Data Security
Data Security at CSAIL
MIT has Data Security information available online at http://infoprotect.mit.edu/
This page helps CSAIL lab members determine how sensitive their data is and where to store it appropriately.
Contents
Security Levels
The Institute’s Written Information Security Program (WISP) defines three levels of risk: Low, Medium, and High.
Low
This information is meant to be freely available to both members of the MIT community as well as the general public without access controls. Publicly available information may still be subject to University review or disclosure procedures to mitigate potential risks of inappropriate disclosure.
Examples:
- Directory information for faculty, staff, or students
- Research data that has been de-identified in accordance with applicable rules
- Published research data; published information about the Institute
Low risk data may be stored on AFS, NFS, or local system disk using standard access controls to limit the set of authenticated users who have access to the data as appropriate.
Low risk data is appropriate to be backed up according to lab backup policies.
Low risk data is public which requires no special treatment.
Medium
Information not intended to be freely available to the general public, or to the MIT community, without access controls.
The loss of confidentiality, integrity, or availability of these information assets could reasonably be expected to result in legal liability, reputational damage, or potential for other types of harm.
Examples:
- MIT IDs with associated identifying information
- Personnel records
- Faculty and staff employment applications, personnel files, benefits, salary, birth date, personal contact information
- De-identified medical and financial datasets which are not covered by law but are governed by individual data security contracts
- Institute financial account numbers and budgets
- Donor contact information and non-public gift information
- Non-public contracts
- Unpublished research papers
- Building floor plans
Medium Risk data is not appropriate for general storage on AFS, NFS, or typical workstation or server local disks, nor is it appropriate for backup with our standard tools.
TIG is able to provide a secured data environment for this level. This requires dedicated hardware purchasing and planning.
High
This information is subject to legal or regulatory requirements necessitating its proper safeguarding and handling, including possible notification in the event of a breach.
The loss of confidentiality, integrity, or availability of these information assets could reasonably be expected to result in serious harm to individuals or the Institute.
High Risk data should never be stored on CSAIL research systems as we do not have security staffing to provide appropriate audit and training.
Regulated Administrative or Academic Information:
- Personal information requiring notification (PIRN)
- MIT credentials with access to Level 2 or higher information
- Student information classified under FERPA
- Health information covered under HIPAA/HITECH
- Credit card information covered by PCI-DSS rules
- Court or national security orders that prohibit disclosure (e.g., subpoenas, National Security Letters)
Regulated Research or Human Subject Information:
- Information regarding illegal activities
- National security information
ITAR (International Traffic in Arms Regulations) and the EAR (Export Administration Regulations):
- Export-related security controls on information that is subject to a Technology Control Plan
Data Risk Reference Grid
The Data Risk Reference Grid helps you get a quick overview of what data you can safely store and where.
Legend:
- ✅ Allowed
- ❌ Prohibited
- ℹ️ Allowed with conditions
| Low | Medium | High | |
|---|---|---|---|
| ✅ | ❌ | ❌ | |
| Slack | ✅ | ❌ | ❌ |
| AFS | ✅ | ❌ | ❌ |
| NFS | ✅ | ❌ | ❌ |
| Dropbox, Google Drive, OneDrive (cloud storage) | ✅ | ℹ️ | ❌ |
| Local Storage | ✅ | ℹ️ | ❌ |
| Removable Media | ✅ | ℹ️ | ❌ |
| Secured Data Environment | ✅ | ✅ | ❌ |
Storage Methods
Status: ✅ Low | ❌ Medium | ❌ High
Email is inherently an insecure method of communication. Medium and/or High risk data should never be sent via email. Consider using email for sending links to cloud storage with proper access control to higher risk data. The only caveat is files that are attached with appropriate file-level encryption.
Slack
Status: ✅ Low | ❌ Medium | ❌ High
Slack on its own does not provide the required security protocols for Medium or High risk data. Consider using Slack for sending links to cloud storage with proper access control to higher risk data.
AFS
Status: ✅ Low | ❌ Medium | ❌ High
AFS cannot accommodate Medium Risk data in its current configuration. Two-factor authentication for interactive user and administrator logins is not provided. If you require Medium Risk data on AFS, please see our Secured Data Environment.
NFS
Status: ✅ Low | ❌ Medium | ❌ High
NFS does not provide any reasonable security whatsoever. Medium and/or High risk data should never be stored on NFS.
Cloud Storage
Dropbox, Google Drive, OneDrive
Status: ✅ Low | ℹ️ Medium | ❌ High
Medium risk data can be stored in Dropbox, Google Drive, or OneDrive with the proper access control and responsible steps in place. Such data should be reasonably secured by sharing only with persons who need to access the data for a permissible purpose, and under strict instructions that these persons: (a) may not share the data with any third party absent permission from you, and (b) should delete the data from their local systems when they are finished with it.
For more details, please see MIT IS&T’s Knowledgebase Article.
Local Storage
Status: ✅ Low | ℹ️ Medium | ❌ High
Managed CSAIL Ubuntu machines do not provide the required security protocols for Medium or High risk data. If you must store Medium Risk data, consider a Secured Data Environment.
It is possible to set up your own local storage provided you implement appropriate tasks to protect your data.
Apple MacBooks configured and provided by TIG provide the required security protocols for Medium risk data, provided the data is deleted from your local systems when you are finished with it. For more details, please see MIT IS&T’s Knowledgebase Article.
Removable Media
Status: ✅ Low | ℹ️ Medium | ❌ High
For Medium Risk data, please see MIT IS&T’s Encryption Landing Page.
Secured Data Environment
Status: ✅ Low | ✅ Medium | ❌ High
TIG can provide support for creating a Secured Data Environment and compute clusters on user-purchased hardware sufficient for Medium Level Confidential Information, such as de-identified medical or financial datasets.
See Also
- Secured Data Environment - Setup details for Medium Risk data
- Standard Security Environment - CSAIL Linux security practices
- AFS at CSAIL - Fine-grained access controls
- NFS Security - Why NFS is not secure
- Backup Policy - What gets backed up and how long