Information Security
The Information Security team supports Texas Woman's University by providing cybersecurity services, education and expertise to support confidentiality, integrity and availability for data across our campuses.
Announcements
November 28, 2023
Updates to TX-RAMP
The Texas Department of Information Resources (DIR) released version 3.0 of their TX-RAMP Manual. The publication goes into effect on 12/1/2023.
Noteworthy changes include the addition of a transitional grace period that enables state agencies to create and leverage a transition plan from a non-compliant solution to a compliant solution in the event a compliant solution’s TX-RAMP certification lapses or is revoked. The timeline for transition may not exceed 24 months from inception to execution. TWU is responsible for developing, documenting, and adhering to a transition plan that meets the minimum criteria:
- Identification of Affected Services: Clearly list and describe the services affected by the lapse or revocation of certification.
- Timeline for Transition: Provide a realistic and achievable timeline for the migration to a compliant solution, including key milestones and deadlines. The timeline for transition may not exceed 24 months from planned inception to execution.
- Risk Assessment: Conduct a risk assessment to identify and mitigate potential security and operational risks during the transition.
- Selection of Compliant Solution: Detail the process for selecting a TX-RAMP compliant solution that meets the TWU's needs.
- Migration Strategy: Outline the methods and procedures for migrating data and operations to the new solution, ensuring data integrity and availability.
- Monitoring and Reporting: Establish ongoing monitoring and internal reporting mechanisms to track progress and address any challenges or delays promptly.
- Contingency Planning: Include contingency measures to address unexpected issues or delays, ensuring uninterrupted service delivery.
The TWU Information Security team will review requests to continue using non-compliant cloud services and will work with the system owner to develop this plan. System owners should initiate the request by completing the TX-RAMP Transitional Grace Period form.
Other TX-RAMP Manual 3.0 revisions:
- State agency, DIR, and cloud service provider responsibilities are defined.
- State agencies are responsible for determining whether a cloud computing service is subject to TX-RAMP requirements and determining the minimum certification level of the cloud solution.
- DIR is responsible for assessing and certifying the cloud computing service. Cloud service providers are responsible for providing assessment information and responding to TX-RAMP inquiries.
- Cloud service providers must maintain TX-RAMP compliance requirements, notify the appropriate parties if the cloud computing service loses TX-RAMP certification, and notify customers of breaches to system security.
- A Fast Track Assessment process was introduced that allows cloud service providers to leverage existing DIR-approved third-party assessments or audit reports that provide evidence of security practices. Cloud service providers seeking the Fast Track process for a cloud service must complete the TX RAMP Fast Track Request Form with DIR.
- Additional details regarding provisional, Level 1 and Level 2 certification extension processes have been added.
- Additional clarification is given to cloud computing services that are out of scope.
- Cloud computer services operating on a cloud infrastructure/platform such as Amazon Web Services (AWS) do not inherit the underlying TX-RAMP certification from the cloud infrastructure provider.
- New and revised security controls are addressed. Cloud service providers must implement new or revised security controls within 18 months from the date the changes are adopted.
- Cloud service providers must now provide DIR with a Plan of Action and Milestones for each required security control that is deficient. DIR determines if the proposed solution addresses the failed control.
- The reporting of significant changes to cloud services is addressed with additional clarification and guidance. Cloud service providers must communicate significant changes to DIR within 30 days of the date the change was made, and DIR is responsible for completing an updated service certification review.
For any questions regarding TX-RAMP requirements, please contact D’Ann Jackson at sjackson47@twu.edu or (940) 898-3262.
Previous Announcements
Past announcements are available below.
Enroll in Google 2-Step Verification
August 31, 2023
Enroll in Google 2-Step Verification
Texas Woman’s University is strengthening its security posture by enabling multi-factor authentication (MFA) (also referred to as two-factor authentication (2FA) or two-step verification) for specific systems across the University. MFA adds an extra layer of protection when accessing accounts and requires users to enter more information than just a password. For example, along with the password, users might be asked to enter a code sent via voice or text message or tap a verification prompt via a secure app on their phone.
