Bring Your Own Device (BYOD) Standard

Standard Number: 1.11.1.1.3
Category: Acceptable Use
Owner: Information Security Services
Effective: July 18, 2023
Revision History: Originally effective December 18, 2012; updated January 1, 2020
Review Date: July 17, 2026

1. Purpose, Scope, and Responsibilities

   1. Personally owned computing devices are increasingly being used to access University Technology Resources and University Data. A security breach when using a personal device could result in loss or compromise of University Data, damage and/or unauthorized access to University Technology Resources, and/or financial harm to the University.
   2. The purpose of the Standard is to establish minimum security requirements for personally owned devices that connect to University Technology Resources and/or access University Data. This Standard does not apply to University-owned devices. For more information regarding University-owned devices, refer to the University-Owned Device Standard.
   3. Individuals who elect to utilize a personal device, including but not limited to smartphones, tablets, laptops, notebooks, and netbooks, to access University Technology Resources are responsible for the following:
      1. Abiding by the requirements identified within this document;
      2. Configuring personal device(s) to be able to connect to University Technology Resources;
      3. Any damages and criminal and/or civil charges resulting from the activities conducted on their personal device while connected to a University Technology Resource; and,
      4. All transactions made under their Authentication to a University Technology Resource.
   4. The University is not responsible or liable for the maintenance, backup, or loss of data on a personal device and does not accept responsibility for the security of personal devices including loss, theft, or damage.
   5. The Chief Information Officer, supported by the Chief Information Security Officer (“CISO”), is responsible for implementation and enforcement of this Standard. Information Technology Services (“ITS”) is responsible for University Authentication systems, verifying Authentication credentials provided, troubleshooting Authentication issues, and performing vulnerability scans of the Campus Network. ITS is not responsible for configuring use of personal devices to connect to University Technology Resources.
   6. Pursuant to the Campus Network Standard, ITS is responsible for deploying all Campus Network infrastructure including wireless access points and routers.

2. Personal Device Use

   1. Individuals who elect to utilize a personal device to access University Technology Resources, whether for personal use, University business, on University time, or during business travel must:
      1. Abide by the Acceptable Use of Technology Resources and Data Policy;
      2. Maintain and backup the personal data stored on the device;
      3. Ensure the physical security of the device to prevent loss, theft, and/or damage;
      4. Report lost or stolen devices that contained University Data; and,
      5. Ensure the device meets the security requirements identified within Section 3 of this document.
   2. A personally owned device must never disrupt use or function of the Campus Network and/or the University Information System to which it is connected. The University will ban or prevent any device from accessing the Campus Network that continually causes disruptions to University Technology Resources.
   3. The device owner must change their WVU Login password immediately when a personal device that has access University Data is lost or stolen.
   4. Pursuant to Identity and Access Management Policy, Authentication is required before a device will be permitted to access the Campus Network.
   5. Personally owned devices must never be used as a University server or networking device, including use as a router or hotspot to connect other University Technology Resources to the Campus Network.
   6. Personally owned devices must never be used in order to circumvent security controls put in place by ITS.

3. Device Security

   1. To prevent others from obtaining unauthorized access, device must remain under the owner’s Effective Control at all times.
   2. All devices that connect to University Technology Resources and/or access University Data must meet the following security requirements:
      1. Employ an active form of access protection such as a passcode, passphrase, facial recognition, or fingerprint;
      2. Passwords/passphrases must meet the minimum requirements identified within the Password Standard;
      3. Have an anti-virus software installed and running Real-Time Scanning and/or scan the device regularly to prevent, detect, and remove malware. The University provides free anti-virus at https://freeav.wvu.edu;
      4. Be configured to lock or logout and require a user to re-authenticate if left unattended for more than 15 minutes. Devices that do not support this capability must be secured alternatively such as restricting access in a locked room;
      5. Run a Supported Operating System that is patched and updated regularly; and,
      6. Be configured to allow the owner to Remote Wipe in the event the device is lost or stolen. Devices that do not support Remote Wipe functionality must be encrypted.
   3. Devices that are Jailbroken, Rooted, or have been subject to any other method of changing built-in protections must not be used to access University Technology Resources.
   4. Device must support WPA2 and AES to connect to WVU.Encrypted.

