FAQ

Click questions to expand answers.

ISPO Services

The ISPO utilizes self-service intake services using University’s enterprise ticketing system Help.UNM, and phone and in-person intake services from the UNM IT Service Desk, the University's central support organization for IT-related services and computer-related issues. All information security or privacy related events and incidents, and service requests are forwarded to ISPO by Service Desk staff.
  • Privacy, Compliance, and Risk Services
    • Contract Review
    • Data Sharing Agreement Review
    • Institutional Review Board (IRB) Review
    • PCI Compliance
    • Other Privacy, Compliance, and Risk Services
  • Information Security Services
    • Continuous Vulnerability Monitoring
      • Application Access Requests
      • Application Maintenance and Support Requests
    • Event Management
    • Digital Forensics
    • Firewall Change Requests
    • Incident Response Services
      • Information Security Incident Response Services
        • Minor Incidents
        • Major Incident
    • Information Request
    • Operational Intelligence
      • Event Management
      • Event Log Analysis
    • Penetration Testing
      • Network Vulnerability Penetration Test
      • Web Applications Penetration Test
    • Vulnerability Assessment(s)
      • Network Vulnerability Assessment
      • Web Applications Assessments
    • Other Information Security Request
The ISPO utilizes the University’s enterprise ticketing system Help.UNM and intake services provided by the UNM Information Technologies (UNM IT) Service Desk, the University's central support organization for information technology-related services and computer-related issues.  All information security-related events, incidents, and requests are forwarded to the ISPO by UNM IT Service Desk staff.  Please use Help.UNM or call the UNM IT Service Desk at 7-5757 to ensure that your request is opened, tracked, and processed in a timely manner.  Requests submitted via email or channels not monitored by the IT Service Desk staff cannot be processed.

Information Security Services

NOTICE: The ISPO requires several pieces of information to process an Application Access Request and we recommend you thoroughly review all of the information below.

Continuous Vulnerability Monitoring Service for Networks (CVMS-N) - Application Access Request


About this Service

The UNM Information Security & Privacy Office (ISPO) is responsible for the development and maintenance of the Information Security Program and designing and maintaining information security technologies and services in the interest of supporting the University’s overall mission of engaging faculty, students, and staff in its educational, research, and service programs.  The Continuous Vulnerability Monitoring Service for Networks (CVMS-N) supports the Vulnerability Management Program, a component of the Information Security Management System (ISMS) a framework for maintaining the University’s Information Security Program.

The CVMS-N is powered by solutions from Tenable Security (Nessus Vulnerability Scanners + Nessus Manager).  Nessus is a best of breed enterprise grade vulnerability monitoring solution provided as a service by the ISPO’s Information Security Operations area.  Nessus utilizes network port scanners to perform periodic recurring vulnerability assessments to examine the University's internal and external network attack surfaces.  Nessus features include high-speed asset discovery, configuration auditing, target profiling, malware detection, sensitive data discovery and vulnerability analysis.  The availablility and effectiveness of the listed features are dependent on the scan method being utilized.

The CVMS-N is designed to support all IT environments including those supported by enterprise and departmental units located on Main, North, South, and Branch campuses (Gallup, Los Alamos, Taos, and Valencia).  Departments affiliated with the Health Sciences Center (HSC) are encouraged to contact the HSC’s Information Security Office to determine what network vulnerability monitoring services are available for HSC environments.

Basic application access, and vulnerability monitoring configuration and maintenance is provided to all IT support units at no-cost.  Custom maintenance and support requests may result in a small fee in circumstances where additional physical hardware or software licenses are required to support such requests.

Controlled Unclassified Information Notice

RESTRICTED INFORMATION

Information contained within the ISPO's CVMS-N is subject to enhanced safeguarding, as unauthorized disclosure could place UNM at risk for data exfiltration or other malicious activities.  Vulnerability information may only be stored in ISPO-designated UNM-owned services.  This information may only be shared with authorized University staff (i.e. Data Owners, Data Steward, Data Custodians, or Data Users) who are directly responsible for the specified system(s) or application(s).

