Page History

Direct Connect (non-person)IDs
Apllication Integration IDs Accessing Restricted Data
  
Context:

...

1. Annual certification acknowledging requirements and responsibilities
2. A description of data use and application purpose must be included in the request for the Direct Connect ID.  The Central Data Stewards must approve data access as well as specified use of the data prior to the Direct Connect account creation.
3. Direct Connect IDs must be tied to only one specific service and must never be reused or shared.   
4. The Direct Connect ID owner must ensure that there are no confidential data stored or delivered through the developed application.
5. If Student data are retrieved, FERPA protection requirements set forth by the University Registrar must be met.  Please review FERPA policy and related FAQ documents at (http://www.policy.cornell.edu/vol4_5.cfm^{Image Removed})
6. End user authentication must be performed by the application using the Cornell central authentication infrastructure where possible.  If integration into the central authentication infrastructure is not possible, local authentication is permissible provided a unique user ID and password are provisioned for each user. 
7. Service owners MUST ensure access is granted to data only which the user is authorized
8. Service owners must provide quarterly reports detailing service users to the appropriate Data Steward 
9. The application or database infrastructure must meet the security requirements specified in University Policy 5.10 Information Security of Institutional Data (http://www.cit.cornell.edu/security/requirements/secreqs-baseline.html^{Image Removed})
10. Local audit logs must be retained for six months
11. Audit logs must contain
    1. Date and time of access
    2. NetID of end user accessing the database
    3. IP address of end user accessing the database
12. The Direct Connect ID Owner must request termination of the ID when use of the ID is no longer needed.
13. If access needs change and additional tables are needed, the ID owner must obtain appropriate Data Steward approval for the new table access.