Acceptable Use Policy

Nederlandse versie: Gebruiksvoorwaarden

Acceptable Use

This Acceptable Use Policy governs the use of the Nikhef networking and computer services; all users of these services are expected to understand and comply to these rules.

1. Use for intended purpose

   Nikhef offers the services to enable the users (employees, students and collaborators) to do their work. The services may not be used for commercial or political purposes. A limited amount of private use is allowed as long as it does not interfere with normal duties and does not incur significant cost. When in doubt about any form of personal use, ask first!
   Of course, there are lots of actions that are most certainly not intended: sending spam, trolling on forums or newsgroups, forwarding chain letters or phishing attempts, cracking passwords, attacking other systems on the Internet, random calling or tele-marketing, stalking, etc.
2. Obey the law

   Seems logical, doesn't it?
3. Respect the authorization restrictions set by Nikhef system administrators and users

   Trying to circumvent effective or intended restrictions is not allowed (and unlawful as well). This includes, but is not limited to, accessing data not intended for the User, logging into a service or using an account you are not expressly authorized to access, probing the security of other networks, interfering with another users access to services, or trying to disrupt services or the network. You shall also refrain from trying to intercept or sniff network traffic that is not intended for you. If you find you have access to data or services you should not have access to, inform the Computer Security Incident Response Team (CSIRT) through the helpdesk (helpdesk@nikhef.nl)
4. Respect intellectual property and confidentiality agreements

   So do not publish, post, transmit or re-transmit, or put up on the web, items that violate the rights of any person, including rights protected by copyright, trade secret, patent or other intellectual property or similar laws or regulations including, but not limited to, the installation or distribution of "pirated" or other software products that are not appropriately licensed for your use. Except of course as permitted by applicable Dutch law -- keeping in mind the rest of this AUP.
   You are not allowed to agree to (click-through) agreements on behalf of Nikhef, other than OSI-approved free and open source licenses unless explicitly authorised by the Computer Technology group or directorate.
5. Protect your access keys (passwords, private keys, security tokens)

   You are responsible for anything that is done under your account, so by sharing credentials you become responsible for the other persons behaviour. You can and should not be. Access keys are yours and yours only: so do not share your credentials with others. These include your single-sign-on (SSO) password, the pass phrase for your certificate's key, the password that protects your SSH key pair. If you feel the need to share, there is always a proper solution. Be careful with your passwords: do not write them down on note paper or in your agenda, but use a storage system intended for such purpose. Also, any credential that grants to access to other services (at Nikhef or elsewhere) must be protected with at least a password or better.
   If you think your credentials have been stolen of sniffed, inform the help desk immediately (phone 2200) and - if possible - change them from a trusted computer and location. If Nikhef suspects abuse of your login credentials, access to your account will typically be suspended as an immediate security measure (see: Enforcement).
   If you have been given credentials for special services (such as a VoIP telephony roaming password, or access to a generic account) you must protect these according to the specific instructions given to you.
6. Report suspected security breaches and misuse

   When you discover vulnerabilities, witness abuse, or see other forms of non-acceptable use, you should report these incidents to the Nikhef Computer Security Incident Response Team (CSIRT) through the helpdesk (helpdesk@nikhef.nl). Do not take any action, but await further instructions. Of course, you should not attempt to exploit such vulnerabilities to circumvent security controls or harm Nikhef, it's services, staff or reputation in any way - such attempts in itself are a violation of this Acceptable Use Policy.
7. Do no harm to Nikhef, it's services, staff or reputation

   Harm is more easily done than repaired! Data is easily deleted or modified but hard or impossible to recover. A rash document (as well as of course offensive material) put up on your home page is quickly indexed by search engines and will never disappear from the web. Confidential data accidentally disclosed will never be secret again. A defamatory remark will live forever in cyberspace. An infected home laptop or smart phone will quickly poison other systems at Nikhef and many person months will be wasted to recover from the incident. So be mindful as well as careful.
8. Comply with the policies of Nikhef's service providers

   Nikhef provides access to and brokers services of third parties for its users, such as connectivity to the public Internet through SURFnet, access to Federated Services, or other hosted services like backup and calendering. You should at all times comply with the policies, terms and conditions of use of these service providers.
9. You share resources with others - be nice

   Even when staying within the intended use, it is quite possible to strain resources to such an extent that other users can no longer make use of them. Running CPU intensive applications on the general login server, or using this service for bulk data transport are some examples. Making an outbound telephone call for a phone conference and then put it on hold, but subsequently forget about it - exhausting our telephone lines as well as incurring a high bill. When such incidents are detected, the program or call in question will be terminated by Nikhef CT staff to preserve operational integrity. Users should subsequently refrain for such actions (so do not just try it again) and may work together with system administrators to see if a less disruptive alternative exists.