Intake Process

The ISPO utilizes the University’s enterprise ticketing system Help.UNM and intake services provided by the UNM Information Technologies (IT) Service Desk, the University's central support organization for information technology-related services and computer-related issues.  All information security-related events, incidents, and requests are forwarded to the ISPO by UNM IT Service Desk staff.  Please use Help.UNM to ensure that your request is opened, tracked, and processed in a timely manner (refer to FastInfo 7263 -  How do I submit a request for service to IT using Help.UNM self-service? for general instructions on how to open a self-service request).  Requests submitted via email or channels not monitored by the IT Service Desk staff cannot be processed.

IT staff with internal access to Cherwell ITSM must select the appropriate Record Type, Service Request Type, and Category, when generating a record, and must use the appropriate workflow when creating tasks for Cherwell teams.  Additionally, IT staff are required to provide all the information outlined in the Request Details tab which mirrors the ‘Required Information’ section below.  Requests that are not appropriately generated within Cherwell will be summarily cancelled/denied.

Required Information

In order to submit an application access request for CVMS-N, the requestor must provide the following information (at minimum):

  • IT Role:
  • Name:
  • NetID:
  • Privileged Account:
  • Supervisor’s Name:
  • Supervisor’s NetID:
  • Justification:

Tickets that do not include the above referenced information in the specified format cannot be processed.

IT Roles (Job Description)

Please reference the following list of UNM Human Resources-defined IT roles (job descriptions) when submitting your request:

Office of the Chief Information Officer Staff

  • Chief Information Officer (CIO)
  • Deputy Chief Information Officer (Deputy CIO)
  • Information Security & Privacy Officer (Info Security Ofcr)

IT Directors, Associate IT Directors, and IT Officers

  • Director of Core Information Technology Services (Dir,Core IT Svcs)
  • Director of Information Technology Services (Dir,IT Svcs)
  • Associate Director of Core Information Technology Services (Assoc Dir,Core IT Svcs)
  • Associate Director of Information Technology Services (Assoc Dir, IT Svcs)
  • Information Technology Officer (IT Officer)

IT Managers, IT Supervisors, and IT Project Managers

  • Manager of Core Information Technology Services (Mgr,Core IT Svcs)
  • Manager of Information Technology Services (Mgr,IT Svcs)
  • Information Technology Project Manager 1-3 (IT Project Mgr 1-3)
  • Supv,Security & Alarm Systems

HPC Specialists, IT Specialists, IT Analysts, and IT Technicians

  • Core Information Technology Services Specialist (Core IT Svcs Splst)
  • Information Technology Services Specialist (IT Svcs Splst)
  • High Performance Computing Specialist 1-3 (HPC Systems Splst 1-3)
  • Systems/Network Analyst 1-3 (Systems/Network Analyst 1-3)
  • Technical Analyst 1-3 (Technical Analyst 1-3)
  • Security & Alarm Tech
  • Information Technology Support Technician 1-3 (IT Support Tech 1-3)

UNM staff requesting access shall have an appropriate UNM-defined information technology focused job description (position classification) or shall be responsible for managing HPC Specialists or IT Specialists, IT Analysts, or IT Technicians.  For more information about UNM’s Job Descriptions, please reference the UNM Human Resources Position Classification Description Listing website for more information. https://jobdescriptions.unm.edu/Requests submitted by UNM staff without an appropriate job description will be summarily denied.

NetID and Privileged Account

User Account and Email

Your user account must be your UNM NetID that is tied to your LoboMail account.  Departmental identities cannot be provisioned access to this service and departmental mail services cannot be used to receive notifications from Nessus Manager.  All UNM staff members are automatically provisioned a NetID and LoboMail account.

Privileged Account

Your privileged account must be a sanctioned privileged account (sometimes called a ‘service’ account) that has been provisioned in the centrally-managed Lightweight Directory Authentication Protocol (LDAP) service and synchronized with Active Directory Domain Services (AD DS) directory service, both services are provided at no-cost to all UNM departments by Information Technologies (IT).

