|
ACCEPTABLE COMPUTER USE POLICY
1.0 Overview
Office of Research IT (OR-IT) group’s intentions
for publishing an Acceptable Use Policy are not to impose restrictions
that are contrary to the University of California – San Francisco
(UCSF) established culture of openness, trust and integrity. OR-IT is committed
to protecting employees, partners and the University from illegal or damaging
actions by individuals, either knowingly or unknowingly.
Internet/Intranet/Extranet-related systems, including but not
limited to computer equipment, software, operating systems,
storage media, network accounts providing electronic mail, WWW browsing,
and FTP, are
the property of UCSF. These systems are to be used for business
purposes in serving the interests of the University, and of our affiliates
in the
course of normal operations. Please review Human Resources policies
for further details.
Effective security is a team effort involving the participation
and support of every UCSF and Office of Research (OR) employee
and affiliate who deals with information and/or information
systems. It is the responsibility
of every computer user to know these guidelines, and to conduct
their activities accordingly.
2.0 Purpose
The purpose of this policy is to outline the
acceptable use of computer equipment at OR. These rules are
in place to protect
the employee and UCSF. Inappropriate use exposes UCSF to risks
including virus attacks, compromise of network systems and services,
and legal issues.
3.0 Scope
This policy applies to employees, contractors, consultants,
temporaries, and other workers at Office of Research, including
all personnel affiliated with third parties. This policy applies to all
equipment that
is owned or leased by UCSF (and OR).
Top of Page
4.0 Policy
4.1 General Use and Ownership
- While UCSF's network administration desires to provide a reasonable
level of privacy, users should be aware that the data they create on the UCSF systems remains
the property of UCSF. Because of the need to protect UCSF's network, management cannot guarantee
the confidentiality of information stored on any network device belonging to UCSF
- Employees are responsible for exercising good judgment
regarding the reasonableness of personal use. Individual
departments are responsible for creating guidelines concerning
personal use of Internet/Intranet/Extranet
systems. In the absence of such policies, employees should
be guided by departmental policies on personal use, and
if there is any uncertainty,
employees should consult their supervisor or manager.
- Office of Research IT group recommends that any information that
users consider sensitive or vulnerable be encrypted. For guidelines on information
classification, see Office of Research's Information Sensitivity Policy. For guidelines
on encrypting email and documents, go to Office of Research's Awareness Initiative.
- For security and network maintenance purposes,
authorized individuals within UCSF may monitor equipment, systems and network traffic
at any time, per Office of Research's Audit Policy.
- UCSF and OR-IT reserve the right to audit networks and systems
on a periodic basis to ensure compliance with this policy.
Top of Page
4.2 Security and Proprietary Information
- The user interface for information contained on Internet/Intranet/Extranet-related
systems should be classified as either confidential or not confidential, as defined by UCSF
confidentiality guidelines, details of which can be found in Human Resources policies. Examples
of confidential information include but are not limited to: university private, university strategies,
competitor sensitive, trade secrets, specifications, customer lists, and research data. Employees
should take all necessary steps to prevent unauthorized access to this information.
- Keep passwords secure and do not share accounts.
Authorized users are responsible for the security of their
passwords and accounts. System level passwords should be changed
quarterly;
user level passwords should be changed every six months.
- All PCs, laptops and workstations should
be secured with a password-protected screensaver with the automatic
activation feature set at 15 minutes or less, or by logging-off
(control-alt-delete for Win2K users) when the host will be unattended.
- Use encryption of information in compliance with Office of Research's
Acceptable Encryption Use policy.
- Because information contained on portable
computers is especially vulnerable, special care should be
exercised. Protect laptops in accordance with the “Laptop Security Tips”.
- Postings by employees from a UCSF email address
to newsgroups should contain a disclaimer stating that the
opinions expressed are strictly their own and not necessarily
those of UCSF, unless posting is in the course of business duties.
