ANNEXES Sample Acceptable Use Policy OBJECTIVE Computer assets The purpose of this policy is to establish acceptable and unacceptable uses of the electronic devices and network resources that belong to CSIRT-XX. It has been drafted to conform with established legal, and ethical norms, and relies on trust, integrity, and transparency of the activities of the CSIRT. You are responsible for ensuring the protection of the assets you were assigned by CSIRTXX. This includes the use of computer lock cables and any other security devices. Laptops that are left overnight at the CSIRT-XX should be placed in a locked drawer or a cabinet. Any theft or loss of equipment must be reported to CSIRT-XX management immediately. CSIRT-XX operates computing devices, networks and other information systems in order to carry out its mandates, objectives and initiatives. All such devices must be managed responsibly to maintain the confidentiality, integrity and availability of information assets that CSIRT-XX has in its possession or works with. All personal workstations and devices must be secured with a password protected screen saver, and you must lock the screen or log out when the workstation or device is unattended. Moreover, the the autolock function should be activated as set in the workstation setup procedure. Any devices you connect to the CSIRT-XX network must meet the Minimum Access Policy. This policy requires users of the devices and network resources to accept and comply with the policies defined, so as to protect CSIRT-XX, its personnel, its operations, and its partners, from damage and lawsuits. SCOPE Internet and Electronic Communications Use You are responsible for the security and proper use of network resources and tools under your control. It is strictly prohibited to use resources in such a manner that they: All employees, contractors, consultants, interns and others who work directly or indirectly in CSIRT-XX, including all personnel affiliated with third parties, must comply with this policy. This policy applies to information assets that are owned or leased by CSIRT-XX, or to devices that connect to CSIRT-XX’s network or that are hosted on a site belonging to CSIRT-XX. • • • • • Cause a security breach or violation in one or more CSIRT-XX network resources; Cause a service interruption to one or more CSIRT-XX network resources; Violate the provisions of copyright law; Violate established security policies of local laws; Support any illegal activity, including by transmitting or aiding in the transmission of material that violates policies that protect confidential or proprietary information; and • Misrepresent, obfuscate, delete or replace a user identity in any electronic communication in order to mislead the recipient about who the sender is. In extenuating circumstances, exceptions may be approved by CSIRT-XX management that would contravene this policy. Any exceptions must be formally approved in writing and include a justification and evaluation of possible risks of such an exception. STATEMENT OF POLICY Finally, you must exercise good judgment to avoid misrepresenting or exceeding your authority in representing the views of CSIRT-XX to the public. General Requirements As an employee of CSIRT-XX, you are responsible for exercising good judgment regarding the appropriate use of CSIRT-XX resources in accordance with the policies and procedures established by the CSIRT-XX. CSIRT-XX resources may not be used for illegal purposes or that are in violation of CSIRT-XX’s Ethics Policy. System Accounts APPLICATION An employee found in violation of this policy or any other CSIRT-XX policies is subject to disciplinary action, possibly including termination of employment. A violation of this policy by a temporary employee, contractor or supplier may result in termination of the contract or assignment with CSIRT-XX. You are responsible for the security of the data, accounts and systems under your control. Keep secure passwords and do not share your account information or password with anyone, including other staff members, relatives or friends. Facilitating access to another person, whether intentionally or due to failure to ensure access is a violation of this policy. You must maintain a level of user and system passwords according to the Password Policies. You must ensure, through legal or technological means, that the information with which you work remains under the control and management of CSIRT-XX at all times. Storage, access, or use of confidential information in environments or applications run by a third party or not directly operated or controlled by CSIRT-XX is prohibited. This includes devices that are maintained by third parties with which there is no contractual agreement in place. This specifically prohibits the use of an email account that has not been provided by the CSIRTxx to exchange information owned by the CSIRTxx. 88 89