Skip to main content Skip to main navigation Skip to footer content

Information Security

CSU and Fresno State Policies

Statement

California State University, Fresno complies with the provisions of the Digital Millennium Copyright Act (DMCA). If you have a concern regarding the use of copyrighted material on any site on the California State University, Fresno network, please contact the agent designated to respond to reports alleging copyright infringement.

Designated Agent

The designated agent for the California State University, Fresno campus to receive notification of claimed infringement under Title II of the DMCA is:

Designated Agent:
Rafael Villegas
Information Security Officer
Information Technology Services
email: dmca@listserv.csufresno.edu 
Telephone:  559-278-3923
Fax:        559-278-4660
  
Fresno State 
Information Technology Services
2225 East San Ramon Avenue
Mail Stop MF93
Fresno, CA.  93740-8029

Claims

The DMCA specifies that all infringement claims must be in writing (either electronic mail or paper letter) and must include the following:

  • A physical or electronic signature of the copyright holder or a person authorized to act on his or her behalf;
  • A description of the copyrighted work claimed to have been infringed, or, if multiple copyrighted works at a single online site are covered by a single notification, a representative list of such works at that site;
  • A description of the material that is claimed to be infringing or to be the subject of infringing activity, and information reasonably sufficient to permit the service provider to locate the material;
  • Information reasonably sufficient to permit the service provider to contact you, such as an address, telephone number, and, if available, an electronic mail address;
  • A statement that you have a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law; and
  • A statement that the information in the notification is accurate, and under penalty of perjury, that you are authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.

Have you received a notice from our Security Office concerning alleged copyright infringement? If you have, you are required to read the following information.

If you have not received a notice, we strongly recommend that you read this information to ensure you understand how to avoid violating copyright law. Violations could result in you losing your campus wireless access .

  • Why did I receive a copyright infringement notice?
    • You received a notice because our logs indicated that your username was logged on when the alleged infringement occurred.
  • Who is monitoring my internet activity?
    • Copyright infringement agencies track infringement by looking at network traffic to find violators. Fresno State does not monitor your network activity.
  • Why does Fresno State send students notices?
    • Fresno State is required by law to send students notices informing them that they have been identified as allegedly being involved in copyright infringement.
  • What is Copyright Infringement?
    • Copyright infringement is downloading or sharing songs, movies, software and games without the permission from the owner. If you are not sure you have the right to access or download a particular title, don't do it.
    • As a general matter, copyright infringement occurs when a copyrighted work is reproduced, distributed, performed, publicly displayed, or made into a derivative work without the permission of the copyright owner.
    • It is against the law
    • It is against Fresno State's policy
    • It is an inappropriate use of our network resources
  • How can copyright infringement occur?
    • Example 1 - Unintentional
      (Against our policy and illegal)
      • You are sitting in the student union and decide to connect to our network. While you are checking your email, someone is downloading a file from your laptop - which is in a folder that is associated with the installed peer-to-peer application. A copyright enforcement agency records the IP address and notifies Fresno State. We look in our logs and identify the student. We send you a notice. The fact that you are on a wireless network gives you no protection from these agencies.
    • Example 2 - Intentional or willful
      (Against our policy and illegal)
      • You hear about a new movie that came out. You get on the wireless network .You open your peer-to-peer client and search for the movie. You find the movie. You assume you can download it because "everyone else is". You think you will not get caught because you are on a wireless network. One week later we receive a notice about the infringement. We send you a notice.
    • Example 3 - Someone using your username and password
      Do not share your password with anyone
      • If you have given your password to someone, please reset it immediately at https://password.csufresno.edu/
        (Against our policy and illegal)
        When you enrolled at Fresno State, you created a username and password. You shared these credentials with your friend. Now your friend logs into the wireless network using your username and password. He/she starts downloading movies. A few days later we receive a copyright notice associated with your account. Even though you did not do this yourself, you will still be responsible because it is your username that will be identified in our logs.
  • Who is responsible for the infringement?
    • You are responsible for all notices we receive concerning your account - even if it is unintentional. This is why it is so important to remove the peer-to-peer software from your laptop.
  • What are the consequences?
    • You risk being sued by the copyright enforcement agency and it puts Fresno State at risk also. Some students at other universities have paid as much as $3,000 per title. (As a settlement before court)
    • Students can be sued for each violation from $750 - $150,000 depending on the copyrighted material and whether the violation was willful or not.
    • You may lose your wireless access .
      • Wireless connectivity allows students to connect anywhere on campus. If you lose your wireless access because of copyright infringement, it will be more difficult to get your school work done. If your wireless access is disabled, you may lose it for the remainder of the semester.
  • Definitions
    • Copyright Enforcement Agency
      • Organization that is hired by a copyright owner to find users on the network illegally sharing copyrighted material.
    • Peer-to-Peer Software
      • Peer-to-peer software is what is used to share files. Here are some examples;
        Bittorrent, Limeware, Shareaza, Kazaa, iMesh, Bearshare Lite, eMule, KCeasy, Soulseek, WinMX, Piolet, Gnutella, Overnet, Azureus now called as Vuze, FrostWire, uTorrent, Morpheus, ANts, Acquisition
        All of these programs may have the ability to automatically allow files to be shared when you turn on your computer - whether you are aware of it or not. It is strongly recommended that you remove these programs to avoid unintentional file sharing.
    • Actively downloading
      • Intentionally downloading unauthorized copyrighted material
    • Passively allowing downloading
      • Allowing a remote user to download unauthorized copyrighted material from your computer because your peer-to-peer program starts automatically without your knowledge