- All hosts used by the employee that are connected
to the UCSF Internet/Intranet/Extranet, whether owned by the
employee or UCSF, shall be continually executing approved virus-scanning
software with a current virus database. Unless overridden by
departmental or group policy.
- Employees must use extreme caution when opening e-mail
attachments received from unknown senders, which may contain viruses, e-mail bombs,
or Trojan horse code.
Top of Page
4.3 Unacceptable Use
The following activities are, in general, prohibited. Employees may be
exempted from these restrictions during the course of their legitimate job responsibilities
(e.g., systems administration staff may have a need to disable the network access of a host if that
host is disrupting production services). Under no circumstances is an employee of UCSF and OR authorized to
engage in any activity that is illegal under local, state, federal or international law while utilizing UCSF-owned resources.
The lists below are by no means exhaustive, but attempt to provide a framework for activities,
which fall into the category of unacceptable use.
System and Network Activities
The following activities are strictly prohibited, with no exceptions:
- Violations of the rights of any person or company
protected by copyright, trade secret, patent or other intellectual
property, or similar laws or regulations, including, but not limited to,
the installation or distribution of "pirated" or other software products that
are not appropriately licensed for use by UCSF.
- Unauthorized copying of copyrighted material including,
but not limited to, digitization and distribution of photographs
from magazines, books or other copyrighted sources, copyrighted music,
and the installation of any copyrighted software for which UCSF/OR or
the end user does not have an active license is strictly prohibited.
- Exporting software, technical information, encryption
software or technology, in violation of international or regional
export control laws, is illegal. The appropriate management should be
consulted prior to export of any material that is in question.
- Introduction of malicious programs into the network
or server (e.g., viruses, worms, Trojan horses, e-mail bombs, etc.).
- Revealing your account password to others or allowing
use of your account by others. This includes family and other household
members when work is being done at home.
- Using a UCSF/OR computing asset to actively engage
in procuring or transmitting material that is in violation of sexual
harassment or hostile workplace laws in the user's local jurisdiction.
- Making fraudulent offers of products, items, or services
originating from any UCSF account.
- Making statements about warranty, expressly or implied,
unless it is a part of normal job duties.
- Effecting security breaches or disruptions of network
communication. Security breaches include, but are not limited to,
accessing data of which the employee is not an intended recipient or logging
into a server or account that the employee is not expressly authorized
to access, unless these duties are within the scope of regular duties.
For purposes of this section, "disruption" includes, but is not limited to, network sniffing,
pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes.
- Port scanning or security scanning is expressly
prohibited unless prior notification to Office of Research is made.
- Executing any form of network monitoring which
will intercept data not intended for the employee's host, unless
this activity is a part of the employee's normal job/duty.
- Circumventing user authentication or security
of any host, network or account.
- Interfering with or denying service to any user
other than the employee's host (for example, denial of service attack).
- Using any program/script/command, or sending
messages of any kind, with the intent to interfere with, or disable,
a user's terminal session, via any means, locally or via the Internet/Intranet/Extranet.
Top of Page
Email and Communications Activities
- Sending unsolicited email messages, including
the sending of "junk mail" or other advertising material to individuals
who did not specifically request such material (email spam).
- Any form of harassment via email, telephone or
paging, whether through language, frequency, or size of messages.
- Unauthorized use, or forging, of email header
information.
- Solicitation of email for any other email address,
other than that of the poster's account, with the intent to
harass or to collect replies.
- Creating or forwarding "chain letters", "Ponzi" or other
"pyramid" schemes of any type.
- Use of unsolicited email originating from within
UCSF's networks of other Internet/Intranet/Extranet service
providers on behalf of, or to advertise, any service hosted by UCSF or
connected via UCSF's network.
- Posting the same or similar non-business-related
messages to large numbers of Usenet newsgroups (newsgroup spam).
5.0 Enforcement
Any employee found to have violated this policy may be subject
to disciplinary action, up to and including termination of employment.
6.0 Definitions
| Term |
Definition |
| Spam |
Unauthorized and/or unsolicited electronic mass mailings. |
|