Request Approvals and Mandatory Training

Approvals

Application Access Requests for CVMS-N must be approved by the requestor’s director, manager, or supervisor, and the ISPO’s Management staff.  Approvals will be submitted on behalf of the requestor via Help.UNM.  Please have your approver check for email from Help.UNM ( help@unm.edu).  Requests that do not receive the appropriate approvals cannot be processed.

Training

All IT staff requesting access to CVMS-N must attend a mandatory training before being provisioned access to this system.  Training includes educating IT staff of the institutional requirements outlined in the Vulnerability Management Program which include University-mandated timeframes for appropriately addressing identified vulnerabilities by severity and impact.  Additionally, a basic tutorial for how to authenticate and interact with CVMS-N, and the basics of interpreting vulnerability scan reports and the data contained therein is provided.

Responsibilities

ISPO (Information Security Operations)

The ISPO is responsible for designing and maintaining information security technologies and services including the Vulnerability Monitoring Service for Networks (CVMS-N), and for identifying areas where information assets are not adequately safeguarded.

IT (Enterprise and Departmental)

All IT units are responsible for appropriately deploying, configuring, and maintaining IT systems over the course of their lifecycle.  Appropriate system lifecycle management includes but is not limited to maintaining appropriate and consistent system update procedures that include patching system security vulnerabilities and making configuration changes when required to address identified vulnerabilities.  All IT units are responsible for adhering to appropriate change management procedures at all times.

Staff within IT units may not share system vulnerability information with individuals who are not in appropriate roles or who have responsibilities outside of their immediate workgroup who are not responsible for addressing identified issues.  Additionally, staff with access to the CVMS-N shall treat all data contained within the system as CUI.  For more information about CUI, please reference the ‘Controlled Unclassified Information – Restricted Information’ section above.

Maintenance and Support

Ongoing maintenance and support of this solution including creating, modifying, and disabling recurring scans, and troubleshooting existing scans can be requested via Help.UNM.  Please refer to the 'How do I request support' for the Continuous Vulnerability Monitoring Service (CVMS-N)'?

Questions and Feedback

If you have questions or feedback regarding this document or the CVMS-N, please use Help.UNM or call the IT Service Desk at 7-5757 to ensure that your information request or feedback request is opened, tracked, and processed in a timely manner.

NOTICE: The ISPO requires several pieces of information to process an Application Access Request and we recommend you thoroughly review all of the information below.
The ISPO utilizes self-service intake services using University’s enterprise ticketing system Help.UNM, and phone and in-person intake services from the UNM IT Service Desk, the University's central support organization for IT-related services and computer-related issues. All information security or privacy related events and incidents, and service requests are forwarded to ISPO by Service Desk staff.
Submit a request through Help.UNM or call the UNM IT Service Desk at (505) 277-5757
The ISPO utilizes self-service intake services using University’s enterprise ticketing system Help.UNM, and phone and in-person intake services from the UNM IT Service Desk, the University's central support organization for IT-related services and computer-related issues. All information security or privacy related events and incidents, and service requests are forwarded to ISPO by Service Desk staff.
Submit a request through Help.UNM or call the UNM IT Service Desk at (505) 277-5757
Submit a request through Help.UNM or call the UNM IT Service Desk at (505) 277-5757
Submit a request through Help.UNM or call the UNM IT Service Desk at (505) 277-5757
  • Please be advised, the ISPO requires several pieces of information to process this type of request
  •  

Privacy, Compliance, and Risk Services

Submit a request through Help.UNM or call the UNM IT Service Desk at (505) 277-5757.
Submit a request through Help.UNM or call the UNM IT Service Desk at (505) 277-5757
Submit a request through Help.UNM or call the UNM IT Service Desk at (505) 277-5757
Submit a request through Help.UNM or call the UNM IT Service Desk at (505) 277-5757
The ISPO utilizes self-service intake services using University’s enterprise ticketing system Help.UNM, and phone and in-person intake services from the UNM IT Service Desk, the University's central support organization for IT-related services and computer-related issues. All information security or privacy related events and incidents, and service requests are forwarded to ISPO by Service Desk staff.
NOTICE: The ISPO requires several pieces of information to process a Purchasing Risk Assessment request and we recommend you thoroughly review all the information below.

