Definitions

An export is any shipment or transmission of controlled technology out of the U.S. The term "deemed export" is commonly used to refer to the release of controlled information (as specified in the regulations) to a foreign national in the U.S. Under the regulations, such a transfer is deemed to be an export to the individual’s home country.

An individual who is an employee of one of the officially recognized University-related foundations.

Gift card scams are usually phishing emails that appear to come from someone you know, often somebody you think is important, such as supervisor or senior colleague or a family member with an emergency - asking if you can do them a favor  or give "urgent help".  It often starts with an email that says, "Available?". The email typically asks you to only use email to respond because the sender is occupied (in a meeting) and currently unable to take calls.  The scammer replies to the your response, asking you to purchase gift cards, scratch off the back to reveal the gift card codes, and send pictures of the cards to them via reply email.  The person promise to pay you back as soon as they are back in the office!  Don't fall for it. Those numbers on the back of a gift card let the scammer immediately get the money you loaded onto the card by purchasing it. And once they’ve done that, the scammers and your money are gone, usually without a trace.

Hardware token (sometimes called an authentication or security token) is a physical object, usually a small hardware device,  that the owner carries to authorize access to a restricted resource. The user's interaction with a login system proves that the user physically possesses a token specific and unique to that user. Examples include plugging a security token into the workstation or using a key fob or identity badge to swipe or hold up to an authentication device.

Highly sensitive data (HSD), as defined in the UVA Policy IRM-003: Data Protection of University Information, are: data that require restrictions on access under the law or that may be protected from release in accordance with applicable law or regulation, such as Virginia Code § 18.2-186.6. Breach of Personal Information Notification. Highly Sensitive data (HSD) currently include personal information that can lead to identity theft. HSD also includes health information that reveals an individual’s health condition and/or medical history.

Specific examples include, but are not limited to:

• Any store or file of passwords or user-ids and passwords on any multi-user system or computer.
• Personal information that, if exposed, can lead to identity theft. This may include a personal identifier (e.g., name, date of birth) as well as one of the following elements:
  • Social security number;
  • Driver’s license number or state identification card number issued in lieu of a driver’s license number;
  • Passport number;
  • Financial account number in combination with any required security code, access code, or password that would permit access to a financial account;
  • Credit card or debit card number, including any cardholder data in any form on a payment card: or
  • Military Identification Number.
• Health information is any information that, if exposed, can reveal an individual’s health condition and/or history of health services use, including information defined by Health Insurance Portability and Accountability Act (HIPAA) as protected health information (PHI).
• Cardholder Data (CHD):  Primary cardholder account number that identifies the issuer and a particular cardholder account, which can include cardholder name, expiration date and/or service code.

Note that credit card numbers can never be stored either alone or in combination with any other identifiers.

Also considered HSD are any form of personally identifying information in combination with social security number (SSN), driver’s license number, passport number, financial account number and required security code, and/or military ID number. For example, computing ID and driver’s license number, or home address and SSN.

A host-based firewall is firewall software that is installed directly on a computer (rather than a network) that controls incoming and outgoing network traffic in order to decide whether to allow that network traffic into the computer.  Sometimes called an "application-based" firewall.   Macintosh and Windows computers include host-based firewall protection as part of their operating system.   This type of firewall is a granular way to help protect the individual device from viruses and malware, and to control the spread fo these harmful infections throughout the network.

Incidental discovery is happening upon a vulnerability in an unplanned or circumstantial manner, not as part of a plan or intention to uncover or explore a vulnerability.

Individual-use electronic devices, as defined in the UVA Policy: IRM-003: Data Protection of University Information, are: electronic equipment, whether owned by the University or an individual, that has a storage device or persistent memory, including, but not limited to: desktop computers, laptops, tablets, smart phones, and other mobile devices.  For purposes of this policy, the term does not include shared purpose devices, such as servers (including shared drives), printers, copiers, routers, switches, firewall hardware, clinical workstations, medical devices (e.g., EKG machines), etc.

Individual-use electronic media, as defined in the UVA Policy: IRM-003: Data Protection of University Information, are: all media, whether owned by the University or an individual, on which electronic data can be stored, including, but not limited to: external hard drives, magnetic tapes, diskettes, CDs, DVDs, and any externally attached storage devices (e.g., thumb drives).

Any event that, regardless of accidental or malicious cause, results in:

• disclosure of University data to someone unauthorized to access it,
• unauthorized alteration of University data,
• loss of data which the University is legally or contractually bound to protect or which support critical University functions,
• disrupted information technology service, or
• a violation of the University’s information security policies, standards, or procedures.

Examples of such incidents include, but are not limited to:

• Malicious software installations on electronic devices that store University data not routinely made available to the general public, e.g., employee evaluations, or data the University is legally or contractually bound to protect, e.g., social security numbers, credit card numbers, Protected Health Information (PHI), research data.
• Loss or theft of electronic devices, electronic media, or paper records that contain University data not routinely made available to the general public or data the University is legally or contractually bound to protect.
• Defacement of a University website.
• Unauthorized use of a computing account or system.
• Use of information technology resources for unethical or unlawful purposes (incidents involving employees and pornography should be reported directly to Employee Relations (UVA HR).
• Contact from the FBI, Secret Service, Department of Homeland Security or other law enforcement organizations regarding a University electronic device that may have been used to commit a crime.