A phased approach is being used so that groups can easily manage their enrollment into the MFA program. Google Workspace is the next system to require MFA through Google 2-step verification. To enable 2-step verification for your account, please follow the steps detailed in the “Turn on 2-Step Verification” help article provided below. Please copy and paste the link to open in your browser.
https://support.google.com/accounts/answer/185839
TWU recommends setting up Google 2-step verification using one of the following options:
- Google Prompt
- Text (SMS) message
- Phone call
More information and frequently asked questions can be found at https://twu.edu/technology/information-security/multi-factor-authentication-mfa/google-mfa/
TX-RAMP Certification for Cloud Services
December 13, 2021
TX-RAMP Certification for Cloud Services
In the 87th Legislative Session, the Texas Legislature passed Senate Bill 475, requiring the Texas Department of Information Resources (DIR) to establish a state risk and authorization management program that provides “a standardized approach for security assessment, authorization, and continuous monitoring of cloud computing services that process the data of a state agency.”
To comply, DIR established a framework for collecting information about cloud services security and assessing compliance with required controls and documentation. Beginning January 1, 2022, Texas Government Code § 2054.0593 mandates that state agencies (including TWU) must only enter or renew contracts to receive cloud computing services that comply with TX-RAMP requirements.
Any cloud service contract being renewed after December 31st, 2021 will be subject to the TX-RAMP certification process and will involve TWU, DIR, and the respective cloud vendor. New contracts and renewals taking place in 2022 will have additional vetting that will have to take place and will significantly increase the amount of time to procure cloud services.
When requesting to renew or purchase a cloud service, please follow the current TWU procurement process. During the risk assessment, TWU Information Security will assess the cloud service and its intended usage at TWU. The risk assessment will determine if the cloud service vendor is required to pursue TX-RAMP certification. If TX-RAMP certification is required, the vendor must have a valid certification before the contract can be executed.
Additional details regarding the TX-RAMP program and vendor certification process can be found via DIR: https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramp
If you have any questions or concerns, please contact Procure@twu.edu.
Beware of COVID-19 Related Scams and Phishing Emails
June 24, 2020
As people across the country take to distance learning and teleworking, cybercriminals are looking to profit from pandemic fears with a surge of scams, phishing emails, and malicious software related to COVID-19. You will most likely experience an increase in COVID-19 related marketing and messaging through various channels (e.g. browsing websites, emails, phone calls). Some of these messages will convey important official news, while others will undoubtedly be fake with malicious intentions.
Scams and phishing attacks range from the typical “Are you available?” gift card scam, fake charity organizations, to COVID-19 trackers applications containing malware. Recognize more of these attacks by reviewing the latest round-up of COVID-19 related scams and phishing attacks.
In these uncertain times, practice the following security tips to stay safe online:
Verify the source - The new proactive cybersecurity adage has become ‘verify, then trust.’ When a message seems out of place, trust your gut feelings and verify the request through another separate method of contact to confirm it’s authentic.
Play defensively - Ensure you practice good cybersecurity hygiene by installing anti-malware software on your computer and examine messages with additional scrutiny.
Scrutinize the urgency - If the message carries a undue sense of urgency, especially one that prompts you to act, take a deep breath, step back and analyze the message objectively. Scams and phishing campaigns force an emotional response. Recognizing when this happens puts you one step ahead.
Think before you click - In addition to the above tips, never open an attachment or click on a link from senders you don’t recognize. The attachment or link won’t expire, so you’ll have time to think it over for a few extra critical seconds.
Report a Phish - Everyone plays a crucial role in preventing scams and phishing attacks. If you receive one, please follow these instructions for reporting a phish.
For additional helpful consumer tips, please review from the Federal Trade Commission advisory on responding to COVID-19 scams.
Cybersecurity Tips for Working from Home
April 14, 2020
Moving at short notice from a trusted office environment to working remotely can create security risks. There has been an increase in coronavirus-related phishing attacks, according to European cybersecurity agency ENISA. Learn more at https://inside.twu.edu/technology/read/cybersecurity-tips-for-working-from-home
Tools and Resources
- Check if a link is malicious - https://urlscan.io/
- Current email scams - https://www.consumer.ftc.gov/features/scam-alerts
- Recognize and avoid phishing scams - https://www.consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
Page last updated 1:28 PM, May 1, 2024