Policy on Computer Disconnection from SSNet

Background: A well functioning network is critical to the research, academic and service missions of the University. Information Security has documented an increasing frequency of computer intrusions which threaten the integrity of SSUET network (which from now on will be referred to as SSNet). The capacity of entire departments to teach and conduct research has been limited as a result, and sensitive data have been at risk of unauthorized disclosure. At times, rapid response is required to protect the integrity of systems, data and those that rely on them. Inefficiency sometimes results because the owners of the penetrated machines can not be located. Disagreements arise over the magnitude and immediacy of the problems without a formal mechanism for resolving conflicts.

Certain types of misconfiguration of SSUET systems, intentional or otherwise, can have serious and detrimental consequences. Examples include using another host's Internet Protocol address ("IP Spoofing") or misconfigured networking protocols. Normal operation of SSUET computers, and even computers elsewhere on the worldwide Internet, can be compromised. Networks can become so congested that network traffic can not get through.

Purpose: The goal of this policy is to protect the academic missions served by SSUET's computers and networks from disruption.

Policy: Academic Computing Services (ACS) will disconnect from SSNet any computers that have actually damaged or pose an imminent threat of harming the integrity of SSNet.

Scope: This policy only applies to computers and devices attached directly or indirectly to SSNet, including improper or defective "daisy-chain" connections and private Local Area Networks with active networking components connected to SSNet wallplates and hosts.

This policy does not address removing computers from SSNet for reasons related solely to their content.

Implementation: Systems users / owners must report serious computer security incidents to the University ACS staff. Serious computer security incidents will be defined as those that jeopardize the integrity, privacy and/or availability of other computers and networks. Examples of serious computer security incidents include break-ins where privileged accounts (e.g. UNIX "root" account, or NT "Administrator" account) are used without authorization, incidents where network traffic is monitored without authorization, and incidents where SSUET computers or networks are either the source or the target of "denial of service" attacks. The Systems Manager will coordinate the response to computer security incidents, including notifying campus systems administrators, law enforcement officers, external sites, incident response teams and University offices as appropriate.

No one is allowed to connect a personal system to the university network which may cause a security hole in the network and can become a potential source of virus which can eventually inactivate the network.

Authorized actions: If, in the judgment of the Systems Manager or his/her designate, criteria are met which suggest that a system poses a significant and immediate threat either to:

The security of other SSUET computers and networks, or

The continued operation of SSUET networks and computers,

and the problem cannot be resolved expeditiously through collaboration between the computer owners and support group, then support group will notify senior management of the department or unit and will require the owners to remove the computer from the network until the problem is solved.

Absent/Unidentified Owners: If Support Personnel is unable, using the Assignments database, to identify a system owner, Support Personnel will move unilaterally to protect the network by disconnecting the threatening system.

Disputes: In cases where there is persistent disagreement between Support Personnel and the owner of the perceived threat, Support Personnel must notify the owner following information in writing:

The reason for the disconnection

What steps must be taken for the network connection to be restore

How to arrange for the system to be reconnected

The process of appealing a decision to disconnect

When the owner of the system has taken the steps necessary to correct the problem, Support Personnel will restore the SSNet connection as soon as possible.

Appealing a Decision to Disconnect: The Registrar of the University shall appoint a committee to review appeals of decisions to disconnect computers. The committee will consist of:

At least two members of the faculty appointed by the department concerned.

Systems Manager or her/his designate

University Registrar or her/his designate, whom to serve as chair.

The Registrar may designate alternates to serve on the hearings of an appeal when its appointees are unavailable.

The owner of a disconnected system who believes that the threat that the system posed is outweighed by the impact of its disconnection on their academic mission may appeal the decision by documenting this belief in writing to the chair of the committee. The chair or her/his designate may resolve the dispute amicably; failing this it will be heard formally by the committee. The committee will resolve conflicts as rapidly as possible within the constraints of fairness.

If the committee does not begin the proceedings within 5 working days in cases where the issue is a threat and not actual harm, or 30 working days in cases where Support Group can document actual harm, the subject system must be reconnected. Once the committee has begun the process, it must complete the proceedings in 15 days.

In considering appeals, the committee will balance the value of leaving machines connected against the associated risks. Its decision will be final. Support Group may not appeal. However, it may re-disconnect the computer and restart the entire process whenever another trigger event is detected.

Interpreting this policy: As technology evolves, questions may arise about how to interpret this policy. The Systems Manager may as needed, after consultation with the IT Committee / IT Advisor / Registrar / Vice Chancellor, publish specific rules interpreting this policy.

Advice: To minimize the likelihood of a serious computer security compromise, campus systems owners are encouraged to configure their systems in accordance with the standards specified by the Systems Manager and the Network Support Group.

Glossary

Assignments Database: Local Support Providers maintain information about SSNet connected computers, including the network address, operating system, and contact information.

Denial of Service Attack: An attack where someone takes up so much of a shared resource that insufficient is left for others. Denial of service attacks threaten the availability of resources, including computer processes, disk space, or network capacity among other things. The result is a degradation or loss of service.

Local Support Provider: Departments/Units at SSUET appoint Local Support Providers to provide information technology support locally.