DRAFT -- University of Tennessee, Knoxville

for Implementing the

Policy of the University of Tennessee

The general policy for Use of Information Technology Resources¹⁵ at the University of Tennessee (Policy) contains the governing philosophy for regulating faculty, student, and staff use of the University’s information technology resources. It relates the general principles regarding appropriate use of equipment, software, and networks. By adopting this Policy, the University of Tennessee, Knoxville (UTK) recognizes that all members of the University are also bound by local, state, and federal laws relating to copyrights, privacy, security, and other statutes regarding electronic media. The Policy also recognizes the responsibility of faculty and system administrators to take a leadership role in implementing the Policy and assuring that the University community honors the Policy.

The purpose of the standards described in this document, UTK Information Security Standards (Standards), is to establish the Information Security Program for UTK that implements UT’s Use of Information Technology Resources (Section 175, Part 01, of UT’s Fiscal Policy Manual)¹⁵. The community at UTK is based on principles of honesty, academic integrity, respect for others, and respect for others’ privacy and property.

UTK seeks to:

• protect the confidentiality of data and privacy of its users;

• safeguard the integrity of UTK IT data and resources;
• maintain availability of UTK IT resources with a reasonable response time;
• enforce UTK policies regarding harassment and the safety of individuals;
• protect the University against legal or damaging consequences;

• appropriately respond to claims of infringement of electronically posted copies of copyrighted materials; and

• ensure the use of electronic communications complies with the provisions of the Policy.

The Division of Information Infrastructure (DII) is responsible for the creation and implementation of a cost-effective information infrastructure in which authorized users (e.g., students, faculty, staff, alumni, authorized affiliates, and outside clients) can create and share intellectual and administrative information. The Standards described in this document apply to all UTK computing and networking facilities that are provided for use by these users for legitimate purposes relating to education, research, administration, and outreach activities of the University. These Standards do not apply to open access to library materials required for the general public (which are to be addressed in a separate document); however, access from those library systems to remaining UTK IT resources must be limited and restricted.

The UTK IT resources addressed in these Standards includes any computers, computer systems, networks (including telecommunications equipment, e.g., routers, switches), or other devices that are owned by UTK or are attached to or access UTK network assets (including privately-owned computers or systems). UTK IT data resources include all electronic information, institutional data, documents, messages, programs or system software, or configuration files that are stored, executed, or transmitted via University computers, networks or other information systems.

To protect UTK IT resources, the University reserves the right to restrict access to computers and network systems for electronic communications while responding to and correcting reported or suspected abuse in order to investigate / obtain evidence of violations of UTK policies; other organizational policies; or local, state, or federal laws.

Each departmental unit is responsible for the security on their systems and networks and may apply more stringent security policies while connected to UTK IT resources; however, they must follow these Standards as a minimum or risk losing connectivity to UTK networks.

DII is responsible for identifying a campus Information Security Officer who will coordinate and facilitate the campus Information Security Program. This program will include but not be limited to the following:

• User accountability requirements, e.g., user identification and authentication, account administration, and password integrity;

• Public access restrictions and limitations;

• Authorized access;
• System and data integrity;
• Auditing;
• File backup and recovery;

• Disaster recovery;

• Malicious code protection;

• Configuration security;
• Guest account guidelines;
• Unattended equipment; and
• Incident reporting and response.

System administrator privileges on UTK IT resources confer substantial authority as well as responsibility to all other connected systems and networks. Systems through which intrusions are detected may be disconnected from all other UTK IT resources, in order to isolate the intrusion and protect other systems connected to the network until DII is certain the problem has been adequately resolved and will not reoccur.

System administrators are responsible for the implementation of appropriate technical security on their computer systems. They must remain familiar with the changing security technology that relates to their system and continually analyze technical vulnerabilities and their resulting security implications. Stored authentication data (e.g., password files, encryption keys, certificates, personal identification numbers, access codes) must be appropriately protected with access controls, encryption, shadowing, etc. – for example, password files must not be world-readable.

Systems administrators or designated security officers may supplement this document with more unit-specific and/or stringent guidelines for their users, but cannot lessen these Standards. System administrators and designated security officers shall be trained and certified through the Division of Information Infrastructure’s First Responder program. Equivalent prior training and experience is also acceptable to fulfill this requirement.

System administrators shall perform their duties fairly, in cooperation with the user community, the University administration, and in accordance with University policies. System administrators shall respect the privacy of users unless investigating charges of abuse of privileges and shall refer all reported violations to the appropriate authority (e.g., Student Judicial Affairs, OHRM) for disciplinary action.