Purchasing Risk Assessment

About this Service

The Purchasing Risk Assessment service is driven by the University’s Data Privacy, Regulatory Compliance, and Risk Management obligations as they apply to the main and branch campuses.  The purchasing risk assessment process is aimed at identifying risk as it applies to third-party access to the University’s information.  In certain scenarios where it is determined sensitive information covered by contractual obligations, University Administrative Policies, and/or regulatory requirements, is being collected, stored, transmitted, or otherwise processed, a review of the appropriate business agreement and the vendor’s privacy policies and information security controls will be required.  Similarly, on-premises use of third-party solutions or services may also require a further review of the in-scope system and of the respective vendor.  Sensitive information includes, but is not limited to, Controlled Unclassified Information (CUI), Personally Identifiable Information (PII), or Credit Card Information (PCI-DSS).

Procurement requests involving Purchasing Cards (PCards), Contracts, Requests for Proposal (RFPs), and other procurement methods shall be reviewed by appropriate enterprise or departmental information technology staff and the UNM Information Security & Privacy Office (ISPO).  The University’s vendors are required to meet the contractual and regulatory obligations for the sensitive information they will have access, including, but not limited to:

  • Banner ID (FERPA/HIPAA Identifier);
  • Credit Card Information (regulated by the Payment Card Industry);
  • Direct Deposit information (regulated by Federal Trade Commission);
  • Institutional Review Board (IRB) activities;
  • Protected Health Information (PHI) (regulated by Health Insurance Portability and Accountability Act – HIPAA);
  • Social Security Number (SSN) (regulated by Federal Privacy Act of 1974);
  • Student Grades and other academic records (regulated by Family Educational Rights and Privacy Act – FERPA);
  • Student Loan information (regulated by Gramm Leach Bliley Act - GLBA)

Refer to University Administrative Policies 2000, 2030, 2520, 2550 and 2580 for additional information.

Healthcare/HIPAA related requests for the Health Sciences System (HSC) are reviewed by the HSC Information Security Office (HSC ISO).  Please contact HSC-ISO for more information.

The purpose of a purchasing risk assessment is to ensure information for which the University is entrusted is adequately safeguarded.

Intake Process

The ISPO utilizes the University’s enterprise ticketing system Help.UNM and intake services provided by the UNM Information Technologies (IT) Service Desk, the University's central support organization for information technology-related services and computer-related issues.  All information security-related events, incidents, and requests are forwarded to the ISPO by IT Service Desk staff.  Please use Help.UNM to ensure that your request is opened, tracked, and processed in a timely manner.  Requests submitted via email or channels not monitored by the IT Service Desk staff cannot be processed.

IT staff with internal access to Cherwell IT Service Management (Cherwell ITSM) must select the appropriate Record Type, Service Request Type, and Category, when generating a record, and must use the appropriate workflow when creating tasks for Cherwell teams.  Additionally, IT staff are required to provide all the information outlined in the ‘Required Information’ section below.  Requests that are not appropriately generated within Cherwell, or that do not include the minimum required information will be summarily cancelled/denied.

Please note, by the end of 2020 the intake for this service will be migrated away from Help.UNM to a Banner ERP workflow.  Please periodically review this document to recieve notification of the planned change.

Required Information

Privacy & Security Questionnaire (PSQ)

All Purchasing Risk Assessment requests must include an electronically completed and Privacy & Security Questionnaire (PSQ), specifically the version intended for the UNM Purchasing Department.  All PSQs submitted during the purchasing risk assessment process must be reviewed and submitted by an applicable IT Officer or IT Liaison, or in some cases an IT Manager through Help.UNM.  For more information, please reference the ‘Intake’ section above.

