ICT Acceptable Use Procedures

Intent

These Procedures have been developed to support the Information Communication Technology (ICT) Acceptable Use Policy and uphold the intent of the Policy by:

• Expressing the commitment of the University to maintaining secure, effective and reliable University ICT Services;
• Providing a clear statement of responsibilities for all users of University ICT Services, including what constitutes acceptable and unacceptable use of these services;
• Establishing clear mechanisms for rapidly responding to threats to the University ICT Services (for instance, via hacking or virus threats); and
• Providing processes to appropriately handle other security incidents, from minor breaches of Policy through to serious misconduct.

Scope

These Procedures apply to all Authorised Users of University ICT Services managed by the University or third party providers on behalf of the University, both on and off campus.

Definitions

Defined terms in the ICT Acceptable Use Policy have the same meaning in these ICT Acceptable Use Procedures.

Account means a user name or other identifier which, with or without a password, allows a user to access the University ICT Services.

Asset Owner means an individual or collective group with accountability and authority for University ICT Services.

College/Directorate Representative means a person appointed by a College or Directorate whose role is to control use of University ICT Services allocated to their College or Directorate.

Corrupt Conduct has the same meaning as in the Crime and Corruption Act 2001 (Qld).

Computer Rooms means the computing labs and equipment provided by the University.

Inappropriate Material means content that, if accessed through University ICT Services, contravenes the Information Communication Technology Acceptable Use Policy;

ICT Bulletins means information supplied by Information and Communications Technology either by email, automatically output on a workstation or on the University websites.

Jailbreaking means the process of removing software controls on the operating systems to increase functionality or subvert security controls. Mostly commonly used when referring to Apple devices, however the concept can be applied to other makes or models.

Outside User means a person or organisation external to the University.

Private Cloud means a service operated solely for a single organisation, whether managed internally or by a third-party, and hosted either internally or externally.

Public Interest Disclosure means disclosure of information, as identified in the Public Interest Disclosure Act 2010 (Qld),by any person, including a Public Officer.

Public Officer has the same meaning as in the Public Interest Disclosure Act 2010 (Qld), and includes University employees.

Table of Contents

1. General usage
2. Personal computer security
3. Software licensing
4. Physical security
5. Computer Rooms
6. Sustainability - energy management
7. Data management
8. Security management
9. System logging and monitoring
10. Reporting and handling events, incidents or breaches
11. Handling breaches of the ICT Acceptable Use Policy
12. Responding to requests for information
13. Inadvertent unacceptable use
14. Contacts

Introduction

These procedures are designed to support the operational nature of the ICT Acceptable Use Policy by providing detailed acceptable use procedures.

University ICT Services are the property of the University.

Procedure

1.  General usage

1.1 Categories of Authorised Users include:

a. Any University student who has been allocated an Account or who has been authorised by a member of University academic staff to use an Account;

b. Any member of University staff who has been allocated an Account or who has been authorised to use an Account allocated to another person or to a group of people or to a section of the University. They must use University ICT Services for officially approved purposes. Limited personal use is permitted consistent with University Policy and Procedures. Note that University ICT Services are monitored for security and compliance purposes;

c. Any representative of another educational institution authorised to use University ICT Services through an arrangement between the University and the other educational institution;

d. An Outside User who has been provided with an Authentication Credential; or

e. Any individual associated with an Outside User authorised to use an Account allocated to the Outside User.

1.2 Authorised Users, must:

a. Take responsibility for all activity initiated from any Account through which they have been granted access to University ICT Services;

b. Ensure that their Authentication Credential(s) are securely stored as they are responsible for all activity initiated from their Account or with their Authentication Credential(s);

c. Not allow another person to use their Account and/or Authentication Credential. Similarly, an Authorised User must not attempt to initiate or operate a computer session by using another person's Account and Authentication Credential, or by any other means. Should an Authorised User believe that the security of an Account has been compromised they must report this to the ICT Help Desk;

d. Not circumvent the University's authorised connections or subvert its security measures. This includes ‘jailbreaking’ of University owned devices;

e. Only access University ICT Services using the Accounts they have been authorised to use (kiosk services have an implicit authorisation to use);

f. Observe ICT Bulletins issued by the University; and

g. Comply with any system quotas. If an Authorised User exceeds any of their quotas, they may be personally charged for the cost of their use and/or temporarily prevented from using the affected University ICT Service.

