WORKSTATION
| Type: | Standard |
| Last Updated: | December 27, 2023 |
| Sponsor: | Scott Hunt, Assistant Vice President, OIT |
| Owner: | Ryan Amy, Computer Support Portfolio Director |
| Custodian: | Mary Stevens, IT Governance, OIT |
| Version: | 1.0 |
PURPOSE
Ensure university-owned workstations use actively patched and supported operating systems and software, are patched monthly, and run required endpoint protection software.
SCOPE
These standards apply to all users of university workstations, including laptops. They extend to all university departments, employees, students, partners, consultants, and vendors utilizing university workstations.
POLICY BASIS
These standards support the Appropriate Use of Information Technology Resources Policy and the Data Use, Privacy, and Security Policy.
REQUIREMENTS
End-of-Life Operating Systems:
Only install and use actively patched and supported vendor operating systems. Any operating system identified as End-of-Life must be upgraded. Major vendor operating systems include Microsoft Windows, Apple macOS, and Linux (Red Hat, Ubuntu) with the latest distribution or distribution marked Long-Term Support (LTS).Operating System Patches: Patch vendor-supported operating systems monthly through the built-in, automatic update functionality of the operating system. If a university-approved endpoint management platform is being used, such as Microsoft Endpoint Manager (MEM), use it to patch monthly.
Workstation Software: All installed software must be patched monthly. If the software can no longer be patched or is End-of-Life, it must be removed or uninstalled. Configure updates to run automatically, if available.
Endpoint Protection Software: CrowdStrike Falcon is the required endpoint protection platform for BYU and CES. It protects and alerts on potential malicious computer activity within the organization. Falcon must be installed and running on all university-owned workstations. Do not disable or uninstall Falcon unless specifically directed by the CES Security Operations Center. If Falcon conflicts with other anti-virus software, remove the other anti-virus products. The Falcon client does not need to be installed on tablets or mobile devices.
ROLES & RESPONSIBILITIES
Technology-supported employees:
If a CSR or someone else helps manage technology for a university employee, they are considered technology-supported employees. These employees should use university-owned workstations responsibly. Workstations should be set up for automatic updates, and employees should allow for those updates. Falcon must be installed and enabled on workstations. Technology-supported employees should contact their assigned CSR with workstation questions.CSRs or self-supporting employees: If a university employee manages his or her own technology, or manages technologies for others they are considered a self-supporting employee. Self-supporting employees must understand and apply the workstation standards. This includes patching operating systems and workstation software monthly; upgrading End-of-Life operating systems; removing End-of-Life software; configuring automatic updates when available; and ensuring Falcon is installed and running on university-owned workstations. CSRs have the added responsibility of helping users apply workation standards.
OIT employees: In addition to the responsibilities listed for technology-supported and self-supporting employees, OIT employees must follow more rigorous workstation management standards. If you work for OIT, please refer to The Elevator (OIT’s Intranet) for an explanation of the OIT Workstation standards.
COMPLIANCE & ENFORCEMENT
Operating systems that are no longer supported or are reaching End-of-Life must be removed or upgraded to a supported version. Software that can no longer be patched or is End-of-Life must be removed or uninstalled. Falcon must not be disabled or uninstalled unless specifically directed by the CES Security Operations Center.
The Appropriate Use of Information Technology Resources Policy states:
The university reserves the right, in its sole discretion and for any reason or no reason, to immediately revoke authorization to access or use any or all IT Resources.
STANDARDS OWNERSHIP & REVIEW
This standard is reviewed every year, or sooner if there is a major change in policy, regulations, or systems.
RELATED RESOURCES
IT Standards are developed by subject matter experts and approved by the Information Technology Committee, which consists of the CIO, the CISO, University Vice Presidents and other senior leaders.