If you were directed by our Security Office to go to this website due to receiving a second copyright infringement notice, please send email to igetitcopyright@csufresno.edu to confirm that you now understand our copyright policy and the consequences for non-compliance. If you do not respond, your wireless access will not be re-enabled.

This page is based on the campus' Acceptable Use Policy.

Please visit the California State University page to get more information.

CSU Info. Security Policy and Standards
Section CSU Policy Standard Summary
8000.0 Introduction and Scope   The CSU Information Security policy provides direction for managing and protecting the confidentiality, integrity and availability of CSU information assets. In addition, the policy defines the organizational scope of the CSU information Security Policy.
8005.0 Policy Management   The CSU Information Security Management Department shall be responsible for overseeing a documented annual review of this policy and communicating any changes or additions to appropriate CSU stakeholders. The CSU Information Security policy shall be updated as necessary to reflect changes in the CSU 's academic, administrative, or technical environments, or applicable laws and regulations.
8010.0 Establishing an Information Security Program   Each campus President and the Assistant Vice Chancellor for Information Technology Services are responsible for the establishment and implementation of an information security program that contains administrative, technical and physical safeguards designed to protect campus information assets. Each campus information security program must implement a risk-based, layered approach that uses preventative, detective, and corrective controls sufficient to provide an acceptable level of information security and must be reviewed at least annually. The campus information security program reviews must be documented. 
8015.0 Organizing Information Security  CSU 8015.S000 Each campus must develop, implement, and document the organizational structure that supports the campus’ information security program. The organizational structure must define the functions, relationships, responsibilities, and authorities of individuals or committees that support the campus information security program. The governance structure must be reviewed at least annually. 
8020.0 Information Security Risk Management   Risk management involves the identification and evaluation of risks to information security assets (risk assessment) and the ongoing collection of information about the risk (risk monitoring). Once a risk has been identified, campuses must develop and implement strategies to reduce the risk to acceptable levels (risk mitigation), s hare or shift the risk to another party (risk transference) or assume the identified risk (risk acceptance).
8025.0 Privacy of Personal Information   All users of campus information systems or network resources are advised to consider the open nature of information disseminated electronically and must not assume any degree of privacy or restricted access to information they create or store on campus systems. The CSU is a public university and information stored on campus information systems may be subject to disclosure under state law. No campus information system or network resource c an absolutely ensure that unauthorized persons will not gain access to information or activities. However, the CSU acknowledges its obligation to respect and protect private information about individuals stored on campus information systems and network resources. 
8030.0 Personnel Information Security CSU 8030.S000 All users are expected to employ security practices appropriate to their responsibilities and roles. Users who access level 1 or level 2 data as defined in the CSU Data Classification Standard must sign an approved system-wide confidentiality (non-disclosure) agreement.
8035.0 Information Security Awareness and Training CSU 8035.S000 Each campus must implement a program for providing appropriate information security awareness and training to employees appropriate to their access to campus information assets. The campus information security awareness program must promote campus strategies for protecting information assets containing protected data. All employees with access to protected data and information assets must participate in appropriate information security awareness training. When appropriate, information security training must be provided to individuals whose job functions require specialized skill or knowledge in information security.
8040.0 Managing Third Parties CSU 8040.S001 Third parties who access CSU information assets must be required to adhere to appropriate CSU and campus information security policies and standards. A s appropriate, a risk assessment must be conducted to determine the specific implications and control requirements for the service provided. 
8045.0 Information Technology Security

