Network Security Policy

The Externis IT network consists of an interconnection of networked devices. These include computers, printer’s network cables and other networking equipment. Externis depends heavily upon its IT network for research, development and administrative activities. It is essential that the stability, integrity and security of the Externis IT network be safeguarded. 
This policy defines the Externis regulations regarding access to the Externis Network. All Network Users must comply with the following policy statements:

Network Administration Roles and Responsibilities

• IT Services are responsible for the administration of the Externis backbone network and primary software domains.
• The administration of the Externis network including, network connections, services, addressing and design is the responsibility of the IT Services and delegated agents.
• Multiple authorized software domains exist within the Externis network. The administration of these domains including user accounts and other access controls is the responsibility of the appointed administrator.

Connection to the Externis Network

• Connection to and use of Externis network facilities is dependent on compliance with all published IT Services and Externis Policies.
• All equipment connected to the Externis network must conform to the appropriate standards as set periodically by IT Services and run only across the backbone using protocols supported by Externis.
• Only IT Services may connect devices to the Externis Network.
• Side-entry connections to the Externis network, for example via modem connection to the asynchronous port of a workstation, or via wireless devices are permitted only with the permission of IT Services.

Wireless Networking

The Director of IT Services is responsible for providing a secure and reliable network. Under this broad responsibility, the following wireless policies apply:

• Only hardware and software consistent with wireless standards approved by the IT Services shall be used for wireless access points.
• All wireless access points shall be registered with IT Services. In the event that a wireless device interferes with other equipment, the Director of IT Services shall resolve the interference as determined by use priority.
• Deployment and management of wireless access points in common areas of the Externis Office is the responsibility of Information Systems Service.

Network Access Controls

Access to Externis network and facilities is restricted to fully authorized Externis users. Users are required to login to an authorized domain using a secure login-name/password combination. Additional authentication mechanisms may be required if IT Services deem it necessary. 
IT Services must ensure that only authorized Externis users have access to the network from their systems.

Connection of Privately Owned Equipment

Employees may connect computing equipment to the Externis network only with the permission of IT Services. Such systems are then subject to all the statutory and Externis rules/regulations/policies currently in force and which are applicable to the fields of computer information systems.
Employees may connect private equipment using the relevant service/procedure in the manner outlined by IT Services.
In general users may connect private equipment to the network by following the procedures outlined by IT Services. All private equipment must meet minimum hardware/software requirements and pass appropriate security checks as defined and updated by IT Services.

Network Administration

All network addresses; including IP addresses, must be allocated and administered by IT Services.
IT Services must be informed of any proposed physical re-organization of the network. This includes requests for extra cabling or the insertion of wireless networking devices.  IT Services may, on behalf of Externis, and subject to appropriate consultations, restrict excessive use of the backbone bandwidth.
In the event of unacceptable network events occurring on the network, IT Services has the right to gain access to and inspect the configuration of devices or equipment on that network and to request the immediate removal of any devices or equipment that it believes could be the source of the problem.
In the event of unacceptable events on a network causing problems on another part of the Externis network or on an external network, IT Services has the right to disable any part of the network as necessary, to remove the source of the problem. 

Use of Network Facilities

All Network Users must comply with the following conditions of use which apply to the Externis network and all attached devices:

• Use of the Network facilities including but not limited to the network, workstations, printers and the facilities associated with it e.g. software, data, email, world wide web (www), bulletin boards, data is subject to Externis Code of Conduct.
• Users should not use or produce materials or resources to facilitate unauthorized corruption, changes, malfunction or access to any Externis or Network facilities.
• Users should not display, store or transmit images or text which could be considered offensive : material of a sexual, pornographic, pedophilic, sexist, racist, libelous, threatening, defamatory nature, of a terrorist nature or likely to bring Externis into disrepute.
• Users must not forge email signatures and/or headers, initiate and/or forward ‘chain’ or ‘junk’ or ‘harassing’ mail.
• Users should comply with all relevant IT legislation as outlined in the Information Systems Security Policy.
• When holding data on computers about living individual’s users must register the data and its uses in accordance with the General Data Protection Regulation.
• Whilst Externis takes appropriate security measures against unauthorized access to, alteration, disclosure, destruction or accidental loss of personal and other data it cannot and does not give any warranties or undertakings to the user about security, confidentiality or integrity of data, personal or other. The same applies to other IT material submitted to or processed on facilities provided or managed by Externis or otherwise deposited at or left on its premises.
• A user’s name, address, photograph, status, e-mail name, login name, alias and other related information will be stored in electronic form for use for administrative and other operational purposes.