General Cybersecurity Policy

Cyber Security Policy – Najran University
Authority: Cybersecurity Administration
Reference: The National Cyber Security Agency
Version: 1.2
Date: 10/01/2022
Document Classification: Internal – Restricted

1. General Policy:
This policy aims to provide cybersecurity requirements based on best practices and standards related to documenting and adhering to cybersecurity requirements in Najran University, to reduce cyber risks and protect technical and informational assets from internal and external threats. This is achieved through focusing on the following main objectives:
- Information Confidentiality
- Information Integrity
– Availability of Information

This policy aims to comply with all regulatory requirements specific to Najran University, as well as relevant legislative and regulatory requirements, and to follow the national cybersecurity controls issued by the National Cyber Security Agency (ECC-1:2018).

2. Objectives:
1. Compliance with legal and regulatory requirements in addition to those of the National Cyber Security Agency.
2. Achieving the basic security controls (ECC-1:2018) issued by the National Cyber Security Agency.
3. Disseminating cybersecurity requirements and clarifying them for all university staff to ensure understanding and compliance.

3. Scope of Work and Applicability:
This policy applies to all information and technical assets at Najran University, including:
– Computers (desktop, laptop, and tablet).
– Network infrastructure and communication systems.
– Electronic platforms and applications.
– Databases and stored information.
– All devices or systems related to university digital activities.

This policy is the main reference for all cybersecurity policies and procedures related to the management of technical projects, human resources, suppliers, system change management, and other operations that affect the university’s information and technological assets.

4. Policy Elements:
The Cybersecurity Administration at Najran University must develop, review, and implement the following elements periodically:

4-1. Cybersecurity Policies Development:
– Establishing clear cybersecurity standards and policies based on risk assessment within the university.
– Obtaining approval of these policies from relevant regulatory bodies within the university and obtaining approval from the University Administration.

4-2. Cybersecurity Strategy (Cybersecurity Strategy):
Develop a comprehensive strategy aimed at protecting the technical and informational assets of Najran University.
– Including objectives, policies, executive policies, and elements related to governance and operations within the framework of the strategy.

4-3. Cybersecurity Roles and Responsibilities (Cybersecurity Roles and Responsibilities):
– Defining clear tasks and responsibilities for all parties involved in implementing cybersecurity controls within the university.
- Ensuring the existence of an organizational structure that performs ongoing surveillance, follow-up, and evaluation of cybersecurity effectiveness.

4-4. Cybersecurity Risk Management:
- Establishing a systematic program for identifying and assessing cybersecurity risks.
- Developing controls and procedures for managing risks according to priorities, ensuring the protection of technical and informational assets.

4-5. Cybersecurity in Technical Projects (Information Technology Projects in Cybersecurity):
- Integrating cybersecurity requirements into all system and application development projects at Najran University.
- Ensuring that projects comply with relevant legislation and regulatory policies and procedures.
- Following accredited methodologies for developing, testing, and securing systems before deploying them for operation.

4-6. Compliance with Regulatory Requirements and Cybersecurity Standards:
- Ensuring that the university’s cybersecurity programs comply with all relevant national laws and regulations.
- Monitoring legislative and regulatory changes and updating policies and plans as needed.

4-7. Cybersecurity Periodical Assessment and Audit Policy
– Conduct periodic reviews and audits to ensure the application of cybersecurity controls within the University.
– Document audit results and take corrective measures when deficiencies or vulnerabilities are identified.

4-8. Cybersecurity related to Human Resources:
– Ensure that faculty and staff at Najran University are aware of cyber security risks and how to handle them.
– Incorporate cybersecurity requirements into recruitment, training, performance evaluation, and promotion procedures.
– Enforce controls for visitor hosting and necessary security clearances before allowing access to sensitive sites.

4-9. Cybersecurity Awareness and Training Program:
– Develop a periodic training package aimed at raising security awareness among University employees.
– Include educational content about the most dangerous cyberattacks and methods for countering them.
– Measure the effectiveness of the training and update it regularly according to new developments and emerging threats.

4-10. Asset Management Policy:
– Prepare an accurate and up-to-date record of all information and technical assets at Najran University.
– Classify these assets according to their level of confidentiality and importance, and identify the responsible parties for them.
– Follow up on procurement procedures and safe disposal of expired or damaged assets.

4-11. Identity and Access Management Policy:
– Establish controls to define and manage digital identities of system users and authenticate access.
– Implement the principle of least privilege in granting access rights.
– Monitor login activities, record them, and analyze them to detect early attempts at intrusion or unauthorized use.

4-12. Information System and Processing Facilities Protection Policy:
– Enforce controls to protect computer systems (servers, workstations, processing devices) from cyber threats.
– Apply regular update and patching rules for systems and applications.
– Secure operating environments (Production, Staging, Development) to prevent security breaches.

4-13. Email Protection Policy:
– Implement email protection mechanisms such as filters, spam/malware detection systems, and encryption techniques when necessary.
Two-Factor Authentication (2FA) will be enforced for access to employee email accounts.
Training users on how to identify suspicious messages and report them.

4-14. Networks Security Management Policy:
Designing a network architecture that controls access and segregates sensitive departments within the university.
Implementing firewalls, Intrusion Detection Systems (IDS/IPS), and data encryption technologies (VPN, SSL/TLS).
Continuous monitoring of the network to detect anomalous activities and potential threats.

