how they log in securely, are defined in the Password and Authentication Standard.


Standard: Workstation Security Controls

System Management

 

Low

Medium

High

Workstations should be set up, updated, and maintained by either unit IT departments or the central University IT team, using approved university tools.

Recommended

Recommended

Required

Enable remote wipe capabilities for managed devices wherever possible.

Required

Required

Required

Enable location services for managed devices wherever possible.

Required

Required

Required


Whole-Disk/Full-Disk Encryption

 

Low

Medium

High

Workstations must be encrypted using a FIPS 140-2 validated full-disk encryption solution.

Recommended

Recommended

Required

Encryption keys must be securely stored in a managed enterprise vault.

Recommended

Recommended

Required


Local Administrator Password Rotation

 

Low

Medium

High

Implement a local administrator password management solution with unique per-device passwords.

Recommended

Required

Required

If enabled, rotate local administrator passwords at least every 180 days or upon role changes. It is recommended that the rotation process be automated if possible.

Required

Required

Required


Remove/Actively Manage Local Administrator Permissions

 

Low

Medium

High

Remove persistent local administrator privileges for standard users.

Required

Required

Required

Restrict local admin access to approved users with Just-In-Time (JIT) access solutions like Privileged Access Management (PAM).

Recommended

Recommended

Required

Require MFA for privileged access.

Required

Required

Required

Use a privileged access workstation (PAW) for domain administration or managing critical infrastructure.

N/A

N/A

Required


Endpoint Detection and Response (EDR)

 

Low

Medium

High

Deploy university approved  endpoint detection and response (EDR) solutions.

Required

Required

Required

Set up endpoint detection and response (EDR) to watch for unusual activity in real time and take automatic action to stop threats.

Required

Required

Required


Vulnerability Scanning

 

Low

Medium

High

Using a university approved tool, conduct authenticated or agent-based vulnerability scans on all workstations at least weekly, in accordance with UA’s Vulnerability and Patch Management Standard.

Required

Required

Required


Patching

 

Low

Medium

High

Apply security patches in accordance with UA’s Vulnerability and Patch Management Standard.

Required

Required

Required

Wherever possible, turn on “automatic updates” for software and operating systems.

Required

Required

Required


Secure Baseline Configuration

 

Low

Medium

High

Deploy workstations using hardened configurations based on the appropriate CIS Level.

Level 1

Level 1

Level 2

Enforce configurations via university approved tools.

Required

Required

Required


Backups

 

Low

Medium

High

Workstation data should be backed up to encrypted solutions ( either cloud or on-prem storage).

Recommended

Recommended

Required

Implement continuous backup solutions.

Recommended

Recommended

Required

Test backups regularly.

Annually

Annually

Quarterly


Host Firewall

 

Low

Medium

High

Enable and configure host-based firewalls.

Recommended

Required

Required

Block all inbound traffic unless explicitly allowed.

Recommended

Recommended

Required

Enable logging for firewall rule violations.

Recommended

Recommended

Required


Multi-Factor Authentication (MFA) 

 

Low

Medium

High

Enforce MFA for all workstation logins. 

Recommended

Recommended

Required (FY27)

Require MFA for privileged access.

Required

Required

Required


Audit Log Collection and Retention

 

Low

Medium

High

Enable detailed logging for system, security, and application events.

Recommended

Recommended

Required

Retain logs as appropriate for relevant compliance obligations.

N/A

N/A

Required

Forward logs to a university-approved SIEM or log management solution.

Required

Required

Required


Physical Protections

 

Low

Medium

High

Workstations must be stored in a physically secure location.

Recommended

Recommended

Required

Enable BIOS/UEFI password protection.

Recommended

Recommended

Required

Disable boot from USB/DVD in BIOS/UEFI.

Recommended

Recommended

Required


Require Network Time Protocol (NTP)

 

Low

Medium

High

Synchronize time via secure, internal NTP servers or trusted sources (e.g., NIST, Microsoft time servers).

Recommended

Required

Required


Screen Lock

 

Low

Medium

High

Enforce automatic screen lock for no more than 15 minutes of inactivity; adhere to specific regulatory requirements where applicable.

