Difference between revisions of "Acceptable Use Policy"

From PDP/Grid Wiki
Jump to navigationJump to search
Line 12: Line 12:
 
# <div class="NavFrame collapsed"><div class="NavHead">Protect your access keys (passwords, private keys, security tokens)</div><div class="NavContent">You are responsible for anything that is done under your account, so by sharing credentials you become responsible for the other persons behaviour. You can and should not be. Access keys are yours and yours only: so do not share your credentials with others. These include your single-sign-on (SSO) password, the pass phrase for your certificate's key, the password that protects your SSH key pair. If you feel the need to share, there is always a proper solution. Be careful with your passwords: do not write them down on note paper or in your agenda, but use a storage system intended for such purpose. Also, any credential that grants to access to other services (at Nikhef or elsewhere) must be protected with at least a password or better.<br><b>If you think your credentials have been stolen of sniffed, inform the help desk immediately (phone 2200)</b> and - if possible - change them from a trusted computer and location. If Nikhef suspects abuse of your login credentials, access to your account will typically be suspended as an immediate security measure (see: [[#Enforcement|Enforcement]]).<br>If you have been given credentials for special services (such as a VoIP telephony roaming password, or access to a generic account) you must protect these according to the specific instructions given to you.</div></div>
 
# <div class="NavFrame collapsed"><div class="NavHead">Protect your access keys (passwords, private keys, security tokens)</div><div class="NavContent">You are responsible for anything that is done under your account, so by sharing credentials you become responsible for the other persons behaviour. You can and should not be. Access keys are yours and yours only: so do not share your credentials with others. These include your single-sign-on (SSO) password, the pass phrase for your certificate's key, the password that protects your SSH key pair. If you feel the need to share, there is always a proper solution. Be careful with your passwords: do not write them down on note paper or in your agenda, but use a storage system intended for such purpose. Also, any credential that grants to access to other services (at Nikhef or elsewhere) must be protected with at least a password or better.<br><b>If you think your credentials have been stolen of sniffed, inform the help desk immediately (phone 2200)</b> and - if possible - change them from a trusted computer and location. If Nikhef suspects abuse of your login credentials, access to your account will typically be suspended as an immediate security measure (see: [[#Enforcement|Enforcement]]).<br>If you have been given credentials for special services (such as a VoIP telephony roaming password, or access to a generic account) you must protect these according to the specific instructions given to you.</div></div>
 
# <div class="NavFrame collapsed"><div class="NavHead">Report suspected security breaches and misuse</div><div class="NavContent">When you discover vulnerabilities, witness abuse, or see other forms of non-acceptable use, you should report these incidents to the Nikhef [http://www.nikhef.nl/security <i>Computer Security Incident Response Team</i> (CSIRT)] through the helpdesk ([mailto:helpdesk@nikhef.nl helpdesk@nikhef.nl]). Do not take any action, but await further instructions. Of course, you should not attempt to exploit such vulnerabilities to circumvent security controls or harm Nikhef, it's services, staff or reputation in any way - such attempts in itself are a violation of this Acceptable Use Policy.</div></div>
 
# <div class="NavFrame collapsed"><div class="NavHead">Report suspected security breaches and misuse</div><div class="NavContent">When you discover vulnerabilities, witness abuse, or see other forms of non-acceptable use, you should report these incidents to the Nikhef [http://www.nikhef.nl/security <i>Computer Security Incident Response Team</i> (CSIRT)] through the helpdesk ([mailto:helpdesk@nikhef.nl helpdesk@nikhef.nl]). Do not take any action, but await further instructions. Of course, you should not attempt to exploit such vulnerabilities to circumvent security controls or harm Nikhef, it's services, staff or reputation in any way - such attempts in itself are a violation of this Acceptable Use Policy.</div></div>
# <div class="NavFrame collapsed"><div class="NavHead">Do no harm to Nikhef, it's services, staff or reputation</div><div class="NavContent">Harm is more easily done than repaired! Data is easily deleted or modified but hard or impossible to recover. A rash document (as well as of course offensive material) put up on your home page is quickly indexed by search engines and will never disappear from the web. Confidential data accidentally disclosed will never be secret again. A defamatory remark will live forever in cyberspace. An infected home laptop or smart phone will quickly poison other systems at Nikhef and many person months will be wasted to recover from the incident. So do no harm.</div></div>
+
# <div class="NavFrame collapsed"><div class="NavHead">Do no harm to Nikhef, it's services, staff or reputation</div><div class="NavContent">Harm is more easily done than repaired! Data is easily deleted or modified but hard or impossible to recover. A rash document (as well as of course offensive material) put up on your home page is quickly indexed by search engines and will never disappear from the web. Confidential data accidentally disclosed will never be secret again. A defamatory remark will live forever in cyberspace. An infected home laptop or smart phone will quickly poison other systems at Nikhef and many person months will be wasted to recover from the incident. So be mindful as well as careful.</div></div>
 
# <div class="NavFrame collapsed"><div class="NavHead">Comply with the policies of Nikhef's service providers</div><div class="NavContent">Nikhef provides access to and brokers services of third parties for its users, such as connectivity to the public Internet through SURFnet, access to Federated Services, or other hosted services like backup and calendering. You should at all times comply with the policies, terms and conditions of use of these service providers. </div></div>
 