In the Privacy & Security Questionnaire (PSQ), the requestor will be asked:

  • Who is the business process owner the information or information system is intended to support;
  • What is the applicable Purchasing Order (P.O.), Request for Quotes (RFQ), Request for Information (RFI), or Contract Number;
  • What is the name of the vendor as well as the goods or services being procured;
  • What is the request type (new, update, renewal);
  • What information is being collected, stored, transmitted or processed;
  • How the information or information systems will be used;
  • The academic, administrative, or research purpose for the information or information systems;
  • What individuals or groups will need to access the information or information systems;
  • What locations where the information or information systems will be deployed;
  • What locations from which to access the information or information system(s) is needed;

Data Owner or Data Steward Approval

In all scenarios involving sensitive information, written approval from the appropriate Data Owner or Data Steward must be obtained and submitted in the Help.UNM ticket.  For questions regarding Data Stewards, please see the UNM Data Governance site located at this linkPlease ensure the applicable Data Owner or Data Steward has provided their approval for your procurement request before starting the procurement process and before submitting a Purchasing Risk Assessment request.

Business Agreement(s) and Vendor's Privacy Policies

In all scenarios involving sensitive information, the ISPO shall review applicable business agreement(s) between the University and vendor, and the vendor's information privacy policies and procedures.  At the end of the contract period, vendors must certify in writing that all UNM data was either returned to UNM in a form agreed to by UNM, or that all UNM information was destroyed.  Please ensure that you have attained the appropriate documentation before submitting a Purchasing Risk Assessment request.

Higher Education Community Vendor Assessment Tool (HECVAT)

In all scenarios involving sensitive information, the ISPO may need to review the information security policies and procedures of the vendor.  Additionally, a review of specific safeguards must be completed to comply with regulatory requirements.  In such cases, the vendor must complete the Higher Education Community Vendor Assessment Tool (HECVAT).  Please ensure you have attained the vendor completed HECVAT from your vendor before submitting a Purchasing Risk Assessment request.

Social Security Number Collection Reporting Worksheet (SSNCRW)

In all scenarios involving third-party (vendor) access to SSN, the requestor is required to submit a completed Social Security Number Collection Reporting Worksheet (SSNCRW).  In such cases, the appropriate IT Officer, IT Liaison, or IT Manager must complete the SSNCRW.

Workflow

1. Purchasing Agents shall contact their area’s appropriate IT Officer, IT Liaison, or IT Manager to assess a proposed purchase and collaboratively complete a Privacy & Security Questionnaire (PSQ) with their IT contact.  If and where necessary/required, the IT contact will know whether to collect additional information (i.e. Data Owner or Data Steward approval, business agreements, vendor privacy policies, vendor-completed HECVAT, department-completed SSNCRW, etc.).

NOTE: The IT contact is responsible for collecting all necessary information before submitting a request.

2. IT Officers, IT Liaisons, or IT Managers shall submit a Purchasing Risk Assessment request through Help.UNM after collecting all the necessary information outlined in the ‘Required Information’ section above.
3. Data Owners or Data Stewards shall review proposed procurements that involve the data they are responsible for and shall provide written authorization to use said information (if necessary/required).
4. The ISPO’s Privacy, Compliance, and Risk area shall review electronically completed PSQs and ensure all appropriate documentation has been submitted.
5. The ISPO’s Information Security Operations shall review the vendor's information security policies, procedures, and controls (if necessary/required).

Responsibilities

Purchasing Agents

Purchasing Agents are responsible for thoroughly reviewing this document and for coordinating communication between the departmental contact responsible for the business process a proposed procurement supports and the appropriate IT Officer, IT Liaison, or in some cases IT Manager.