2.  Personal computer security

2.1 University staff and students, who use a personal computer (including smartphones) must:

a. Take responsibility for the security of personally owned computers and equipment used in conjunction with the University's ICT Services;

b. Familiarise themselves with ICT good practice guidelines (available on the Information and Communications Technology website) and take reasonable steps to ensure that personal computer(s) do not pose a threat to University ICT Services when connected to the University network. This may include:

• Regularly scanning their device for viruses; and
• Maintaining up-to-date software versions; and

c. Protect against loss or theft of University data by:

• Regularly backing up data;
• Using encryption tools to protect sensitive data;
• Logging off or locking devices when left unattended;
• Implementing a secure access mechanism, such as a password; and
• Avoiding leaving devices unattended in public places even if physically secured.

3. Software licensing

3.1 The University has entered into various software licensing agreements with software vendors. Under the terms of those agreements, University staff and students may be able to install any of the products covered under the agreement onto University owned machine or personal device(s).

3.2 Refer to the Software Supplier Agreements & Offers on the University Intranet for information on how to access software and the terms of use which must be complied with by staff and students.

4.  Physical security

4.1 Authorised or Outside Users must:

• Take responsibility for the physical security of all University ICT Services owned or leased by their area. Where these University ICT Services are managed by Information and Communications Technology, the responsibility is shared between the College/Directorate (physical security) and Information and Communications Technology (data and systems security).

4.2 Information and Communication Technology must:

• Physically secure all University core infrastructure and Computer Rooms against theft. This can be achieved by:
  • Implementing secure cables between the device and the building; or
  • Storing equipment in lockable rooms; or
  • Storing equipment in lockable cabinets.

5. Computer Rooms

5.1 Authorised Users who use the Computer Rooms must:

• Abide by the ICT Acceptable Use Policy, associated procedures and Computer Rooms Conditions of Use.

6. Sustainability - energy management

6.1 When on a University campus, University staff and students should:

• Save consumption of energy by powering down systems/devices when left unattended for long periods.

6.2 Information and Communication Technology must:

• Implement power management programs to reduce the energy consumption for non-critical University ICT Services.

7. Data management

7.1 All academic research supervisors and College Deans are responsible for ensuring that they:

• Define research data management requirements and communicate these requirements to the relevant stakeholders; as required by the Code for the Responsible Conduct of Research.

7.2 All University staff and students must:

7.2.1 Adhere to the data management requirements as specified by their College or Division;

7.2.2 Ensure all electronically held University owned information is stored in such a way that it is backed up regularly. This can be achieved by:

• storing data on University approved systems;
• storing data on a University network drive or system; or
• storing data on a University endorsed cloud based storage; and

7.2.3 Ensure all University owned information is disposed of in accordance with the University's Records Management Policy and sustainability procedures as provided by TropEco.

8. Security management

8.1 All Asset Owners must:

• Take responsibility for the physical security and access control of all the data stored on, transmitted through or processed by University ICT Services within their responsibility;
• Implement suitable security controls to prevent un-authorised access or modification to data; and
• Monitor the effectiveness of security controls to ensure their on-going effectiveness.

