Human Resources
Email subject: Identifying Associate Staff
Email date: 12th November 2024
SIA initial email
We are currently reviewing how we grant permission to access our Tableau server. For data security, we should be restricting what staff can view on Tableau if they are an associate and/or based overseas. However we don't currently have a way of doing this, aside from asking colleagues to self-identify.
Are there any options available to us here?
Alex McFarlane response
I'm afraid you would be better having this conversation with IT, who manage associate user access.
HR have the same problems in giving associates access to resources. IT have had similar problems when trying to give associates access to MetaCompliance training. Unfortunately I don't think there are any easy answers.
IT
Case number: 00708851
Email subject: Identifying Associate Staff for Data Security
Email date: 26th November 2024
SIA initial email
We are currently reviewing how we grant permission to access our Tableau server. For data security, we should be restricting what staff can view on Tableau if they are an associate and/or based overseas. However we don't currently have a way of knowing who these staff are, aside from asking colleagues to self-identify. We have spoken to HR and they are unable to help and they also experience this issue.
For areas of the university we know have a high number of associate or overseas staff (such as the International Recruitment team), we are working with them to keep up to date lists of those staff usernames. However this isn't sustainable across the whole institution.
Are there any options available to us here?
IT response
If HR cannot report on their oversee staff then we cannot help out there. When it comes to oversee associates we just maintain the system for departments to create their own associate accounts... of which we don't capture if they will be based oversea.
The only option I can think of to help out would be working with the security team to see who has been accessing the VPN from abroad. This isn't to say someone is definitively based abroad, it would just show who has accessed the VPN from abroad (which yet again will not be 100% accurate as there are means of masking your location). We have 3 month worth of logs to look back on. If this is something that could help out let me know and we can discuss, what sort of frequency of 'logging on from abroad' you would be happy with classing as being 'based abroad'.
Afraid this is the best we can do.