Services

The IT Security Office serves all campuses, departments, and schools within the University of South Carolina, as well as all faculty, staff, and students of the University. To engage us in any service, please contact us via e-mail at security@sc.edu

We provide services in these areas:

Security Assessments and Compliance

• Risk assessments
  • Risk assessments help our customers understand the potential impact of the loss of confidentiality, integrity or availability of the system being assessed. Systems are often comprised of various different components, including servers, desktops, people and processes. Risk assessments attempt to look at the system in its entirety to determine the overall risk rating for the system. The types of data processed, transmitted and/or stored directly contribute to the overall risk rating of a system. At this time, assessments are conducted using the methodology outlined in NIST Special Publication 800-30.
• Vulnerability assessments
  • Vulnerability assessments provide specific information about the vulnerability of a stand-alone information technology resource, usually with the help of a network scanning tool. A vulnerability assessment is not a substitute for a risk assessment, but is in fact a component of a risk assessment.
• Assist with the creation of policies, standards, procedures and guidelines
  • Through the Information Technology Security Council, or through working with individual departments or colleges, we help with the creation or revision of policies, standards, procedures and guidelines.
• Compliance checks of existing systems
  • Upon request or as required by policy or mandate, verify that our systems are compliant with applicable policies, directives, laws and/or requirements. This will be done through the use of checklists, visual verification and review of the system and associated documentation.

Security Education, Awareness and Consulting

• Via our website
  • We will publish pertinent information on our website for our community.
• Via phone conversations, meetings, and other correspondence
  • We will answer questions and proactively comment on issues of security and privacy.
• Via presentations
  • We will conduct seminars to raise awareness on issues of security and privacy.
  • See our Events page for a list of scheduled presentations.

Computer Security Incident Response

• Via phone conversations, meetings, and other correspondence
  • We will accept reports of possible security and privacy incidents.
• Via network scanning and monitoring
  • We will proactively attempt to detect security and privacy incidents.
• See our Incident Reponse page to see the process described.