8.2 Information and Communications Technology must:

• Lead and advise on good practice security management across the University. This includes providing advice and support to Asset Owners on good practice with regard to information and data security;
• Manage common University ICT Services in such a way that the services and data are reasonably protected from:
  • Unauthorised access and unacceptable use;
  • Common and easily exploitable vulnerabilities;
  • Wilful, malicious damage or any activity undertaken to intentionally bypass security controls on University ICT Services; and
  • Virus infection and malicious software;
• Take reasonable steps to ensure that data on University ICT Services is:
  • Accurate and complete;
  • Available to be accessed by Authorised Users, and only those users, when required; and
  • Recovered in an agreed timeframe in the event of serious systems failure or disaster;
• Ensure required University owned or leased computers, desktops or laptops are configured to have a password enabled screensaver that activates within a period of no greater than 30 minutes of inactivity;
• Promote a positive and safe computing environment for all Authorised Users;
• Implement appropriate quotas on the use of University ICT Services (this may include print, file storage, email and internet usage) in order to ensure the ongoing integrity and availability of University ICT Services;
• Ensure sensitive information is disposed of in a manner that renders any information illegible and irretrievable at the time of disposal by:
  • Physically destroying the media;
  • Bulk wiping (degaussing); or
  • Implementing an industry approved 3-times secure wipe of the media; and
• Carry out security reviews of University ICT services to verify the on-going effectiveness of controls. This should include access reviews of administrative accounts.

9. System logging and monitoring

9.1 Information and Communications Technology will:

• Implement appropriate logging of use of University ICT Services and routinely monitor to assist in the detection of breaches of these Procedures and the ICT Acceptable Use Policy.
• Monitor the use of University ICT Services and investigate potential breaches of University Policy, or State or Commonwealth Law.

10. Reporting and handling events, incidents or breaches

10.1 All Authorised Users must:

• Report any actual or suspected security weakness, breach or threat involving University ICT Services to the ICT Help Desk or the Chief Digital Officer as soon as possible;
• Respond to potential incidents or events, including un-authorised system usage, as directed by an Information and Communications Technology staff member; and
• Report lost, stolen or damaged University owned computers or other equipment to the ICT Help Desk. These should also be reported in accordance with the University insurance finance policy and procedures FMPM 450: Policy – Insurance, FMPM 920: Policy – Losses and FMPM 323: Procedure - Disposal of Plant and Equipment located at www.jcu.edu.au.

10.2 Information and Communications Technology must:

• Respond to potential incidents, events, breaches or requests for information (as per Section 12). Responses may include, but are not limited to:
  • Modifying University ICT Services;
  • Taking reasonable steps to protect University ICT Services from unauthorised or unacceptable use. This may include suspending Accounts,  confiscating University owned electronic devices and/or disconnecting or disabling relevant services or other equipment, with or without prior notice;
  • Handle alleged breaches in accordance with Clause 11; or
  • The retrieval or examination of documents or messages for purposes such as finding lost files or messages, complying with legal requests, or recovering from system failure.

11. Handling breaches of the ICT Acceptable Use Policy

11.1 If an alleged breach of the ICT Acceptable Use Policy is reported to the ICT Help Desk or the Chief Digital Officer will conduct a preliminary evaluation of the allegation. Any alleged breach that may also constitute Corrupt Conduct will be referred, in the first instance, to the University Secretary. Similarly, any disclosure by a person of an alleged breach that may constitute a Public Interest Disclosure must also first be referred to the University Secretary.

11.2 Following the preliminary evaluation, the Chief Digital Officer may:

a. Dismiss the matter if the allegation is deemed to be unfounded or trivial, and send written advice of the dismissal and reasons for the dismissal to the complainant or appropriate officer;

b. In the case of an alleged breach by a University student refer the matter to the Director, Student Services to be dealt with under the Student Conduct Policy or other appropriate University policies;

c. In the case of an alleged breach by a University staff member or adjunct refer the matter to the Director, Human Resources (or Vice Chancellor if Director, Human Resources is alleged to have committed the breach) to be dealt with in accordance with the terms of the applicable Enterprise Agreement and/or appointment document;

d. In the case of an alleged breach by a University Council member or co-opted Committee member refer the matter to the University Secretary to be dealt with in accordance with the James Cook University Act 1997 (Qld) and the Code of Conduct – University Council;

e. In the case of an alleged breach by an Outside User, refer the matter to the University Authorised User who is responsible for the Outside User to be dealt with by that University Authorised User; and/or

f. In the case of an alleged breach by a student or staff of another educational institution authorised to use University ICT Services through an arrangement between the University and the other educational institution, refer the matter to the relevant educational institution to be dealt with by that institution.

