Policies - Technology Rules and Guidelines set forth by DoIT

NETWORK SECURITY D 102

ISSUED BY:

Office of the Chief Information Officer

SCOPE

This policy applies all users of any University network, communication system or computer resource.

POLICY

To the fullest practical extent, the Division of Information Technology maintains an open University network while ensuring that University resources remain protected from harm that could result from cyber threat or the misuse of University facilities.

To ensure the continued integrity of its information technology systems, the University may scan any machine connected to the network and audit, inspect or monitor network usage, at any time.

  1. Conditions for Access to the University Network: DoIT has established the following basic conditions for user access to the University network.
    1. Network jacks shall be secure. Active network jacks that do not require authentication shall be physically secured or activated only when needed for use. All “public” jacks or wireless access must use authentication and encryption.
    2. Limited network connectivity. Unless a user is specifically authorized to use a different IP address by DoIT, each device connecting to the University network is limited to the IP address assigned to it.
    3. Scanning University network activity. The unauthorized installation or use of software that attempts to perform a port scan, sniff, or otherwise intercept network traffic, is strictly prohibited.
      Recognized departmental network administrators may perform scans for diagnostic purposes on the address space assigned to them.
    4. Unauthorized servers are prohibited. Personal machines (not University property) may not be used as servers.
  2. Removal from the University Network: A machine or device may be immediately removed from the network if:
    1. the University receives a verified complaint indicating that it has been used to compromise other machines or servers;
    2. a vulnerability scan reveals security issues that are not promptly corrected by the user or administrator, or
    3. investigation reveals an actual or potential misuse of University resources or the violation of state or federal law. DoIT may authorize reconnection of the machine or device to the University network after the deficiency or condition has been satisfactorily rectified.

INQUIRIES / REQUESTS:

Office of the Chief Information Officer
Room 231, Educational Communications Center
(631) 632 – 9085

Office of Computer Accounts
Room 112 Computing Center
(631) 632 – 8011