CSU 8045.S200

CSU: 8045.S300

CSU 8045.S301

CSU 8045.302

CSU 8045.400

CSU 8045.600

 Campuses must develop and implement appropriate technical controls to minimize risks to their information technology infrastructure. Each campus must take reasonable steps to protect the confidentiality, integrity, and availability of its critical as sets and protected data from threats.
8050.0 Configuration Management CSU: 8050.S100
CSU: 8050.S200		 Campuses must develop, implement, and document configuration standards to ensure that information technology systems, network resources, and applications are appropriately secured to protect confidentiality, integrity, and availability.
8055.0 Change Control CSU 8055.S01 Changes to information technology systems, network resources, and applications need to be appropriately managed to minimize the risk of introducing unexpected vulnerabilities and ensure that existing security protections are not adversely impacted. Campuses must establish and document a process to manage changes to campus information assets containing level 1 or level 2 data, as defined in the CSU Data Classification Standard.
8060.0 Access Control

CSU 8060.S000

CSU 8060.S000 Appendix A

 The CSU Information Security policy provides direction and support for managing access to CSU information assets and guidance for: granting access to CSU information assets; separating duties of individuals who have access to CSU information as set; conducting reviews of access rights to CSU information assets; and modifying user access rights to CSU information assets.
8065.0 Information Asset Management

CSU 8065.S001

CSU 8065.S02

CSU: 8065.S003 

 Each campus must develop and maintain a data classification standard that meets or exceeds the requirements of the CSU Data Classification Standard. Campuses must maintain an inventory of information assets containing level 1 or level 2 data as defined in the CSU Data Classification Standard. These assets must be categorized and protected throughout their entire life cycle, from origination to destruction.
8070.0 Information Systems Acquisition, Development and Maintenance CSU 8070.S000 Campuses must integrate information security requirements into the software life cycle of information systems that contain protected data. The security requirements must identify controls that are needed to ensure confidentiality, integrity, and availability. These controls must be appropriate, cost-effective, and mitigate risks that may result from unauthorized access, us e, dis closure, disruption, modification, or destruction of the protected data.
8075.0 Information Security Incident Management CSU 8075.S000 Campuses must develop and maintain an information security incident response program that includes processes for investigating, res ponding to, reporting, and recovering from incidents involving loss, damage, misuse of information assets containing protected data, or improper dissemination of critical or protected data, regardless of the medium in which the breached information is held or transmitted (e.g., physical or electronic). 
8080.0 Physical Security CSU 8080.S01 Each campus must identify physical areas that must be protected from unauthorized physical access. Such areas would include data c enters and other locations on the campus where information assets containing protected data are stored. Campuses must protect these limited-access areas from unauthorized physical access while ensuring that authorized users have appropriate access. Campus information assets which access protected data that are located in public and non-public access areas must be physically secured to prevent theft, tampering, or damage. The level of protection provided must be commensurate with that of identifiable risks. Campuses must review and document physical access rights to campus limited-access areas annually.
8085.0 Business Continuity and Disaster Recovery   An information security program needs to support the maintenance and potential restoration of operations through and after both minor and catastrophic disruptions. Campuses must ensure that their information assets can, in the case of a catastrophic event, continue to operate and be appropriately accessible to users. Each campus must maintain an ongoing program that ensures the continuity of essential functions and operations following a catastrophic event. The campus program must be in compliance with the CSU Business Continuity Program.
8090.0 Compliance   The CSU Information Security Management Office s hall, in consultation with the CSU Office of General Counsel and other subject matter experts, regularly identify and define laws and regulations that apply to CSU information assets. The CSU Information Security Management Office s hall provide this information to campuses as it develops. Campuses must develop and maintain information security policies and standards that comply with applicable laws and regulations and the CSU policies that apply to campus information assets. The campus policies and standards must include monitoring controls that ensure ongoing compliance with applicable laws, regulations, and CSU policies.
8095.0 Policy Enforcement    
8100.0 Electronic and Digital Signatures CSU 8100.S01 It is the policy of the CSU to permit the use of electronic or digital signatures in lieu of handwritten signatures. Usage of electronic or digital signatures is at the option of an individual campus or the Chancellor’s Office provided they conform to the terms set forth in this policy. This policy does not pertain to facsimile signatures printed on checks issued by the CSU.
8105.0 Responsible Use Policy  

