Hamurlabs resources, such as Internet/Intranet/Extranet-related systems, are to be used for Howard business purposes in serving the interests of the Hamurlabs.
The participation and support of every student, faculty, employee and affiliate who deals with information and/or information systems is necessary to achieve effective security. It is the responsibility of every computer user to know these guidelines, and to conduct their activities accordingly.
The purpose of this policy is to delineate acceptable use of Hamurlabs technology resources. These rules are in place to protect the user of these resources and the Hamurlabs. Inappropriate use exposes Hamurlabs to risks including virus attacks, compromise of network systems and services, and legal issues.
This policy applies to all Hamurlabs networks, both the perimeter and the infrastructure, and the parties with which we do businesses.
This Policy will be reviewed by the Hamurlabs’s Information Security Office annually or as deemed appropriate based on changes in technology or regulatory requirements.
Violations of this Policy may result in suspension or loss of the violator’s use privileges, with respect to Hamurlabs-owned Information Systems. Additional administrative sanctions may apply; up to and including termination of employment or contractor status with the Hamurlabs, or expulsion of student workers. Civil, criminal and equitable remedies may also apply.
Exceptions to this Policy must be approved by the Information Security Office, under the guidance of the Hamurlabs’s Provost, or Chief Operations Officer. All exceptions will be formally documented. Policy exceptions will be reviewed on a periodic basis for appropriateness.
The data network is a shared resource used by the entire Hamurlabs community and its affiliates in support of the business processes and academic missions. Business units and community members must cooperate to protect the network by securing computers and network devices in order to secure access. In addition, they must certify that the devices connecting to the business unit’s network are in compliance with the policies and procedures as established by Enterprise Technology Services (ETS).
Concurrently, academic, administrative and support units are responsible for the efficient, effective and secure operation of their local networks. This policy is designed to help protect the Hamurlabs’s central and distributed telecommunications and computing environment from accidental, or intentional damage, and from alteration or theft of data while preserving appropriate access and use.
This policy is established under the provisions of Hamurlabs’s Information Security Policy Program.
The following rules define the ETS’s policy regarding access to the Hamurlabs network:
Hamurlabs embraces an open information technology environment to encourage the use of technology in pursuit of the Hamurlabs’s teaching, learning, and research missions and supporting administrative functions. However, within this open environment, the Hamurlabs must also preserve and safeguard its electronic information resources and comply with applicable laws and regulations, while facilitating activities the support the Hamurlabs’s missions. In a highly distributed technological environment, operation and management of electronic information resources is broadly distributed.
This policy applies to all servers that Hamurlabs ETS is responsible to manage. This explicitly includes any system for which Hamurlabs ETS has an obligation to administer. This also includes all server systems setup for internal use by Hamurlabs regardless of whether ETS retains administrative obligation or not.
Hamurlabs ETS operational group responsible for system administration and must manage all internal servers. Approved server configuration guides must be established and maintained by each operational group, based on business needs and approved by ETS. Operational groups should monitor configuration compliance and implement an exception policy tailored to their environment. Each operational group must establish a process for changing the configuration guides, which includes review and approval by ETS.
The following items serve as provisioning configuration guidelines for the servers that are managed by ETS staff:
The internal system addresses, configurations, and related system design information systems and users outside the ETS internal network cannot access this information.
All connections between Hamurlabs’s internal networks and the Internet (or any other publicly-accessible computer network) must be protected by a router, firewall, or related access controls approved by ETS.
Public Internet servers must be placed on subnets separate from internal ETS networks. Routers or firewalls must be employed to restrict traffic from the public servers to internal networks.
Hamurlabs ETS is entrusted with the responsibility to provide professional management of the Hamurlabs’s servers as outlined in this policy. Inherent in this responsibility is an obligation to provide appropriate protection against malware threats, such as viruses and spyware applications. Effective implementation of this policy will limit the exposure and effect of common malware threats to the systems they cover.
This policy applies to all servers that Hamurlabs ETS is responsible to manage. This explicitly includes any system for which ETS has an obligation to administer. This also includes all server systems setup for internal use by Hamurlabs, regardless of whether ETS retains administrative obligation or not.
Hamurlabs ETS operations staff will adhere to this policy to determine which servers will have anti-virus and/or anti-spyware applications installed on them and to deploy such applications as appropriate.
