UNSW Technology Policy:

Transcription

1 UNSW Technlgy Plicy: UNSW Plicy Respnsible Officer Cntact Officer Apprving Authrity UNSW Data Netwrk Cnnectin Plicy Chief Infrmatin Officer Manager Infrastructure Services Supprt UNSW IT Services Ph: x 51141; g.sawyer@unsw.edu.au Chief Infrmatin Officer Date Apprved 2 August 2006 Date Effective 18 September 2006 New plicy, althugh prcess has been implemented infrmally Histry as a result f Net98 prject. Review Cmmencement Date September 2008 UNSW IT Security Plicy; UNSW IT Security Plicy Standards and Guidelines; Electrnic Recrdkeeping Plicy; Rules Relating t Student Use f Cmputing and Electrnic Cmmunicatins Facilities at UNSW; Student Miscnduct Rules; Related Plicies & Dcuments UNSW Cde f Cnduct File Number [will be prvided by Plicy Management Unit] 1. Preamble The University recgnises that access t, and security f, its data cmmunicatins netwrk is critical. This dcument establishes the respnsibility f UNSW IT Services in managing the netwrk as well as its authrity t detect, prevent r rectify incidents r risks which threaten the netwrk and thus the activities f the University and its members. 1.1 Purpse UNSW IT Services, as a key part f its rle, is respnsible fr the wnership, develpment, installatin, peratin and maintenance f the data cmmunicatins netwrk n behalf f UNSW and its members. With this respnsibility cmes the authrity t take actin necessary t safeguard the integrity f the netwrk t minimise and cntain ptential risks t the University and its members, bth peratinal and legal, frm the cnsequences f netwrk-related security vilatins and misuse. In this cntext, the purpse f this plicy is t state clearly bth UNSW IT Services respnsibility and authrity fr the University s netwrk infrastructure and devices cnnected t that infrastructure and; users respnsibilities in using such devices. Page 1

2 1.2 Principles UNSW IT Services hlds sle respnsibility fr, and authrity ver, the UNSW data cmmunicatins netwrk Only registered users r thse given permissin by the designated UNSW IT Services Authrity are permitted t use the UNSW data cmmunicatins netwrk Only UNSW IT Services (r its apprved delegate(s) may mdify/attach devices t the UNSW data cmmunicatins netwrk. 2. Scpe This plicy applies t: The University s internal data cmmunicatins netwrk, devices cnnected t it and supplied by, r therwise apprved fr cnnectin, by UNSW IT Services, and the netwrk s cnnectin t AARNet and the Internet; All devices using this infrastructure, including thse cnnecting via wireless technlgy; All users f such devices; The prtectin, detectin and actin against threats, including but nt restricted t: Virus attacks Denial f service attacks Hacking (internal r frm external surces) Dwnlads and uplads f unacceptable material Unacceptable cntent f utging Unslicited bulk (spam) Unauthrised cnnectin f devices t the netwrk. The cverage f this plicy includes threats frm, but excludes risks t: On-campus devices nt apprved fr netwrk cnnectin by UNSW IT Services; On-campus netwrks nt installed r apprved by UNSW IT Services; Off-campus netwrks and devices. Page 2

3 3. Definitins Fr purpses f this plicy, unless therwise stated, the fllwing definitins shall apply: Designated UNSW IT Services Authrity: UNSW Chief Infrmatin Officer r authrised delegate within UNSW IT Services. Netwrk Devices: Active equipment required t perate the University s data netwrk. These devices prvide transient services including switches, ruters, firewalls and wireless access pints. 4. Plicy Statements This plicy addresses the fllwing: Wh can and cannt make use f the University s data cnnectin netwrk; Wh can and cannt extend, remve r change the cabling and fibres that cnstitute the University s data cnnectin netwrk, either within r between University buildings; What cnnectins r changes can and cannt be made t the netwrk; What devices can and cannt be attached t the netwrk; Wh can and cannt attach such devices; What they can and cannt use it fr; Hw UNSW IT Services manages the cntrl f the netwrk and the apprval f cnnectins bth frm devices and frm ther netwrks; Hw UNSW IT Services is able t detect r prevent security threats and rectify the cnsequences f thse threats t the netwrk; What sanctins are available t UNSW IT Services when threats and misuse are encuntered, t deter further misuse f the netwrk. 4.1 Users f the Netwrk Only registered users r thse given permissin by the Designated UNSW IT Services Authrity are permitted t use the UNSW data netwrk. 4.2 Mdifiers f the Netwrk Only UNSW IT Services and University apprved data cmmunicatins cntractrs are permitted t mdify the netwrk infrastructure. 4.3 Netwrk Devices Only UNSW IT Services and University apprved data cmmunicatins cntractrs are permitted t install such devices, which will be slely managed by UNSW IT Services. These devices shall be lcated in UNSW IT Services cabinets. N ther equipment shall be hused within these cabinets. Page 3

