National Labor College • Course Catalog 2013–2014 • www.nlc.edu such as thumb drives, cameras, MP3 players and PDAs; removable hard drives (including hard drive-based MP3 players); optical disks such as CD and DVD disks; floppy disks and any commercial music and software disks not provided by NLC. To minimize the risk of loss or exposure of sensitive information maintained by NLC and to reduce the risk of acquiring malware infections on computers operated by NLC, users may only use NLCapproved removable media on their work computers. NLC-owned removable media may not be connected to or used in computers that are not owned or leased by the NLC without explicit permission of the President or her designee. Sensitive information should be stored on removable media only when required in the performance of assigned duties. 7. System Administrator. The System Administrator has the following responsibilities regarding user account and access management: • Account creation requests shall specify access either explicitly or via a “role” that has been mapped to the required access. There must be written authorization by the President or an NLC Vice Presidents before the creation of any account type or resource access is granted. • Access shall be immediately revoked for terminated employees, at time of an employee’s last day or for any user whose access is no longer required for a specific resource unless otherwise directed by the President or her designee. • User IDs shall be disabled after 30 days of inactivity. After an additional thirty days, disabled User IDs shall be purged. These restrictions may not apply to certain specialized accounts used by the Information Technology Department for running services or applications. In these instances the IT department will keep an encrypted database of these specific IDs and passwords. • All Computer resources capable of displaying a custom sign-on or similar message must display as part of the login process: • This system is for use of authorized users only. Individuals using this computer system without authority, or in excess of their authority, are subject to having all of their activities monitored and recorded. National Labor College reserves the right to take any and all appropriate legal actions against any individual who uses this system in an unauthorized or unlawful
ADDITIONAL COLLEGE POLICIES
manner. • Passwords set by the System Administrator shall be changed by the user immediately upon the user’s next login. System Administrators shall set initial passwords that are unique and are compliant with the password rule set. • The identity of users shall be validated before performing a password reset. The approved method for validating identity is in person or remotely only after the being provided with a unique piece of information about the person. Examples include: date of birth, full name, or home phone number. • All systems and access to databases containing credit cardholder information shall be authenticated. Direct database queries shall only be made by authenticated Database Administrators. • Audit logs shall be stored and retained accordingly. • Access to management consoles for wireless networks shall be limited to the System Administrator and shall not be accessible by the wireless network itself. • All computers, servers with any type of operating system, workstations, kiosks, point of service machines and any other NLC-owned computing device shall have up to date antivirus software. 8. Liability. NLC will not assume any liability for any claim, suit, criminal prosecution, or judgment against a user of email or of the internet because of any improper action by that user during the course of such use. If NLC is required to pay money damages in connection with any misuse of the system by any employee or other user, it reserves the right to recover such damages from the responsible party. 9. Sanctions. Any employee, student, consultant or other user who uses the email system in an inappropriate, disruptive, offensive, or unlawful manner, or who otherwise violates this policy, shall be subject to discipline up to and including discharge from employment, expulsion from school, or termination of contractual arrangement 10. Reporting of Violations. Any complaints about unlawful, improper, or inappropriate use of email (including receipt of such material) should be reported promptly to the President or her designee.
77