 The California State University (CSU) provides access to information assets for purposes related to its mission and to the responsibilities and necessary activities of its faculty, students and staff. These resources are vital for the fulfillment of the academic, research and business needs of the CSU community. This policy defines user (e.g., faculty, staff, students, third parties, etc.) and CSU responsibilities with respect to the use of CSU information assets in conjunction with the CSU Information Security Policy. 

The University, with input from Technology Services and campus stakeholders, has instituted a set of information security policies that govern the appropriate use of computer technology on campus. Please navigate through the individual policies to learn more about the appropriate usage for each area.

As part of our partnership with other offices on campus we have also included links to other campus policies.

Approved by IETCC December 11, 2003

Attacks on and intrusions into university electronic resources are continual, serious, and threatening. To prevent catastrophic damage to these resources (including the normal operation of telephone, email, internet, management systems, video, etc.), given the sophistication and speed of intrusive hardware and software, the university must have a capability to immediately address and respond to attacks and intrusions.

The Director of Technology Services (TS) or designee, having the responsibility to maintain and operate the campus infrastructure, has the authority to implement emergency security measures to protect campus electronic resources. These measures may involve shutting off or disconnecting portions of the campus network, blocking certain communication ports, implementing software and/or anti-virus updates, shutting down servers or workstations as a response to immediate threats or attacks to the campus electronic resources.

The Director shall notify senior administration of actions taken in emergency situations, as noted above, as soon as practical. Those units affected by such emergency actions shall be notified and consulted in a timely manner.

Download the printed version of this policy here.

1. Policy

California State University, Fresno requires devices connecting to the network to meet the minimum security baseline in order to protect devices. Devices connecting to the network must comply with the minimum security baseline before access to university information resources is granted.

2. Reason

The minimum security baseline safeguards protect the confidentiality, integrity, and availability of each individual device and other devices connected to the network by reducing the security susceptibility of every device.

3. Scope

All staff, faculty, and students of California State University, Fresno, guests, third parties, and any other entities connecting any device to the network are subject to this policy.

4. Minimum Security Baseline

All network connected devices able to must be configured to meet the minimum security baseline. The baseline security safeguards listed below are the minimum required to protect devices.

  • Anti-virus software must be enabled, running, and up-to-date on every device.
  • the built-in (native) firewall of a device or a more advanced firewall must be active. Firewall configurations must permit and allow for policy compliance verification.
  • Applications and operating system software running on devices must be a supported version.
  • the installation of relevant software updates, patches, or upgrades fixing critical or high security vulnerabilities of devices must be prompt.

5. Compliance

Users connecting devices to the network permit and consent to verification of compliance with this policy.

6. Exceptions

Users connecting devices to the network, which are unable to meet the requirements of this policy, must obtain an exception from the chair of STLT.

7. Enforcement

Devices are subject to disconnection from the network for infractions of this policy which put other devices at risk.

Download the printed version of this policy here.

The University, with input from Technology Services and campus stakeholders, has instituted a set of standards that provide requirements, specifications or characteristics on how to implement information security policy to secure campus information resources. Please navigate through the individual standards to learn more about the appropriate usage for each area.

Practices

The University, with input from Technology Services and campus stakeholders, has instituted a set of practices that describe the methods to implementing various information security standards and policies. Please navigate through the individual practices to learn more about the appropriate usage for each area.