System administrators are responsible for ensuring appropriate security is enabled and enforced in order to protect the UTK network to which it is connected. UTK reserves the right to immediately disconnect systems from the network while assessing and/or repairing any discovered or reported security incident in order to minimize risk to the rest of the UTK network.

There is an expectation of confidentiality / privacy on UTK IT resources inherently granted to users; however, although the University cannot guarantee that privacy, it strives to protect it. Users are expected to act in a responsible, ethical, and legal manner with the understanding that UTK’s IT resources are conducted in a public forum – electronic communications, such as electronic mail, are public records that can be used as evidence in a court of law. Users should respect the rights of others (especially rights of privacy and confidentiality), freedom of expression, intellectual property rights, law, and due process.

Users are required to follow the established guidelines and procedures described in these Standards. Although system administrators or designated security officers strive to provide and preserve the security and integrity of files, account numbers, authorization codes, and passwords, security can be breached through actions or causes beyond their reasonable control. Therefore, users are urged to safeguard their data, personal information, passwords, and authorization codes by taking full advantage of file security mechanisms built into the computer’s operating system.

User’s granted root access are also subject to the Standards for system administrators delineated above.

The University will not routinely examine the content of a user’s account space; however, it reserves the right to inspect the account contents and investigate the use of that account when an abuse is suspected or reported.

To protect authorized users from the effects of abuse or negligence, the University reserves the rights to limit, restrict, or terminate any account or use of UTK computer resources, and to inspect, copy, remove, or otherwise alter any data, file, or system resources which undermine authorized use.

The University shall not be liable for inadvertent loss of data or interference with files resulting from this action.

System administrators or designated security officers will ensure that user authentication is required before access to any UTK IT resources is granted and that public and open access is restricted to library materials. All users of UTK IT resources agree to the following rules and responsibilities:

1. No one shall use UTK’s IT resources for personal gain – commercial use of these resources, except for authorized University business, is prohibited.
2. No one shall interfere with the intended use of UTK’s IT resources. All users shall share computing resources (including bandwidth) in an ethical and fair manner in accordance with the policies and criteria set for the systems involved by cooperating fully and not unduly interfering with other authorized users.
3. No one shall perform, participate, encourage, or conceal any unauthorized use or attempts of unauthorized use of UTK IT resources.
4. No one shall use UTK IT communications resources to attempt unauthorized use, or interfere with the legitimate use by authorized users, of other computers or networks elsewhere. Users are responsible for adhering to the policies and standards of such networks. UTK cannot and will not extend any protection to users who violate external network policies. Abuse of networks or computers at other sites through the use of UTK IT resources will be treated as an abuse of UTK IT resource privileges.
5. No one shall install or use network "sniffers" or otherwise inappropriately intercept or monitor a user’s network traffic or data communications without prior approval from DII.
6. No one shall use UTK’s IT resources to transmit abusive or harassing material; chain letters or mass mailings (e.g., "spamming"), or other communications prohibited by law; nor launch denial of service attacks against other users, systems, or networks. Users shall take full responsibility for any electronic messages that are transmitted from their accounts through UTK’s telecommunications networks.
7. No one shall abuse the policies of any newsgroups, mailing lists, and other public forums through which they participate from a University account.
8. No one shall connect any computer or network system to any of UTK’s networks (e.g., direct connection, direct dial-in access) unless it meets the technical and security standards set and approved by DII.
9. No one shall give any account authentication (e.g., password) to an unauthorized person, nor obtain another user’s authentication by any means. Since passwords are the first line of defense to UTK IT resources, users must choose passwords carefully and comply with password guidelines [ref.] for effective password protection.
10. No one shall access UTK IT resources without appropriate authentication. (The only exception to this is restricted open public access for library web materials.) In order to protect UTK IT resources, the use of remote access products requires prior approval from DII to ensure authentication and security functions are implemented.
11. No one shall misrepresent his or her identity or relationship to the University for the purpose of accessing or attempting unauthorized access to UTK IT resources nor misrepresent his or her identity to other networks (e.g., IP address "spoofing") from UTK IT resources.
12. No user shall access (e.g., read, write, modify, delete, copy, move) another user’s files or electronic mail without the owner’s permission regardless of whether the operating system allows this access to occur.
13. No one shall post, copy, install, or use any electronic materials in violation of applicable patent protection and authorizations, copyrights, license agreements, other contracts, or state or federal laws.
14. No one shall knowingly create, install, execute, or distribute any malicious code (e.g., virus, Trojan Horse, worm) or another surreptitiously destructive program on any UTK IT resource, regardless of the result.
15. No one shall modify or reconfigure the software, data, or hardware of any UTK IT resource without appropriate authorization.
16. No one shall knowingly or willingly interfere with the security mechanisms or integrity of UTK IT resources. Users shall not attempt to circumvent data protection schemes or exploit security loopholes.
17. No one shall place confidential information in computers without appropriately protecting it. The University cannot guarantee the privacy of files, electronic mail, or other information stored or transmitted on UTK’s IT resources.
18. No one shall compromise the privacy of others or the confidentiality of the information contained on UTK IT resources.

