MIS Offcie Policy

MIS Office security policies

Password Policies:

Purpose: The purpose of this Guideline is to educate employees on the characteristics of a Strong Password as well as to provide recommendations on how to securely maintain and manage passwords.

Applies to: This Guideline applies to all employees that have a username and password to at least one University system or application, independent of whether you are an end user or a

                   system administrator for that system or application.

Password Guidelines:

The following are general recommendations for creating a Strong Password:

A Strong Password should -

·         Be at least 8 characters in length

·         Contain both upper and lowercase alphabetic characters (e.g. A-Z, a-z)

·         Have at least one numerical character (e.g. 0-9)

·         Have at least one special character (e.g. ~!@#$%^&*()_-+=)

Strong Passwords do not -

·         Spell a word or series of words that can be found in a standard dictionary

·         Spell a word with a number added to the beginning and the end

·         Be based on any personal information such as user id, family name, pet, birthday, etc.

·         The following are several recommendations for maintaining a Strong Password:

o   Do not share your password with anyone for any reason

o   Change your password upon indication of compromise

o   Consider using a passphrase instead of a password eg. "My passw0rd is $uper str0ng"

o   Do not write your password down or store it in an insecure manner

o   Avoid reusing a password

o   Avoid using the same password for multiple accounts

o   Do not use automatic logon functionality

o   Do not use Restricted data for initial or “first-time” passwords, Restricted data includes, but is not limited to, social security number, name, date of birth, etc.

Clean desk Policy:

Purpose: To maintain the security and privacy of employees’ and members’ personal information, employees should observe the “clean desk” rule.

All employees should take appropriate actions to prevent unauthorized persons from having access to member information, applications, or data.

Employees are also required to make a conscientious check of their surrounding work environment to ensure that there will be no loss of confidentiality to data media or documents.

• ·         Sensitive working papers are expected to be placed in locked drawers when staff are away from their desks for extended periods of time.
• ·         All office papers are expected to be stored securely at the end of the working day.
• ·         Consider scanning paper items and storing them securely in Microsoft OneDrive.
• ·         Secure portable computing and storage devices such as laptops, handheld devices, CDROMs, DVDs or USB drives.
• ·         If needed, allocate appropriate time in your schedule to clean up documents on your desk and devices.
• ·         Computer workstations must be locked when the desk is unoccupied and completely shut down at the end of the work day.
• ·         Keys for accessing drawers or filing cabinets should not be left unattended at a desk.
• ·         All wastepaper which contains sensitive or confidential information must be placed in the designated confidential waste bins.

             Under no circumstances should this information be placed in regular wastepaper bins.

·         Printers and fax machines should be treated with the same care under this policy:

o   Any print jobs containing sensitive and confidential paperwork should be retrieved immediately. When possible, the “Locked Print” functionality should be used.

o   All paperwork left over at the end of the work day will be properly disposed of.

Email usage policy:

·         Inappropriate use of company email

o   Sign up for illegal, unreliable, disreputable or suspect websites and services.

o   Send unauthorized marketing content or solicitation emails.

o   Register for a competitor’s services unless authorized.

o   Send insulting or discriminatory messages and content.

o   Intentionally spam other people’s emails, including their coworkers.

·         Email security

o   Select strong passwords with at least eight characters (capital and lower-case letters, symbols and numbers) without using personal information (e.g. birthdays.)

o   Remember passwords instead of writing them down and keep them secret.

o   Change their email password every two months.

o   Avoid opening attachments and clicking on links when content is not adequately explained (e.g. “Watch this video, it’s amazing.”)

o   Be suspicious of clickbait titles.

o   Check email and names of unknown senders to ensure they are legitimate.

o   Look for inconsistencies or style red flags (e.g. grammar mistakes, capital letters, excessive number of exclamation marks.)