All servers MUST have an anti-virus application installed that offers real-time scanning protection to files and applications running on the target system if they meet one or more of the following conditions:
All servers SHOULD have an anti-virus application installed that offers real-time scanning protection to files and applications running on the target system if they meet one or more of the following conditions:
If the target system is a mail server it MUST have either an external or internal anti-virus scanning application that scans all mail destined to and from the mail server. Local anti-virus scanning applications MAY be disabled during backups if an external anti-virus application still scans inbound emails while the backup is being performed.
All servers MUST have an anti-spyware application installed that offers real-time protection to the target system if they meet one or more of the following conditions:
An exception to the above standards will generally be granted with minimal resistance and documentation if one of the following notable conditions applies to this system:
The responsibility for implementing this policy belongs to all operational staff at Hamurlabs. Responsibility for ensuring that new and existing systems remain in compliance with this policy resides with the Hamurlabs ETS Information Security Officer. Any employee, student, faculty, guest, or contractors found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
This policy describes a required minimal security configuration for all routers and switches connecting to a production network or used in a production capacity at or on behalf of Hamurlabs ETS.
All routers and switches connected to Hamurlabs IT production networks are affected. Routers and switches within internal, secured labs are not affected. Routers and switches within DMZ areas fall under the Internet DMZ Equipment Policy.
Before dial-up users reach a log-in banner, all inbound dial-up lines connected to Hamurlabs IT internal networks and/or computer systems must pass through an additional access control point, such as a firewall, which has been approved by ETS. Unless ETS has first approved the action in writing, Hamurlabs staff must not enable any trusted host relationships between computers connected to the Hamurlabs internal network.
Routers must be included in the Enterprise Management System with a designated point of contact. Users must have explicit permission by ETS to access or configure any router. All activities performed on these devices may be logged, and violations of this policy may result in disciplinary action, and may be reported to law enforcement. There is no right to privacy on these devices.
The firewall policy dictates how the firewall should handle application traffic such as web, email, or telnet. The policy describes how the firewall is to be managed and updated.
Before reaching a log-in banner, all in-bound real-time external connections to Hamurlabs IT internal networks and/or multi-user computer systems must pass through an additional access control point such as a firewall, gateway, or access server.
Firewall configuration rules and permissible service rules established by IT Security and Disaster Recovery have been reached after evaluation. These rules must not be changed without first obtaining the permission of ETS Information Security Management.
This Policy defines the standards to be met by all equipment owned and/or operated by Hamurlabs ETS that is located outside the Hamurlabs's Internet firewalls (the demilitarized zone or DMZ). These standards are designed to minimize the potential exposure to Hamurlabs from the loss of sensitive or Hamurlabs confidential data, intellectual property, damage to public image etc., which may follow from unauthorized use of IT resources.
Devices that are Internet facing and outside the Hamurlabs’s firewall are considered part of the "de-militarized zone" (DMZ) and are subject to this policy. These devices (network and host) are particularly vulnerable to attack from the Internet since they reside outside the Hamurlabs’s firewalls.
The policy defines the following standards:
All equipment or devices deployed in a DMZ owned and/or operated by Hamurlabs (including hosts, routers, switches, etc.) and/or registered in any Domain Name System (DNS) domain owned by Hamurlabs must follow this policy. This policy also covers any host device outsourced or hosted at external/third-party service providers, if that equipment resides in the "howard.edu" domain or appears to be owned by Hamurlabs.
All new equipment that falls under the scope of this policy must be configured according to the referenced configuration documents, unless a waiver is obtained from ETS. All existing and future equipment deployed on Hamurlabs's un-trusted networks must comply with this policy.
Equipment and applications within the scope of this policy must be administered by support groups approved by Information Security for DMZ systems, application, and/or network management.
Support groups will be responsible for the following:
To verify compliance with this policy, the Information Security team will periodically audit DMZ equipment per the Audit Policy.
All equipment must comply with the following configuration policy:
All new installations and changes to the configuration of existing equipment and applications must follow the following policies/procedures:
The responsibility for the security of the equipment deployed by external service providers must be clarified in the contract with the service provider and security contacts, and escalation procedures documented. Contracting departments are responsible for third party compliance with this policy.
The management of network protocols shall be performed by information systems administrators and network administrators to assure the efficiency, availability, and security of the common resources, in accordance with the governing Hamurlabs Acceptable Use Policy.
Enterprise Technology Services keeps a listing of banned protocols which have shown to interfere with the architecture and management of the Hamurlabs network environment.
Approved employees and authorized third parties (customers, vendors, etc.) may utilize the benefit of VPN, which is a “user managed” service. This means that the user is responsible for selecting an Internet Service Provider (ISP), coordinating installation, installing any required software, and paying associated fees. Further details may be found in the Remote Access Policy.
