Secure your home router and WiFi

Here are some guidelines to follow for working from home securely:

1. Secure your home router and WiFi

Insecurely configured home routers can lead to eavesdropping and/or attackers gaining remote control of your home computing devices.  Follow key and fundamental security safeguards such as changing the default router password and using Wi-Fi Protected Access 2 (WPA2).

See the following guide for router/wifi security:

Router Security: How to Setup Wi-Fi Router Securely

2. Secure your home computers

Keep up-to-date with patches/fixes/updates (including security, operating system, and antivirus updates).  Enable the computer's personal firewall and hard drive encryption.  Use a strong/secure password that is unique and not shared.

3. Minimize information management risks

Do not save, store, or print University information locally (especially that which is personally identifying).  That is, securely connecting to and using University resources remotely keeps University information on the University system.  Examples of such University resources include UAlberta Google, faculty/department based file-shares, and enterprise systems such as PeopleSoft, EDRMS, SupplyNet and eClass.  Use the University VPN where appropriate and necessary to securely connect to the University network.

If you absolutely need to save, store, or print University information at home in order to do your job, obtain approval from your Director/Chair beforehand, and agree on security safeguards around version control, information sharing/exchange, encryption, and retention/archive/disposal, among others.

The university has created these best practices to help address questions related to sharing information securely. You may have other requirements to consider as well, such as faculty or department policies and procedures, Research Ethics Board requirements, and external stakeholder stipulations.

Types of Information

Institutional data can generally be assigned to one of four categories:

1. Restricted (extremely sensitive)
2. Confidential (highly sensitive)
3. Protected (moderately sensitive)
4. Unrestricted (non-sensitive)

More information can be found in the UAPPOL Institutional Data Management and Governance Procedure document.

General Principles for Sharing Information

It is recommended to avoid sharing extremely sensitive information (such as identifiable patient and health care information, social insurance numbers, and passport information) on any university system (including UAlberta G Suite). If there is a valid and approved business justification for doing so, such sharing may be acceptable provided it includes encryption of data at rest and other compensating controls.

1. Extremely and highly sensitive information is not to be transmitted by email. It is also prudent to avoid sending emails with any information that could lead to harm upon compromise, e.g., including a full date of birth in an email could lead to identity theft.
2. UAlberta Google Drive is an approved alternative to email for sharing the university's business, academic, research and administrative information and records. Files in UAlberta Google Drive have built-in information rights management (IRM), meaning users can share files and information securely. However, be conscientious and careful when providing permission to those receiving or viewing the document or files, and always remember to unshare a document once the business need for it has passed.
   • Any type of files containing identifiable patient and health care information is NOT to be shared through or stored in UAlberta G Suite services.
3. Additional alternatives for sharing and storing university information include encrypted attachments or a faculty / department shared network file server.