Recommended

Required

Required

Require password or platform authentication to unlock.

Recommended

Required

Required


Application Allowlisting

 

Low

Medium

High

Only software that has been approved by the UA Software Security Review process may be installed or run on workstations.

Required

Required

Required


Logon Banner

 

Low

Medium

High

Display legal, security, and regulatory compliance (if applicable) notification at login.

Required

Required

Required


USB Mass Storage Allowlisting

 

Low

Medium

High

Disable USB storage devices unless explicitly allowed via university-approved management tools.

Recommended

Recommended

Required

Encrypt all external storage devices.

Recommended

Recommended

Required


Disable Macros in MS Office Docs from Internet

 

Low

Medium

High

Block all macros from the internet via Microsoft Office security settings or university-approved management/threat detection tools.

Required

Required

Required


Review/Approve Browser and Other User-Installable Extensions  

 

Low

Medium

High

Install only pre-approved browser extensions.

Recommended

Recommended

Required (FY27)


File Integrity Monitoring (FIM) on High Risk Systems

 

Low

Medium

High

Implement file integrity monitoring (FIM) solutions to monitor and alert on changes to software, firmware, and critical system files.

N/A

N/A

Required


Temporary File Cleanup

 

Low

Medium

High

Automate deletion of temporary files using system cleanup tools or scripts. 

Recommended

Required

Required


Cached Credential Cleanup

 

Low

Medium

High

Configure workstations to clear cached credentials for network accounts upon reboot.

Recommended

Recommended

Required


Limit Unsuccessful Login Attempts 

 

Low

Medium

High

After 10 consecutive unsuccessful attempts, lock session for 10 minutes.

Required

Required

Required


Loss/Theft

 

Low

Medium

High

Report lost or stolen devices to unit or central IT and Security (security@alaska.edu)  within 24 hours of determining the device is missing.

Required

Required

Required


Disposal of Devices

 

Low

Medium

High

All university-owned devices and data storage must have their storage media properly sanitized at the end of their lifecycle or prior to disposal.

Secure Delete/Wipe

Secure Delete/Wipe

Destruction of Storage Media


Use of Personal Devices for University Business

UA users may need to access or maintain sensitive university data from their personally owned devices (smartphones, tablets, laptops, and more). The university addresses this use in Board of Regents' Policy 02.07.066, Device Security .

Storing and processing institutional and research data on personal devices may introduce significant risk to the integrity, security, and availability of that data. Note that some units have adopted and enforce requirements for use of personally owned devices that are more specific or restrictive than defined in BOR Policy 02.07.066 and its related guidelines.

If your department or unit permits you to work with sensitive institutional data from devices not owned by the university, you, as the employee,  are expected to protect university data by adhering to this Standard to secure all personal devices accessing university resources.

 


Violations and Exceptions

In an effort to perform its requirements under Board of Regents Policy & Regulation R02.07.060 to secure University Information Resources, systems and services which fail to abide by approved information security controls may be subject to the implementation of compensating controls to effectively manage risk, up to and including disconnection from the UA network or blocking of traffic to/from untrusted networks.

UA employees, students, and other affiliates who attempt to circumvent an approved information security control may be subject to sanctions or administrative action depending on their role and the nature of the violation, which:

  • may result in a reduction or loss of access privileges, or the imposition of other restrictions or conditions on access privileges;
  • may subject employees to disciplinary action, up to and including termination; 
  • may subject students to disciplinary action including expulsion according to the Student Code of Conduct procedures; and 
  • may also subject violators to criminal prosecution. 

Requesting an Exception

The process for requesting exceptions to this or other IT Security Standard are outlined in the Information Security Controls Standard.

 


Implementation

OIT Information Security and Assurance is responsible for the implementation, maintenance and interpretation of this IT Standard.

Related Standards

References

Lifecycle and Contacts

Standard Owner: OIT Information Security and Assurance

Standard Contact: Chief Information Security Officer

Phone: 907-474-5347

Email: ua-ciso@alaska.edu

Approved: December 2025

Effective: January 2026

Next Review: January 2028