4. Conducting University Business

   1. Pursuant to the Acceptable Use of Technology Resources and Data Policy, the University provides the use of University Technology Resources, including Devices, which must be used by Authorized Individuals as the primary means to create, store, send, or receive University Data.
      1. De minimis use of personally owned devices is permitted to access University Data and/or conduct University business provided the device meets the security requirements identified within Section 3 of this Standard.
      2. Use of a personal device as the primary means to create, store, send, or receive University data is prohibited.
      3. Employees who access Sensitive Data for their job must primarily use a University Device. If a University Device is not available, a personally owned device may be used only if it has been pre-approved by the CISO and is utilizing an approved University remote access solution to access Sensitive Data. See Remote Access Standard.
   2. Software licensed to the University must never be downloaded to a personally owned device unless specifically permitted by the license (e.g., Microsoft Office).
   3. University Data subject to document requests (e.g., Freedom of Information Act or Family Educational Rights and Privacy Act) or document production (e.g., warrants, subpoenas, court orders) stored on a personally owned device must be produced upon the request of the University.
   4. Any University Data downloaded to a personally owned device must be destroyed, removed, or returned to the University once the individual:
      1. Is no longer employed by the University;
      2. No longer requires access to the University Data due to changing job responsibilities; or,
      3. Is no longer the owner or primary user of the device.

5. Exceptions

   1. Anti-virus software is not required to be installed on mobile devices such as cell phones and tablet computers.

6. Definitions

   1. “Authentication” means verifying the identity of a user, process, or device to allow access to a University Technology Resource.
   2. "Effective Control” means when a traveler either retains physical possession of the device or secures the device in an environment such as a hotel safe, a bonded warehouse, or a locked and guarded exhibition facility.
   3. “Jailbroken” means the process of modifying an iOS device such as an iPhone, iPad, or iPod Touch to bypass restrictions imposed by Apple to allow owner to modify the operating system, install non-approved applications, and grants the user elevated administration-level privileges.
   4. “Real-Time Scanning” means the anti-virus software is always on and checks files in real time when they are created, opened, or copied.
   5. “Remote Wipe” means a security feature that allows data on a device be deleted without physically possessing the device.
   6. “Rooted” means the process of allowing Android users to attain privileged control over subsystems to alter or replace system applications and settings, run specialized applications that require administrator-level permissions, or perform other operations that are otherwise inaccessible to a normal Android user.
   7. “Supported Operating System” ” means the entity providing the OS, be it a vendor, open source, or an individual, is actively and routinely providing and deploying patches and security updates for the OS.
   8. “University Data” means anything that contains information regarding the University made or received in connection with its operations, regardless of whether it is a hard copy or electronic, and includes, but is not limited to, written and printed matter, books, drawings, maps, plans, photographs, microforms, motion picture films, sound and video recordings, e-mails, computerized or other electronic data on hard drives or network drives, or copies of these items. See Record Retention Policy and Schedule.
   9. “University Technology Resources” means University-owned hardware, software, and network/communications equipment, technology facilities, and other relevant hardware and software items, as well as personnel tasked with the planning, implementation, and support of technology. University Technology Resources can be broken into the following categories:
      1. Campus Network means the wired and wireless components and University Technology Resources connected to the network managed by the University. Excludes residence halls, University public/private partnerships, and other relationships the University may establish with institutions, including the City of Morgantown and WVU Medicine, through which the University provides IP addresses but does not manage the network.
      2. Device means a server, computer, laptop, tablet, or mobile device used to enter or access University Data from a University Information System.
      3. University Information System means an application or software that is used to support the academic, administrative, research, and outreach activities of the University, whether operated and managed by the University or a third-party vendor.

7. Related Documents

   1. Password Standard
   2. Sensitive Data Policy
   3. University-Owned Device Standard
   4. Identity and Access Management Policy
   5. Identity and Authentication Management Standard
   6. Remote Access Standard