5.1. Basic Security Elements

5.1.1. Identification

A unique user identification code, called a user ID, is used to represent a user’s identity to the system. This user ID is used for authorization, authentication, and auditing purposes.

5.1.1.1. Users must be uniquely identified to provide individual accountability.

5.1.1.2. A unique user ID will be assigned to individuals and used for identification of that individual.

5.1.2. Authentication

Authentication is the process of identifying a unique user or device. This is done by an authentication mechanism. The most common of which is having a user type their username and password at an authentication prompt.

5.1.2.1. Users must be authenticated when accessing computer, voicemail, and other services made available through the network.

5.1.3. Authorization

5.1.3.1. Individual users and devices shall be authorized to access to needed resources, as well as denied or restricted access to unnecessary resources.

5.1.3.2. Accessing or attempting to access resources without receiving authorization from the proper authority is prohibited.

5.1.4. Passwords

All passwords used on the network should be:

5.1.4.1. Not in plain English.

5.1.4.2. Difficult to guess.

5.1.4.3. Kept secret.

5.1.4.3.1. Not written down.

5.1.4.3.2. Not shared with others.

5.2. Personal Use

5.2.1. Use of Information Systems

The users of information technology systems must utilize the systems in a legal, responsible manner.

5.2.1.1. The systems and network shall not be used to generate, access or distribute material that is illegal or immoral or contravenes the principles of the district.

5.2.1.2. Use of the network and systems for commercial purposes is prohibited.

5.2.2. Privacy

The protection of the privacy of personal information, of staff and students, is of utmost importance.

5.2.2.1. The entire system will adhere to relevant local, state and federal privacy and protections acts, including, but not limited to: HIPPA, FERPA and SIP.

5.2.2.2. The entire system and all users must adhere to privacy regulations put forth in the FMS board policy.

5.3. Network

5.3.1. Users of the network

The network is in place for the educational, professional and legal purposes of the school district. Access to the system is permitted only to the following:

5.3.1.1. Staff, who have accepted the board policy (which includes this document).

5.3.1.2. All FMS students immediately upon their enrollment in the district. Students are automatically subject to the district Board Policy, which refers to this document.

5.3.1.3. Others who have been authorized to use the network by the district IT department, or other appropriate administration. (Examples include, but are not limited to: contract or maintenance workers, guests making sales presentations, and other non-student/non-staff users.)

5.3.1.3.1. In such situations, access is only granted to the necessary systems.

5.3.2. Remote Network Access

Employees may request or require access to the systems from network locations that are outside of the district network. This remote access may be granted when adhering to the following stipulations:

5.3.2.1. Appropriate justification is given for such access.

5.3.2.2. Required security measures are in place.

5.3.2.3. These requests must not compromise the security of the systems, network or data.

5.3.2.4. They must also follow the previously established requirements of the security policy.

5.3.3. Third Party Access

Third parties may request access to computing systems for contract work or to conduct special projects such as contract or maintenance agreement fulfillment. These requests should adhere to the following guidelines:

5.3.3.1. Have the appropriate approval

5.3.3.2. Be subject to stringent security mechanisms such as specific location access, time of day limitations, or other limitations.

5.3.3.3. These requests must not compromise the security of the systems, network or data.

5.3.3.4. They must also follow the previously established requirements of the security policy.

5.3.4. Privacy of Communications

The network is the property of the district. Users should not assume that their use of the network is private. The position of the district on the privacy of voice, data, fax & other communications across the network is as follows:

5.3.4.1. Electronic communications & all other network use may be subject to review, depending on the district principles and culture and the level of concern for the protection of sensitive information.

5.3.4.2. Review of electronic communications may also be required when investigating any breaches of district policy.

5.4. Software Policies

5.4.1. Software Copyright

Copyright laws protect the right of software manufacturers to create and distribute their software. Restrictions on use are included in manufacturers’ licensing agreements, which accompany each software package. The licensing agreement will stipulate the number of machines that may have the software installed on them. Violation of copyright laws is a serious offense and can subject the district to legal action.

5.4.1.1. The entire district will strictly adhere to the licensing agreements for all software used.

5.4.1.2. If additional licenses are needed for any software program they must be legally obtained. This may include the purchase of a site license (school or district). Such acquisitions must be made through the appropriate channels within the school or district.

5.4.2. Software Ownership

Any software program has the potential to disrupt the availability of the IT network (whether the local computer, network or otherwise). Further, the district is liable for software licensing violations in the network. Knowledge, control and approval of all software programs installed on the District computer network should be maintained by the appropriate entities (Site/District IT).

5.4.2.1. All software installed in the district network must be owned by / licensed to the district, except where an explicit exception is made by the proper authority (site/district IT department).

5.4.2.2. Approval is necessary in order to ensure:

5.4.2.2.1. The compatibility and validity of software programs.

5.4.2.2.2. Appropriate software licensing.

5.5. Other Policies

5.5.1. Physical Security

A secure, protected environment is essential for efficient system operation of all components of the network.

5.5.1.1. Physical access to areas containing data processing facilities is restricted to those with a clear need for access.

5.5.1.2. Prior to any equipment being checked out or leaving its primary location, the appropriate school/district check-out/release procedure must be completed. (This includes, but is not limited to computers, digital/video cameras, projection units, etc.)

5.5.1.3. Connecting devices to the network, if not owned by the district (e.g. personal property of staff or other ownership), is prohibited, with the exception of removable storage devices used exclusively for the purposes of backing up and transferring data. This use must not violate any other section of the security policy or the board policy.

5.5.2. Use of Standards

The adoption of standards is an important principle providing direction for information technology systems. These standards aid in establishing interoperability & portability of applications & communications, in a networked environment.

5.5.2.1. Technologies adopted and implemented in the district, must operate cleanly with the existing standards in place on the network.

5.5.3. Fax & Voicemail (Unified Communications)

Normally the fax and voicemail component of the communications in a district are separate from other data and are often overlooked when considering security and integrity. Farmington Municipal Schools has implemented an integrated, unified communications system that places electronic mail, data, fax and voice on the same network.

5.5.3.1. With the integrity of the network system impacting all electronic information (mail, data, voice) it is imperative that security be implemented on a scale that incorporates all potential weak points.

5.5.3.2. All fax, voice and voicemail use must conform to this policy.

Farmington Municipal Schools

Technology Security Policy

1. Introduction

2. Scope & Definitions

3. Enforcement

4. Compliance with the Policy

5. Policy Statement

6. Acceptable Use

7. Summary