IT Officers, IT Liaisons, and IT Managers

UNM-designated IT Officers, IT Liaisons, and in some cases IT Managers are responsible for thoroughly reviewing this document, coordinating responses to the Privacy & Security Questionnaire (PSQ), collecting additional documentation if required (i.e. Data Owner or Data Steward approval, business agreements, vendor privacy policies, vendor-completed HECVAT, department-completed SSNCRW, etc), and for submitting a request on behalf of the applicable Purchasing Agent via Help.UNM.

Data Owners and/or Data Stewards*

UNM-designated Data Owners or Data Stewards are responsible for appropriately reviewing proposed procurements that involve all data they are responsible for.

ISPO - Privacy, Compliance, and Risk

The ISPO's Privacy, Compliance, and Risk area is responsible for reviewing all electronically completed PSQ's submitted through Help.UNM, and where applicable reviewing additional documentation and contacting the ISPO's Information Security Operations team in the event a review of the vendor's information security policies, procedures, and controls is required.

ISPO - Information Security Operations*

The ISPO's Information Security Operations area is responsible for reviewing the vendor's information security policies, procedures, and controls if required.

 *These areas are only engaged in limited scenarios   

Questions and Feedback

If you have questions or feedback regarding this document or the Purchasing Risk Assessment service, please use Help.UNM or call the IT Service Desk at 7-5757 to ensure that your information request or feedback request is opened, tracked, and processed in a timely manner.  The IT Service Desk will forward your request to ISPO staff.

Malware & Hacking

  1. Gather information about the event including the following: 
    • Date and time of the event
    • Location of the event
    • How you suspect the event may have occurred
  2. Isolate the affected machine by disconnecting the machine from a network (either wired or wireless), but do not power-off the machine, volatile (and valuable) data will be lost of the machine is powered-off
  3. After you have collected the relevant information, report the event by opening a Help.UNM ticket and by calling the ISPO on-call number (505) 277-2497
  1. First, disconnect from the network by turning off Wi-Fi and unplugging Ethernet
  2. Then, contact the IT Service Desk for help at (505) 277-5757
Make sure you have all important and/or security-related operating system updates and an up-to-date antivirus program installed, then scan your machine with that antivirus program. More often than not however, you should reinstall your operating system to be certain that the compromise is eradicated.

NetID Issues

To regain access to your account, please contact the UNM IT Service Desk. The IT Service Desk is the University's central support organization for IT-related services and computer-related issues, and can be reached at (505) 277-5757.
UNM IT Customer Support Services hours can be found in FastInfo #3351: What are the hours of operation for IT Customer Support Services?
Immediately change your NetID password at https://netid.unm.edu or by calling the UNM Information Technologies (IT) Customer Service Desk at (505) 277-5757
Non-hyperlinked format (copy and paste into your URL bar): https://netid.unm.edu

Email Issues

  1. Do not reply to the sender
  2. Forward the email as an attachment to spamdrop@unm.edu
  3. Delete the email  
  1. First, check the Phish Bowl for examples of phishing emails and to see if the ISPO has already taken action
  2. Then, forward the email as an attachment to  spamdrop@unm.edu and Cc security@unm.edu
In Outlook for Windows: In the Home tab section titled, “Respond”, click “More” > click “Forward as Attachment”
In Outlook for Mac: Right click the phishing message in your inbox > point to “Forward Special” > click “As Attachment”
In Outlook Webmail: Click “New” to create a new email, then click and drag the phishing message to the new message
In Apple Mail: Right click the phishing message in your inbox > click “Forward As Attachment”

Other

Please send your questions to security@unm.edu
To properly track your Information Request, a ticket will be opened on your behalf.  In such an occurrence, all follow-up communication and correspondence will be handled through the address help@unm.edu

Report an Incident

If you suspect that your NetID (i.e. LoboMail account) or a computer have been compromised and you need to know what to do, please see our FAQ

Abuse Report Form

- or - 

Help.UNM Self Service

- or -

security@unm.edu

- or -

+1 (505) 277-2497

- or -

UNM EthicsPoint


For more information, visit our Contact Information page