Malware/Virus and Spam and Phishing Policy.

Computer malware can impact productivity, incur financial costs and can result in the compromise or loss of data and reputation. 
Viruses can originate from a range of sources, spread rapidly, and require a comprehensive approach to ensure the risk they pose is effectively managed. This comprehensive approach requires the full co-operation of all Externis employees.
This Anti-Virus and Anti-Spam Policy and outlines the overall approach adopted by Externis as well as individual responsibilities.
All Externis network users have a responsibility to protect their systems from malware infection and follow the guidelines on spam email as outlined below:

Virus Prevention - Network Users Responsibilities

• All users have a responsibility to protect any device, which they use which connects to the Externis network by ensuring that they have the installed the correct anti-virus product for their area and that it is up-to-date. This relates to Externis owned machines and user’s private machines where the machines are used to access the Externis network.
• Users must not try to install an unapproved anti-virus product or try to alter the configuration or disable the existing anti-virus product.
• Users must install when requested by IT Services any software, which is for the prevention of or monitoring of malware infections.
• Users must ensure that all relevant software security updates are applied to their computer. Users are advised to use the Windows update service for all Microsoft operating systems, and the equivalent update service for other types of operating system.
• Users must scan their hard drives regularly for malware.
• Users should not open suspicious emails or attachments whether solicited or unsolicited from unknown or unusual sources.
• Users should scan all software or other content that they download from the Internet for viruses.
• Users should exercise caution when downloading software from the Internet and only install software from reputable Internet sites.

Where malware is detected by a User

• All users must respond to any malware infection detection indicated by their anti-virus software.
• In the event that a user is unable to clean or remove an infected file they should disconnect their PC from the Externis network by removing the network cable and deactivating the WIFI connection and inform the IT Services of the problem immediately.
• All users should be alert to the possibility of malware and report any suspicious behavior to  the IT Services  immediately.

Unsolicited Email (Spam) User Responsibilities

• Users should exercise caution when divulging their Externis Email account to third parties. Some organizations may provide your email address to parties involved in sending unsolicited emails (Spam), which may result in increased volumes of spam email being sent to your account.
• IT Services provide a Spam filtering service for users of the Externis email system. All users should report any spam that they receive using the method advised by IT Services in order to improve the overall efficiency of the system.

Phishing - User Responsibilities

• Phishing is a form of online fraud. In a typical phishing incident, a user may receive an email or pop-up message that claims to be from IT Services or another business or organization that they may have previously dealt with.
• Externis employees must treat any email that asks for their Externis username and password details with extreme caution.
• Any user who suspects that they have fallen for a phishing attack and compromised their Externis username and password must immediately change their password and inform IT Services.

Virus and spam Prevention - Administrative responsibilities

IT Services must:

• Select an effective desktop anti-virus product.  This product must be licensed and made available to all users connecting to the Externis network.
• Monitor systems regularly for devices that do not have anti-virus software installed or have incorrect anti-virus products or settings.
• Provide a central point of contact to Externis users for malware matters.
• Keep abreast of potential malware that may affect Externis.
• Promote awareness of malware issues amongst users.
• Follow up on and evaluate any malware reports from users and make recommendations which may include informing users of the problem by email alert, intranet, etc..
• During a malware outbreak incident, provide whatever assistance is required to disinfect the device and prevent propagation.
• In the event of an incident the official source of updated information will be the IT Services.
• IT Services running approved Externis email systems must scan all incoming and outgoing email at the mail gateway for viruses using a reputable malware scanning product. This is to prevent mass propagation of viruses through email systems.
• IT Services  running approved Externis email systems must offer a high-quality spam filtering service to all users.