# <div class="NavFrame collapsed"><div class="NavHead">Comply with the policies of Nikhef's service providers</div><div class="NavContent">Nikhef provides access to and brokers services of third parties for its users, such as connectivity to the public Internet through SURFnet, access to Federated Services, or other hosted services like backup and calendering. You should at all times comply with the policies, terms and conditions of use of these service providers. </div></div>
 
# <div class="NavFrame collapsed"><div class="NavHead">You share resources with others - be nice</div><div class="NavContent">Even when staying within the intended use, it is quite possible to strain resources to such an extent that other users can no longer make use of them. Running CPU intensive applications on the general login server, or using this service for bulk data transport are some examples. Making an outbound telephone call for a phone conference and then put it on hold, but subsequently forget about it - exhausting our telephone lines as well as incurring a high bill. When such incidents are detected, the program or call in question will be terminated by Nikhef CT staff to preserve operational integrity. Users should subsequently refrain for such actions (so do not just try it again) and may work together with system administrators to see if a less disruptive alternative exists.</div></div>
 
# <div class="NavFrame collapsed"><div class="NavHead">You share resources with others - be nice</div><div class="NavContent">Even when staying within the intended use, it is quite possible to strain resources to such an extent that other users can no longer make use of them. Running CPU intensive applications on the general login server, or using this service for bulk data transport are some examples. Making an outbound telephone call for a phone conference and then put it on hold, but subsequently forget about it - exhausting our telephone lines as well as incurring a high bill. When such incidents are detected, the program or call in question will be terminated by Nikhef CT staff to preserve operational integrity. Users should subsequently refrain for such actions (so do not just try it again) and may work together with system administrators to see if a less disruptive alternative exists.</div></div>

Revision as of 13:52, 28 June 2012

Nederlandse versie: Gebruiksvoorwaarden


Acceptable Use

This Acceptable Use Policy governs the use of the Nikhef networking and computer services; all users of these services are expected to understand and comply to these rules.

Legalese

Monitoring and logging of network traffic and e-mail

Systems and network are monitored in order to detect trouble in an early stage and rapidly mitigate potential damage, for administrative, operational, accounting, monitoring and security purposes only. In order to trace problems on the network to the source, logs of all network traffic flows (but not their content) may be kept for a period of up to 14 days. E-mail transactions (its source and destinations, but again not its content) are also logged, in a secured system, and retained for a maximum of 90 days. Access, authentication and authorization (collectively "security") logs are kept for a period of up to 400 days.

Because most systems are periodically backed up, the above log data is effectively kept for for an additional period of 100 days.

This data is only accessible by Nikhef system administrators and CSIRT members, as authenticated per the usual Nikhef login/password access control.

Obviously, user data, including stored e-mail, will only be inspected if there is a strong and substantiated suspicion of misuse of services or illegal activities. If you want to know what kind of logs are kept about your use of ICT services, you can always contact the CT department. We follow CBP guidance on working in networks.

Enforcement

Access to services may at any times be suspended or terminated discretionarily for administrative, operational or security purposes. It is common for access to be suspended as part of an incident investigation, even when a violation is merely suspected. As a general matter prior to terminating service, Nikhef will attempt to work with the User to cure violations and to ensure that there is no re-occurrence of the violation.

Liability

In no event will Nikhef be liable to any user or third party for any direct, indirect, special or other consequential damages for actions taken pursuant to this AUP, including, but not limited to, any lost profits, business interruption, loss of programs or other data, or otherwise, even if Nikhef was advised of the possibility of such damages.

Reporting abuse

Complaints regarding violations of this AUP, as well as concerns regarding objectionable material sent from or distributed via Nikhef, will be accepted via e-mail at [1], so long as a valid return address is included. Nikhef must be able to independently verify each instance of abuse: for objectionable email each complaint must include the COMPLETE TEXT OF THE OBJECTIONAL MESSAGE, INCLUDING ALL HEADERS. Please do NOT send excerpted parts of a message; sending a copy of the entire message, including headers, helps to prevent misunderstandings based on incomplete information, or information used out of context. Full headers demonstrate which path the message has taken, and enable us to determine whether any part of the message has been forged. This information is vital to our investigation. If you consider material located on Nikhef resources (e.g. published via its web site) to infringe on your rights, provide the complete URL, the time you visited this URL, and complete and sufficient evidence as to why you consider such a publication to infringe on your rights under Dutch Law.

Responsibility

Nikhef is not responsible for the content of email communications sent by its users, not for information published on user personal home pages. This responsibility rests with the user. At its sole discretion, Nikhef reserves the right to remove materials from its servers and to terminate access to services for the user that Nikhef determines has violated this AUP.

Modifications

Nikhef retains the right to modify the AUP at any time. Such modifications shall become effective at the moment they are adopted by Nikhef and will apply to all users, current and future.

CSIRT

The above text mentions several times the Computer Security Incident Response Team (CSIRT). For more information about the role of this team, see the contact page at http://www.nikhef.nl/security/.

Complaints

Employees who disagree with the application of this policy, should at first contact the head of the CT department, and otherwise consult the FOM algemeen klachtrecht (UR-17) (in dutch).