Computer Security Policy Definitions: 1) The "Physics and Astronomy Local Network", also referred to as "the Local Network" is considered to consist of any and all devices that can communicate with other devices within the Allen Building. Although a device is not considered to be part of the Local Network while it is not actually connected to or otherwise communicating with the Local Network, if it is subsequently connected or in any way communicates with any part of the Local Network, e.g. through some form of wireless connectivity, over the internet or through reading a disc, it must be fully compliant with the policies outlined in this document. 2) For the purpose of this policy, a "machine" refers to any device (e.g. computer, workstation, PC, laptop computer, printer, scanner, etc), regardless of operating system or applications, that will be networked or allowed to share data with any other Departmental or University machines regardless of the medium employed (network or removable storage medium etc). 3) The "Principal User" of a machine is taken to be the person having the primary responsibility for or being the main user of a machine. 4) "Technical Staff", also referred to as "technical support staff", refers to the Information Technology Group of the Department of Physics and Astronomy. Preamble: The Department of Physics and Astronomy prefers that people using machines consult the technical support staff for set-up and ongoing maintenance of all machines used on the Local Network. This should not be taken to imply that support staff will be responsible for all aspects of ensuring the ongoing integrity of all devices on the Local Network. Some aspects of setup, maintenance and security are necessarily the responsibility of the users who must exercise due diligence to ensure that the machines they are using do not pose a hazard to other users of the Local Network. It is recognized that there may be cases where more control of a machine by the Principal User or a third party may be required to deal with exceptional situations in a timely manner. Nevertheless, even when the Principal User plays a significant role in the administration of the machine, whenever the machine is attached to the Local Network or otherwise communicates with or through it, the machine must adhere to the policies stated below. Policy: 1) Information concerning security-related problems and updates for the applicable software will normally be obtained and communicated to users on a regular basis by the technical support staff. It is the PRINCIPAL USER'S RESPONSIBILITY to ensure that the recommended solutions to security problems are implemented, with assistance from the technical support staff, where necessary. This includes installation and maintenance of appropriate antivirus software on all applicable systems. 2) Installation of all vendor-supplied, security-related software updates or patches will be done on a timely basis. This is primarily the responsibility of the technical support staff, but they must have reasonable access to machines in order to carry out the necessary operations. 3) Installation of machines must be done in conjunction with and following consultation with the technical support staff, to assure that potential problems are addressed. Technical support staff must also be consulted whenever the Principal User or maintainers of the machine are unsure of what security or maintenance procedures should or need to be followed. The Head, in conjunction with the Department Computing Committee, will make available a list of such security and maintenance procedures. 4) Technical support staff must always be consulted for authorization prior to any changes in machine configuration which may impact the network or other machines. Examples: setting up network services, file sharing services (WWW, FTP) or any other similar services. A more complete list will be made available by the Head, in conjunction with the Department Computing Committee. 5) Technical support staff will perform security analysis using appropriate network monitoring and scanning tools, periodically or as required. Technical support staff will report any vulnerabilities thus discovered to the machine's Principal User and to the Department Computer Committee. The technical support staff will assist the Principal User to rectify the problem(s) in an appropriate and timely manner. 6) In the event of a significant security problem being discovered, the technical support staff may, at their discretion and without prior notice to the Principal User, deal with the problem in an appropriate manner. The Head, in conjunction with the Department Computer Committee, will establish and make available an appropriate hierarchy of responses to be followed in the event of a significant security problem. In the event of an emergency, however, the final decision regarding the application of the policy and hierarchy of responses will rest with the technical support staff. 7) It is recommended that all administrator passwords be stored in the Office safe and made available to the technical support staff so that it may be possible to address some problems without removing a machine from the local network. In the event of an emergency, if the administrator password for a particular machine is not available, the technical support staff may, at their discretion, remove the machine from the local network. 8) Reasonable access control mechanisms will be used to ensure that the machine is accessible only to authorized users. This could include any or all of (i) controlling physical access to the machine, (ii) use of secure and private passwords by all users, (iii) disabling any vulnerable accounts, such as guest accounts or other similar initial accounts with weak passwords or no passwords at all, (iv) disabling all unnecessary services, and (v) whatever other access control is appropriate for the software being used. THIS IS THE PRINCIPAL USER'S RESPONSIBILITY. 9) It is recognized that for some devices, there may be external security requirements by other collaborating institutes that may have to be taken into account. In these cases, the decision as to whether or not any requirements stated herein can be waived will reside with the Department Head. 10) Failure by the Principal User or designated third parties to comply with this policy can result in removal of the affected machine(s) from the network, and/or other actions deemed appropriate by the Department Head. These measures may include, but are not necessarily limited to: i) removing a particular machine or portion of the local network from the rest of the local network ii) powering down a particular machine or portion of the local network iii) locking a particular account, especially if the account appears to have been accessed in an unauthorized fashion iv) reporting the problem to other authorities. (This is a University requirement.)