SCEC Acceptable Use Policy
The purpose of this policy is to outline
the acceptable use of computer equipment at SCEC. These rules are in place to
protect the students, teachers, employees and users of the SCEC network and
SCEC itself. Inappropriate use exposes SCEC to risks including virus attacks,
compromise of network systems and services, disclosure of student and/or
administrative information and legal issues.
This policy applies to teachers, students,
employees, contractors, consultants, temporaries, and other workers at SCEC,
including all personnel affiliated with third parties. This policy applies to
all equipment that is owned or leased by SCEC and also any devices that are
attached to the SCEC network in any way.
The following activities are, in general,
prohibited. Users who feel they need to be exempted from these restrictions
during the course of their legitimate course of work should contact SCEC IT.
Under no circumstances is a user of the
SCEC network authorized to engage in any activity that is illegal under local,
state, federal or international law.
The lists below are by no means
exhaustive, but attempt to provide a framework for activities which fall into
the category of unacceptable use.
The following activities are strictly
prohibited, with no exceptions:
Any user found to have violated this
policy may be subject to disciplinary action, up to and including termination
of employment.
SCEC Email Use Policy
1.0 Purpose
To prevent disclosure of
Student and/or Administrative information, tarnishing the public image of School
City East Chicago (SCEC) and ensure a safe computing environment for all SCEC
users.
2.0 Scope
This policy covers appropriate
use of any email sent from a SCEC email address or any email sent using a SCEC
computing device and applies to all teachers, employees, students, vendors, and
agents operating on behalf of SCEC.
Email is defined as any form of electronic mail sent to any ecps.org
account.
3.0 Policy
3.1 Prohibited Use. The SCEC email system shall not to be used
for the creation or distribution of any disruptive or offensive messages,
including offensive comments about race, gender, hair color, disabilities, age,
sexual orientation, pornography, religious beliefs and practice, political
beliefs, or national origin. Any user who receives an email with this content
from any SCEC user should report the matter to SCEC IT immediately.
Also prohibited is: creating or forwarding
"chain letters", "Ponzi" or other
"pyramid" schemes of any type; any form of harassment via email,
instant messaging, telephone or paging, whether through language, frequency, or
size of messages.
SCEC IT only supports the Groupwise email client.
Any other email client application is not supported by SCEC IT and
should not be used on the SCEC network.
Users may not install or otherwise use
Instant Messaging software other than that provided by SCEC IT. This includes, but is not limited to, Yahoo!
Instant Messenger, AOL Instant Messenger (AIM) and MSN Instant Messenger.
3.2 Personal Use.
Using a reasonable amount of
SCEC resources for personal emails is acceptable, but non-work related email
shall be saved in a separate folder from work related email. Virus or other malware
warnings and mass mailings from SCEC shall be approved by SCEC IT before
sending. These restrictions also apply to the forwarding of mail received by a
SCEC employee.
3.3 Monitoring
SCEC users shall have no expectation
of privacy in anything they store, send or receive on the SCEC email system. To
ensure compliance, SCEC routinely monitors e-mail messages for content without
prior notice to the user. However, SCEC is not obliged to monitor email
messages.
3.4 Mass Mailing
Under no circumstances should a
SCEC user participate in mass e-mailings.
This includes bulk messages in which the user does not have a personal
relationship with the recipient. E-mail
messages should be limited to a reasonable number of recipients.
3.4 Retention
SCEC systems will retain email
messages for the period of one month following arrival of the message onto SCEC
servers. After this time, the email
messages will automatically be removed.
Any important information contained in an email message should be copied
out of the email system.
4.0 Enforcement
Any employee found to have
violated this policy may be subject to disciplinary action, up to and including
termination of employment.
SCEC Incident Reporting Policy
The purpose of this policy is to clearly define what steps are to be taken if a security compromise is suspected.
This policy applies to all SCEC staff, any
vendors working on their behalf, and any third parties who are servicing SCEC
IT operations or working with in the SCEC organization.
A reportable incident is anything that may
compromise sensitive SCEC information.
Sensitive Information is any information related to a student or any
other information that is not public knowledge.
This includes information related to, but is not limited to, insurance,
health, financial, investment, criminal history, demographic and grades.
A Reportable Incident is anything that is
observed that may cause this information to be compromised or that seems
outside of normal business practices.
This would include things such as suspicious or unknown individuals
using office resources, phone calls asking for sensitive information without
proper identification, signs of forced access into a room, office, filing
cabinet, etc.
Any individual who has knowledge of a Reportable Incident should contact the Director of Technology at 391-4100 immediately.
Any user found to have violated this
policy may be subject to disciplinary action, up to and including termination
of employment.
Password Policy
1.0 Overview
Passwords are one of the most important aspects of information
security. A poorly chosen password can
lead to the compromise of sensitive information, such as Student
Information. All School City East
Chicago (SCEC) employees (including contractors and vendors with access to SCEC
systems) are responsible for taking the appropriate steps, as outlined below,
to select and secure their passwords.
