INTRANET AND INTERNET SECURITY POLICY
Introduction
This is a generic policy that provides rules and guidelines for Internet and intranet security within a company. This tool is intended as a sample for other companies who are in the process of creating or re-evaluating their policy.
All employees are expected to sign and abide by this policy. Signed agreement forms are to be provided to your facility's IT department. After completion, the form will be filed in the individual's human resources file (for permanent employees), or in a folder specifically dedicated to Internet access (for contract workers, etc.), and maintained by the IT department.
The Intranet and Internet Security Policy applies to all Intranet/Internet users (including permanent full-time and part-time employees, contract workers, temporary agency workers, business partners and vendors) who access the Internet through the company's computing or networking resources. Intranet/Internet users are expected to be familiar with and to comply with this policy. Users are also expected to use their common sense and exercise good judgment while using Internet services.
Violations of the Intranet and Internet Security Policy, including but not limited to violation of information specified herein will be documented and can lead to revocation of system privileges and/or disciplinary action up to and including termination. Additionally, the company may at its discretion seek legal remedies for damages incurred as a result of any violation. The company may also be required by law to report certain illegal activities to the proper enforcement agencies.
General Security Policy
Users are to:
-
Use computer systems for solely corporate business purposes.
-
Maintain the privacy and confidentiality of all confidential and institutional data. (See Information Classification Section)
-
Use unique user-IDs and personal non-trivial secret passwords to access computer systems. Users are responsible for all activities occurring with their User-IDs.
-
Log out of all systems when leaving a computer system unattended.
-
Report information security violations immediately.
-
Adhere to virus control procedures. All software to be installed or downloaded from external sources through the Intranet or Internet must be screened with virus detection software before being invoked.
-
Refrain from connecting networked workstation to modems without approval. At no time should networked workstations be connected both to the Internet via a modem and to the company network.
-
Comply with all third-party software licenses. Any unlicensed software must be immediately removed from company computers.
Information Classification
Information assets must be identified, classified, and labeled based on the sensitivity to the organization (i.e., the business impact if destroyed, damaged or disclosed). Owners are responsible for classifying information assets. Everyone is responsible to ensure that the appropriate level of protection is consistently applied. Information assets must be classified according to the following scheme:
-
Level 1 -- Confidential Information: This class represents important and/or highly sensitive material that is appropriate for only specific employees. Unauthorized disclosure, modification, or destruction of this information could cause serious damage to the company and our clients.
-
Level 2 -- Institutional Information: This class represents information important to the company. Its destruction and/or modification could result in serious losses. This information must have controls to ensure its integrity and accuracy. Its use is therefore subject to certain restrictions.
-
Level 3 -- Unrestricted Information: This class represents information that does not fall into one of the above classifications and is appropriate for all company personnel in addition to the general public.General (lot. generalis - umumiy, bosh) - qurolli kuchlardagi harbiy unvon (daraja). Dastlab, 16-a.da Fransiyada joriy qilingan. Rossiyada 17-a.ning 2-yarmidan maʼlum. Oʻzbekiston qurolli kuchlarida G. This information is not considered confidential, and its disclosure, modification and/or destruction does not need to be controlled.
Information classified as Level 1, log-in passwords and other parameters that can be used to gain access to the company are a few examples of data types which must be encrypted by the approved encryption standard before transmission over the Intranet or Internet. In addition, Level 2 data must be sent encrypted over the Internet. It may be in the clear on the Intranet.
Electronic Mail Policy
The electronic mail system is to be used for business purposes only. All messages sent by electronic mail are the property of the company. The company reserves the right to access and disclose all messages sent over its electronic mail system, for any purpose. Supervisors may review the electronic mail communications of workers they supervise to determine whether they have breached security, violated company policy, or taken other unauthorized actions. The company may also disclose electronic mail messages to law enforcement officials without prior notice to the employees who may have sent or received such messages.
Employees must not use an electronic mail account assigned to another individual to either send or receive messages. If there is need to read another's mail (while they are away on vacation for instance), message forwarding and other facilities be used must instead.
Unless the information owner/originator agrees in advance, or unless the information is clearly public in nature, employees must not forward electronic mail to any address outside the company network.
Employees must not create their own, or forward electronic mail messages which may be considered illegal, pornographic, or negatively depicts race, sex or creed.
Internet Access Policy
Internet usage is granted for the sole purpose of supporting business activities necessary to carry out job functions. All users must follow the corporate principles regarding resource usage and exercise good judgment in using the Internet. Acceptable use of the Internet for performing job functions includes:
-
Communication between employees and non-employees for business purposes.
-
IT technical support downloading software upgrades and patches.
-
Review of possible vendor web sites for product information.
-
Reference regulatory or technical information.
-
Research.
The company also prohibits the conduct of a business enterprise, political activity, engaging in any form of intelligence collection from clients or business partners, engaging in fraudulent activities, or knowingly disseminating false or otherwise libelous materials.
Other specific activities that are strictly prohibited include but are not limited to:
-
Accessing confidential information that is not within the scope of one's work.
-
Misusing, disclosing without proper authorization, or altering company or personnel information.
-
Any unauthorized, deliberate action that damages or disrupts computing systems or networks, alters their normal performance, or causes them to malfunction regardless of location or duration.
-
Willful or negligent introduction of computer viruses, trojan horses or other destructive programs into company systems or networks or into external systems and networks.
-
Unauthorized decryption or attempt at decryption of any system or user passwords or any other user's encrypted files.
-
Packet sniffing, packet spoofing, or use of any other means to gain unauthorized access to a computing system or network.
-
Use, transmission, duplication, or voluntary receipt of material that infringes on the copyrights, trademarks, trade secrets, or patent rights of any person or organization.
-
Unauthorized downloading of any shareware programs or files for use without authorization in advance from the IT Department and the user's manager.
-
Any conduct that would constitute or encourage a criminal offense, lead to civil liability, or otherwise violate any regulations, local, state, national or international law including without limitations US export control laws and regulations.
-
Deliberate pointing or hyper-linking of the company Web sites to other Internet/WWW sites whose content may be inconsistent with or in violation with the aims or policies of the company.
-
Transmission of any proprietary, confidential, or otherwise sensitive information without the proper controls.
-
Acquisition, storage, dissemination, creation, posting, transmission, or voluntary receipt of any unlawful, offensive, libelous, threatening, harassing material, including but not limited to comments based on race, national origin, sex, sexual orientation, age, disability, religion, or political beliefs.
-
Any ordering (shopping) of items or services on the Internet.
-
Playing of any games.
-
Forwarding of chain letters.
-
Participation in on-line contest, forms of gambling or accepting of promotional gifts.
Agreement to Comply with Information Security Policies
By signing below, he/she acknowledges that he/she is a "user" as defined in this policy. The undersigned certifies that he/she has received, read and will comply with the Intranet and Internet Security Policy. The undersigned also acknowledges that he/she is responsible for any possession of company information resources and must protect these information resources from unauthorized activities including disclosure, modification, deletion, and usage.
The undersigned agrees to abide by the policies and procedures described therein as a condition of continued employment. The undersigned furthermore understands that violators of these policies and procedures are subject to disciplinary measures including privilege revocation and/or employment termination. The undersigned understands that access to company information systems is a privilege which may be changed or revoked at the sole discretion of management.
The undersigned also agrees to promptly report all violations or suspected violations of information security policies and procedures to the Corporate Help Desk.
I have read the Intranet and Internet Security Policy. I understand the contents, and I agree to comply with the said Policy.
Name:
Location:
Business Purpose:
Signature:
Date:
Manager/Supervisor Signature:
Date:
|