4 4.4 User Devices Any device, ther than netwrk devices (as defined in Sectin 3) is defined as a user device. User devices fall int tw categries client and nn-client: Client devices Client devices are defined as equipment generally used by ne persn with traffic terminating n the device, eg PC s, laptps, Macintshes r PDA s. Netwrk cnnectivity is achieved by either plugging this equipment directly int an activated data pint n the University netwrk r indirectly by enabling a cnnectin via a wireless access pint. University-wned client devices may be cnnected t the netwrk by any user f the University prvided the equipment is used in accrdance with the aims and plicies f the University) and fr n ther purpse Nn-client devices A nn-client device, eg a server, is defined as equipment which prvides a service t ne r mre users. University-wned nn-client devices may be cnnected t the netwrk by cmpetent users prvided the recgnised wner f the equipment shall agree t keep it updated in terms f anti-virus and perating system security patches. 5. Legal & Plicy Framewrk Use f UNSW netwrks will generally be subject t regulatin cnsistent with all relevant legislatin and UNSW plicies and guidelines. Self-regulatin is expected and the University will impse limits r take actin nly where and when necessary t prtect its data netwrk. 6. Implementatin 6.1 Respnsibilities UNSW IT Services are respnsible fr: Managing access t the Data Netwrk by the University s users; Managing the risks f any netwrk device cnnected t the netwrk and implementing any necessary security measures t prtect the netwrk; Managing the prvisin f IP addresses; prtectin via access lists; authenticatin and data pint activatin. UNSW IT Services hlds sle authrity and respnsibility fr the cnnectins f netwrking equipment t the netwrk, eg hubs, switches, ruters and wireless equipment. Traffic entering the UNSW netwrk will be mnitred and managed by UNSW IT Services. Page 4

5 Owners f any equipment cnnected t the netwrk are respnsible fr: Ensuring that all machines have the latest level f anti-virus sftware and security patches installed, and that these are kept up t date. 6.2 Supprt The Infrastructure Services Supprt team within UNSW IT Services can prvide guidance and advice regarding the implementatin f the plicy. Cntact the IT Service Desk in the first instance fr assistance. 6.3 Cmpliance and Breaches UNSW IT Services, n behalf f the University, are respnsible fr investigating, cntaining and reslving breaches f security, and may discnnect, blck traffic t/frm, r lg infrmatin abut any machine using the data netwrk. UNSW IT Services are authrised t investigate any apparent breaches f this plicy. If a breach is fund, UNSW may ban users withut ntice, pending reslutin f the incident. Depending upn severity r unlawfulness, breaches may be reprted t the NSW Plice. Where a prven breach f this plicy ccurs, the relevant rganisatinal unit will be liable fr all csts incurred in rectificatin. 6.4 Cmmunicatin Strategy & Implementatin Plan [This will be develped as an Appendix t this dcument] Hw will the University Cmmunity be infrmed f changes t University practice? Identify cmmunicatin & training, as required. 7. Evaluatin The success f this plicy and its technlgical implementatin will be evaluated peridically. Stakehlders, including users, University staff, the student bdy, Heads f Budget units, Deans and the University Executive will be cnsulted as part f any evaluatin. Evaluatin criteria will include: The degree f cmpliance with the Plicy The degree t which netwrk facilities are available t staff and students. Page 5

6 8. Assciated Dcuments Cmmnwealth Spam Act, UNSW Cde f Cnduct (Staff) UNSW IT Security Plicy, Standards and Guidelines UNSW Electrnic Recrd-Keeping Plicy Student Miscnduct Rules Rules Relating t Student Use f Cmputing and Electrnic Cmmunicatins Facilities at UNSW 9. Dcument Versin Cntrl 4/7/06 V0.1 G.Sawyer Initial draft 25/7/06 V1.0 J. Beatsn Re-frmat t new PMU template 10. Dcument Histry and Apprval This technlgy plicy was develped by Greg Sawyer, Manager Infrastructure Services Supprt, UNSW IT Services. It was peer-reviewed by the ISS team and by Jenny Beatsn, IT Plicy and Cmpliance Officer. The plicy was apprved by Chief Infrmatin Officer Tim Cpe n August 3, T. Cpe Chief Infrmatin Officer University f new Suth Wales Page 6