Other terms

Monitoring and logging of network traffic and e-mail

Systems and networks are constantly monitored to detect problems in time and be able to intervene to prevent damage. This is done only for administrative, operational, security, and systems analysis purposes, and to attribute usage to users and groups. In order to trace problems on the network to the source, logs of all network traffic flows (but not their content) may be kept.

Network traffic may also be analysed and stored, in order to trace the source of network issues, and to be able to detect, resolve, and prevent cyber-security incidents. The retention period depends on the type of traffic, and this data is searchable for no longer than 31 days. The data is destroyed after 45 days, unless it is part of an ongoing forensic investigation. Except during occurances of active cybersecurity incidents, the data is only and exclusively analyzed for known indicators of cybercrime ("indicators of compromise") through automated means. The data will not be searched manually unless there are due reasons to do so. Such manual searches by the Nikhef computer security team are recorded and made available upon request.

Email transactions (sender and recipient, but again not content) are also stored for a period of up to 90 days. Finally, security events related to service access (regarding identity and access rights) are retained for a period of up to 400 days.

Because many systems are backed up automatically, the above-mentioned log and transaction data are subject to a supplementary back-up period of a maximum of 100 days.

This data is only accessible to system administrators and CSIRT members, whose access is controlled based on the usual Nikhef login and password controls.

These data will of course be handled with due care: data that can be traced back to individual users (including email) will only be reviewed if there is a well-founded suspicion of substantial misuse or of illegal activity. We follow the guidelines of the Dutch Data Protection Authorities (Autoriteit Persoonsgegevens) with regard to working in networks.

Would you like to know what (kind of) information is known about you in the logs? Then ask the CT, via helpdesk@nikhef.nl.

Enforcement

Access to services may at any times be suspended or terminated discretionarily for administrative, operational or security purposes. It is common for access to be suspended as part of an incident investigation, even when a violation is merely suspected. As a general matter prior to terminating service, Nikhef will attempt to work with the User to cure violations and to ensure that there is no re-occurrence of the violation.

Liability

In no event will Nikhef be liable to any user or third party for any direct, indirect, special or other consequential damages for actions taken pursuant to this AUP, including, but not limited to, any lost profits, business interruption, loss of programs or other data, or otherwise, even if Nikhef was advised of the possibility of such damages.

Reporting abuse

Complaints regarding violations of this AUP, as well as concerns regarding objectionable material sent from or distributed via Nikhef, will be accepted via e-mail at abuse@nikhef.nl, so long as a valid return address is included. Nikhef must be able to independently verify each instance of abuse: for objectionable email each complaint must include the COMPLETE TEXT OF THE OBJECTIONAL MESSAGE, INCLUDING ALL HEADERS. Please do NOT send excerpted parts of a message; sending a copy of the entire message, including headers, helps to prevent misunderstandings based on incomplete information, or information used out of context. Full headers demonstrate which path the message has taken, and enable us to determine whether any part of the message has been forged. This information is vital to our investigation. If you consider material located on Nikhef resources (e.g. published via its web site) to infringe on your rights, provide the complete URL, the time you visited this URL, and complete and sufficient evidence as to why you consider such a publication to infringe on your rights under Dutch Law.

Responsibility

Nikhef is not responsible for the content of email communications sent by its users, not for information published on user personal home pages. This responsibility rests with the user. At its sole discretion, Nikhef reserves the right to remove materials from its servers and to terminate access to services for the user that Nikhef determines has violated this AUP.

Modifications

Nikhef retains the right to modify the AUP at any time. Such modifications shall become effective at the moment they are adopted by Nikhef and will apply to all users, current and future.

CSIRT

The above text mentions several times the Computer Security Incident Response Team (CSIRT). For more information about the role of this team, see the contact page at http://www.nikhef.nl/security/.

Complaints

Employees who disagree with the application of this policy, should at first contact the head of the CT department, and otherwise consult the NWO-I individual right to complain.