it.ucsf.edu

How Box protects your data

Jennifer Pham's picture

Box protects data using both access controls and encryption. Access to your UCSF Box account is controlled using your MyAccess userID and password. Access to the files you store on Box is controlled by the permissions you set. By default, access is private to the account holder. All communication with Box from your computer or mobile device is encrypted using SSL and data is encrypted in storage using 256-bit AES encryption. Other security features include file-level password protection and access notification. Additional information can be found by reading Box’s security whitepaper.

Box adheres to the highest industry standards for security at every level and commits extensive resources to the design, implementation, monitoring, and maintenance of its security infrastructure, including:

  • Data encryption
  • Administrative auditing
  • Password policy enforcement and AD/LDAP integration
  • Role-based access controls
  • Password- and time-based file sharing

Additionally, we further protect your data through CipherCloud by constantly scanning your Box account for matches to PHI. When it discovers PHI, it encrypts it on the file level irregardless of location. Once a file has been encrypted with a .ccsecure extension, it can only be decrypted by a user who has access to the CipherCloud agent. We also create a secure folder for you in which everything you place inside it is automatically encrypted.