12. Responding to requests for information

12.1 Information and Communications Technology must respond to all requests to access records relating to University ICT Services received from the University General Counsel.

12.2 Subject to paragraph 1 above, Information and Communication Technology may only respond to requests to access records relating to University ICT Services, as follows:

a. In so far as the request relates to student records, from the Director, Student Services;

b. In so far as the request relates to staff or adjunct records, from the Director, Human Resources;

c. In so far as the request relates to a breach of copyright, from the Director, Library Services (Copyright Officer);

d. In so far as the request relates to a third party request for information made under the Information Privacy Act 2009 (Qld), from the University Privacy Decision Maker or University General Counsel;

e. In so far as the request relates to a third party request for information made under the Right to Information Act 2009 (Qld), from the University’s Right To Information Decision Maker;

f. In so far as the request relates to Singapore staff or students, from the Head of the Singapore Campus, Director of Compliance or Director of Human Resources; and

g. In so far as the request relates to University Council members or matters, from the University Secretary.

13. Inadvertent unacceptable use

13.1 Authorised Users, who inadvertently receive, transmit or access material (for example, via email or the Internet) that may be considered Inappropriate Material and is not related to their work duties, must take immediate action to either delete such material or cease such access.

13.2 Advice must be sought from the Authorised User’s supervisor or the ICT Help Desk if Inappropriate Material continues to be received.

14. Contacts

For further information, please contact:

• JCU ICT Help Desk (Townsville: 4781 5500; Cairns: 4042 1777; Singapore: 6576 6811 – 814).
• JCU Director Human Resources (directorhrm@jcu.edu.au)
• JCU Chief Digital Officer (cdo@jcu.edu.au)
• JCU Student Services (Townsville: +61 7 4781 5601,international@jcu.edu.auor Cairns: +61 7 4232 1558,isccairns@jcu.edu.au)
• JCU Copyright Officer (copyright@jcu.edu.au)
• JCU Privacy (gsu@jcu.edu.au)
• JCU Cybersecurity (cybersecurity@jcu.edu.au)

Related policy instruments

Information Communication Technology Acceptable Use Policy

Code of Conduct

Student Conduct Policy

Code for the Responsible Conduct of Research

Intellectual Property Policy

Cybersecurity Policy

Risk Management Policy

Records Management Policy

Code of Conduct – University Council

Related legislation

Queensland Australia

Criminal Code Act 1899 (Qld)

James Cook University Act 1997 (Qld)

Information Privacy Act 2009 (Qld)

Public Records Act 2002 (Qld)

Telecommunications Interception Act 2009 (Qld)

Queensland Right to Information Act 2009 (Qld)

Public Interest Disclosure Act 2010 (Qld)

Crime and Corruption Act 2001 (Qld)

Commonwealth Australia

Crimes Act 1914 (Cth)

Cybercrime Act 2001 (Cth)

Copyright Act 1968 (Cth)

Spam Act 2003 (Cth)

Telecommunications (Interception and Access) Act 1979 (Cth)

Singapore

The Computer Misuse and Cyber Security Act (Cap 50A) (Singapore)

Copyright Act (Cap 63) (Singapore)

Spam Control Act (Cap 311A) (Singapore)

Undesirable Publications Act (Cap 338) (Singapore)

Administration

NOTE: Printed copies of this policy are uncontrolled, and currency can only be assured at the time of printing.

Approval Details

Revision History

Keywords