2.0 Purpose
The purpose of this policy is to establish a standard for creation
of strong passwords, the protection of those passwords, and the frequency of
change.
3.0 Scope
The scope of this policy includes all users who have an SCEC
password for any system or device.
4.0 Policy
·
All system-level passwords (e.g., root,
enable, NT admin, application administration accounts, etc.) must be changed on
at least a semi-annual basis.
·
All user-level passwords for desktop
computers must be changed at least every semester. After each semester, users
that have not changed their password will be forced by the appropriate system.
·
Passwords must not be inserted into email
messages or other forms of electronic communication such as Instant
Messaging. Password also must not be
written down in an obvious or predictable place.
·
All user-level and system-level passwords
must conform to the guidelines described below.
4.1 Guidelines
A. General Password Construction Guidelines
STRONG passwords have the following
characteristics:
·
Contain both upper and lower case
characters (e.g., a-z, A-Z)
·
Have digits and punctuation characters as
well as letters e.g., 0-9, !@#$%^&*()_+|~-=\`{}[]:";'<>?,./)
·
Are at least eight alphanumeric characters
long.
·
Are not a word in
any language, slang, dialect, jargon, etc.
·
Are not based on personal information,
names of family, etc.
·
Passwords should never be written down or
stored on-line. Try to create passwords that can be easily remembered. One way
to do this is create a password based on a song title, affirmation, or other
phrase. For example, the phrase might be: "This May Be One Way To Remember" and the password could be:
"TmB1w2R!" or "Tmb1W>r~" or some other variation.
NOTE: Do not use these examples as passwords!
POORLY chosen passwords have the following
characteristics and therefore should not be used on the SCEC network:
·
The password contains less than eight
characters
·
The password is a word found in a
dictionary (English or foreign)
·
The password is a common usage word such
as:
o
Names of family, pets, friends,
co-workers, fantasy characters, etc.
o
Computer terms and names, commands, sites,
companies, hardware, software.
o
The words "
o
Birthdays and other personal information
such as addresses and phone numbers.
o
Word or number patterns like aaabbb, qwerty, zyxwvuts, 123321, etc.
o
Any of the above spelled backwards.
o
Any of the above preceded or followed by a
digit (e.g., secret1, 1secret)
B. Password Protection
Do not use your SCEC passwords on any other system such as Yahoo
Mail, E-bay or your personal banking website.
Do not share SCEC passwords with anyone under any
circumstances. This includes
administrative assistants, teachers, SCEC IT staff, secretaries, even your
supervisor!
If someone demands a password, contact the school technology
coordinator immediately.
Do not use the "Remember Password" feature of applications (e.g.,
Eudora, OutLook, Netscape Messenger).
Do not write passwords down and store them anywhere in your
office. Do not store passwords in a file on ANY computer system (including Palm
Pilots or similar devices).
5.0 Enforcement
Any employee found to have violated this policy may be subject to
disciplinary action, up to and including termination of employment.
Software Usage Policy
1.0 Purpose
The purpose of this policy is to ensure that School City East
Chicago (SCEC) follows all licensing agreements with software providers.
2.0 Scope
The scope of this policy is all software that runs on the SCEC
network and/or is used by SCEC employee’s for work related functions.
3.0 Policy
Only software that has been legally purchased through the SCEC IT
department is to be installed on the SCEC computers. This is to ensure licensing compliance.
Software downloaded from the Internet, such as Shareware, Freeware
and demo versions are not to be installed on SCEC systems. Often times, this software has special
licensing considerations when not used by an individual. Also, this software may have undesired
effects on the SCEC network.
Copying of software media (CD, floppy disk, DVD, etc) by SCEC is
prohibited unless expressly authorized by the SCEC IT department. On occasion, SCEC may engage in a licensing
agreement with a software provider that will allow employee’s to copy and use
specific software at home. This,
however, is not common and must be explicitly authorized by SCEC IT.
Installation of software licensed/owner by SCEC is not to be
installed on home computers. If an
employee wishes to do SCEC work from home and believes that software used by
SCEC is necessary, a request should be made to the SCEC IT department. Installation of SCEC licensed/owned software
on home computers is illegal unless
specifically allowed by the software publisher.
Hacking “tools” such as port scanners, network mappers,
penetration testers and other such software are not allowed on the SCEC
network. These software packages can
cause unexpected behavior on the network and are prohibited.
All purchases of textbooks that include software that is to be
installed on the SCEC network must be submitted to the SCEC IT department prior
to purchase. Installation of new
software is done quarterly and textbook software will be installed in the next
quarter.
4.0 Enforcement
Any employee found to have violated this policy may be subject to
disciplinary action, up to and including termination of employment.