Abuse of UTK policies or standards, abuse of UTK IT resources, or abuse of other sites through the use of UTK IT resources may result in termination of access, disciplinary review, expulsion, termination of employment, legal action, and/or other appropriate disciplinary action. Notification will be made to the appropriate UTK office, e.g., Office of Human Resource Management, Student Judicial Affairs, Dean of Student Affairs, General Counsel, Office of Human Resource Management, UTK police, or local and federal law enforcement agencies.

System administrators and designated security officers will, when necessary, work with other University offices such as the Dean of Students, UT Police, schools’ and colleges’ disciplinary councils, the General Counsel, Office of Human Resource Management, and others in the resolution of security incidents.

Users are expected to report any information concerning instances in which they suspect or have evidence that the above Standards have been or are being violated.

In general, reports about violations of these Standards should be directed to the administrative office of the school, college, or unit for the system involved. That administrative office will be responsible for immediately forwarding Standards violation reports as well as reporting incidents of unauthorized access to UTK IT resources to the Campus Information Security Officer.

Users may report possible or suspected abuses and violations of these Standards to:

The Digital Millennium Copyright Act (DMCA)³, signed into law on October 28, 1998, amended the copyright law to provide limitations for service provider liability relating to online material.

The University of Tennessee, Knoxville (UTK) is considered an Internet Service Provider (ISP) for its community of students, faculty and staff and, in some cases, for other nonprofit organizations. In order to take advantage of some of the DMCA provisions, UTK must take steps to respond to notices received alleging that someone to whom UTK provides Internet service has infringed the rights of a copyright owner. The DMCA does not require UTK to monitor or affirmatively seek out information about copyright infringement by its users.

All complaints of online copyright infringement will be referred to UTK's registered agent, the UTK Division of Information Infrastructure. Complaints will be handled by the Information Security Officer, who will first determine the nature of UTK's role.

UTK may take advantage of the ISP limitations on liability only if UTK is acting as an ISP, and not as a content provider. The Information Security Officer will make this determination, consulting with the General Counsel's Office as needed.

If the University is eligible for the ISP liability limitation, and the complaint is complete, the Information Security Officer will immediately disable access to the work.

As soon as a complaint is received, the Information Security Officer shall notify the account holder of the allegation of infringement. A standard notification will include a copy of the complaint, information on counter notification, put back, and basic copyright rights and responsibilities. This will allow the account holder to voluntarily remove the challenged material or formulate a counter notification of fair use. Under certain circumstances it may be appropriate for the University to participate in the determination of whether fair use or some other exemption may apply that would allow the work to continue to be used.

If the material is to remain down, it is important that the account holder understands why a complaint was made and agrees to refrain from further infringements.

If the account holder files a counter-notification claiming that the work is misidentified, or the owner is mistaken and the use is lawful, the Information Security Officer will send the counter-notification to the complainer, explaining that the material will be put back in fewer than 10 to 14 days.

Access to the material will be re-established in fewer than 10 to 14 days unless the complainer sends notice that a court order is being sought or other legal action will be taken.

Account holders who infringe the rights of a copyright owner may be subject to disciplinary action. Students will be referred to the Dean of Students and the student judicial process. Faculty will be referred to the Provost and appropriate Dean. Staff will be referred to the Office of Human Resource Management and the appropriate Vice Chancellor.

Allegations of infringement for which UTK is the content provider and for which UTK is not eligible for liability limitation as an ISP will be referred to both the account owner and the General Counsel's Office. UTK shall respond to these allegations by conducting an investigation into whether the allegedly infringing materials are authorized by law or otherwise do not infringe on copyright protections.

ATTACHMENT A: GLOSSARY OF SECURITY TERMS⁸