4-15. Mobile Devices Security Policy:
Enforcing security measures on mobile devices (smartphones, tablets, and laptops) when accessing university resources.
Implementing Mobile Device Management (MDM) solutions to secure and configure device settings.
Blocking the use of personal or bring-your-own-device (BYOD) devices unless approved by the Cybersecurity Administration and appropriate controls are implemented.

4-16. Data and Information Protection Policy:
Organizing the classification of sensitive data and encrypting it during transmission and storage according to international standards.
– Establishing controls for sharing information with internal and external parties to ensure its safety and confidentiality.
– Implementing periodic backup procedures and testing recovery measures to guarantee data availability in the event of disasters or incidents.

4-17. Cryptography Policy and Standards:
– Selecting internationally approved encryption algorithms and implementing them to protect confidential data.
– Managing encryption keys securely and documenting procedures for key lifecycle management.
– Documenting processes and procedures related to cryptography to ensure compliance with the University’s requirements and regulatory bodies.

4-18. Backup and Data Recovery Management Policy:
– Identifying and documenting backup procedures for databases and core systems serving the University.
– Testing recovery procedures (Disaster Recovery) periodically to verify system readiness in case of a disaster.
– Maintaining offsite, encrypted backups to ensure their security.

4-19. Vulnerabilities Management Policy:
– Conducting periodic scans of systems and applications using accredited tools to detect security vulnerabilities.
– Classify vulnerabilities based on severity level and apply appropriate patches within specified timeframes according to a defined schedule.
– Document test results and repairs, and track open requests until all vulnerabilities are completely closed.

4-20. Penetration Testing Policy and its Criteria:
– Conduct periodic penetration testing exercises to simulate real cyberattacks.
– Focus on critical assets (such as servers containing sensitive data or electronic payment systems).
– Issue a professional report that clarifies the identified weaknesses and technical recommendations for addressing them.

4-21. Cybersecurity Event Logs and Monitoring Management Policy:
– Collect cybersecurity event logs from all sources (firewalls, servers, intrusion detection devices).
– Analyze these logs to detect anomalous activity and potential threats.
– Maintain event logs within a secure archive and make them available for investigation when needed.

4-22. Cybersecurity Incident and Threat Management Policy:
– Develop an incident response plan that ensures the timely detection, identification, and containment of cybersecurity incidents.
– Compliance with Royal Decree No. 3714 dated August 14, 1438 AH in reporting and coordination mechanisms with relevant authorities.
– Providing technical and organizational measures to deal with the incident and securing affected systems.

4-23. Physical Security Policy:
– Protecting technical and information assets from theft and sabotage through the implementation of physical protection measures (locks, surveillance cameras, security guards).
– Identifying sensitive areas (server rooms, network rooms) and imposing security measures to access them.

4-24. Web Application Security Policy and Standards:
– Adopting web application security rules in accordance with international standards (OWASP Top 10).
– Conducting periodic security audits of the University’s electronic applications to prevent common vulnerabilities (such as SQL injection, XSS).
– Applying immediate remediation mechanisms for applications when any weakness or irregularity is detected.

4-25. Cybersecurity Resilience and Business Continuity Policy:
– Incorporating business continuity requirements into the University’s cybersecurity strategy.
– Preparing plans for rapid recovery and ensuring the continuity of electronic services in the event of disasters or incidents.
– Test these plans periodically to verify their effectiveness in handling sudden disruptions.

4-26. Cybersecurity Policy related to Third Parties and Cloud Computing:
– Assess the risks of using external services and outsourcing some technical services.
– Verify that external service providers comply with the University of Najran’s cybersecurity standards before signing contracts.
– Ensure that contracts include confidentiality clauses and define responsibilities when using cloud computing services.

4-27. Cybersecurity Policy related to Cloud Computing and Hosting:
– Secure cloud computing environments and hosting services used by the University.
– Implement security controls to ensure data protection during its transfer and storage with cloud service providers.
– Continuously verify that the service provider complies with relevant legislative and regulatory requirements.

4-28. Compliance with Evidence Collection (Cybersecurity Forensics and Evidence Collection):
– For cybersecurity management, the right to access information and collect necessary evidence for investigating incidents is reserved.
– Digital evidence and assets are handled in accordance with legal and regulatory procedures that ensure the integrity of the digital evidence supply chain.

5. Exceptions:
It is not permitted to exceed any of the cybersecurity policies and controls without obtaining prior formal approval from the Cybersecurity Administration, unless it conflicts with any relevant legislative or regulatory requirements.

6. Roles and Responsibilities: The roles and responsibilities related to cybersecurity for university employees:

Compliance Policy:
1. The authorized person shall ensure full compliance with cybersecurity policies and their implementation within their responsibilities.
2. The Cybersecurity Administration shall review and update cybersecurity policies periodically to align with legislative and regulatory requirements.
3. All employees of Najran University shall comply with this policy without exception.
4. In the event of any violation of these policies, the University may take appropriate disciplinary measures according to the internal systems followed at Najran University.

This policy has been approved by the Cybersecurity Administration at Najran University and is mandatory for all university personnel.