information is on an externally hosted service, backup by that service provider or backup to customer site must be considered for that service and included within that Service Level Agreement. Data and information stored on the local drive of a computer is not automatically backed up. Backup of these devices is the responsibility of the users. Desktop and Mobile Device Timeout and Log Out Standards With the large number of staff and common use computers and the increasing use of mobile and wireless devices throughout the University, it is essential that unauthorised system access is prevented from these devices. Where appropriate, device timeouts will be implemented to lockdown the device so that and access would require entry of a password. Wherever possible, enforced timeouts to be implemented at the following levels: Screensaver level Page level Session level. application level Users of common use equipment should ensure they log out of those devices on every occasion to avoid the potential of subsequent users utilising the previously logged-in credentials of the first user to access the internet or web-based applications. Operational Security PROCEDURES Documentation Operating Procedures When documenting operating procedures and processes, consideration will be to the following: User manuals to be maintained on all current hardware, software applications and developed systems; Authorisation processes for approving all changes to enterprise information facilities, operating systems, software applications and hardware to be in place; Procedures to be in place for recording and monitoring of security violations and exposures. Change Control To minimise threats to operational environments, consideration will be given to the following: Ensuring operational environments are under change control and any changes are subject to the Request for Change (RFC) process. Ensuring adequate testing and change control mechanisms are in place for the migration of new or modified systems into the operational environment; Ensuring that the information environment is managed so that future expansions or changes can be accommodated and do not adversely impact the operational environment. Malicious Software There are many types of malicious software that can severely impact information systems, data and networks and undermine the integrity, confidentiality and availability of information. To minimise threats to the University’s operational environment, consideration will be given to the following activities: Virus Detection and Scanning All operational computer equipment to have the current version of anti-virus software installed and operational; server scans to be run on a regular basis, anti-virus software to be configured in mode to ensure any infections are identified and cleaned immediately upon “real-time” detection;
information is on an externally hosted service, backup by that service provider or backup to customer site must be considered for that service and included within that Service Level Agreement. Data and information stored on the local drive of a computer is not automatically backed up. Backup of these devices is the responsibility of the users. Desktop and Mobile Device Timeout and Log Out Standards With the large number of staff and common use computers and the increasing use of mobile and wireless devices throughout the University, it is essential that unauthorised system access is prevented from these devices. Where appropriate, device timeouts will be implemented to lockdown the device so that and access would require entry of a password. Wherever possible, enforced timeouts to be implemented at the following levels: Screensaver level Page level Session level. application level Users of common use equipment should ensure they log out of those devices on every occasion to avoid the potential of subsequent users utilising the previously logged-in credentials of the first user to access the internet or web-based applications. Operational Security PROCEDURES Documentation Operating Procedures When documenting operating procedures and processes, consideration will be to the following: User manuals to be maintained on all current hardware, software applications and developed systems; Authorisation processes for approving all changes to enterprise information facilities, operating systems, software applications and hardware to be in place; Procedures to be in place for recording and monitoring of security violations and exposures. Change Control To minimise threats to operational environments, consideration will be given to the following: Ensuring operational environments are under change control and any changes are subject to the Request for Change (RFC) process. Ensuring adequate testing and change control mechanisms are in place for the migration of new or modified systems into the operational environment; Ensuring that the information environment is managed so that future expansions or changes can be accommodated and do not adversely impact the operational environment. Malicious Software There are many types of malicious software that can severely impact information systems, data and networks and undermine the integrity, confidentiality and availability of information. To minimise threats to the University’s operational environment, consideration will be given to the following activities: Virus Detection and Scanning All operational computer equipment to have the current version of anti-virus software installed and operational; server scans to be run on a regular basis, anti-virus software to be configured in “real-time” mode to ensure any infections are identified and cleaned immediately upon detection;
Information-Security-Policy-Schedule-A-Roles-Standards-Operational-Procedures.docx