CT Community Colleges - Network Policy

(Issued on March 5, 2007 by Chancellor Herzog)

A. PURPOSE
B. SCOPE
C. DEFINITIONS
D. RESPONSIBILITIES
E. VIOLATIONS OF LAW AND POLICY
F. NO EXPECTATION OF PRIVACY

III. WIRED AND WIRELESS NETWORKS

IV. WIRELESS NETWORKS ONLY

V. NETWORK ACCESS

VI. DISCLAIMER

VII. NOTICE TO USERS

I. INTRODUCTION

This Policy governs wired and wireless networks within the Connecticut Community Colleges (CCC). Furthermore, it defines network access from CCC owned and Non-CCC owned devices. In developing this policy, careful consideration was made in balancing many variables including security, risk, ease-of-use, and cost in an academic computing environment.

II. GENERAL PROVISIONS

A. PURPOSE
The purpose of this Policy is to:

Ensure that CCC network resources are used for purposes appropriate to the CCC mission and goals;

Prevent disruptions to and misuse of CCC network resources;

Ensure that the CCC community is aware that use of CCC network resources is subject to state and federal laws and the CCC policies; and

Ensure that network resources are used in compliance with those laws and the CCC policies.

B. SCOPE

This Policy applies to:

All network resources owned or managed by the CCC;

All network resources provided by the CCC through contracts and other agreements with the CCC; and

All users and uses of CCC network resources.

C. DEFINITIONS
The following terms are used in this Policy. Knowledge of these definitions is important to an understanding of this Policy:
Appropriate CCC Authority: Chancellor, College President or designee.

Authorized Networks: Networks that are explicitly installed and operated or authorized by the cognizant CCC IT authority.

Cognizant CCC IT Authority: IT authority designated by the appropriate CCC Authority

Compelling Circumstances: Circumstances in which time is of the essence or failure to act might result in property loss or damage, adverse effects on CCC resources or services, loss of evidence of one or more violations of law or of CCC policies or liability to CCC or to members of the CCC community.

Discreet User Authentication: Generic, pre-expired user accounts that are valid for a day and are used exclusively for public library devices.

Limited User Authentication: To be used only for a limited number (5-6) of unauthenticated, CCC-owned library computers that have a hard-wired network connection.

Internet Available Resources: Internet services which are available over http, https and all CCC Internet available resources (for example: Banner Self-Service, Libris, WebCT, college websites, etc.)
Isolated User Authentication: To be used in a restricted-use, isolated, high-tech classroom, where authorized. The instructor is responsible for insuring that the students follow the CCC IT policies.

Network Active Component: Network devices that forward or moves packets along or between networks such as Wireless Access Points, switches, routers, etc.

Network Resources: This includes, but is not limited to, wired and wireless networks, network addresses, network ports, network infrastructure, network active components, the devices that are connected to the network, etc.

Non-CCC Owned Devices: Any device that uses CCC network resources and is not owned by the CCC.

Vetted: A computer that has been inspected against and has passed a list of security requirements. For example, a vetted computer is up-to-date with operating system service packs and patches, is running an anti-virus program and is up to date with anti-virus definition files.

Wireless Network: Local area network technology that uses radio frequency spectrum to connect computing devices to CCC wired networks and the Internet.

Wireless Resources: Wireless access points, antennas, cabling, power, and network hardware associated with the deployment of a wireless network and the devices that connect wirelessly to it.
D. RESPONSIBILITIES
Policy. This Policy was issued by the Chancellor of the CCC after consultation with appropriate councils, including the Council of Presidents and the Information Technology Policy Committee.

Implementation. In support of this Policy, system standards and procedures shall be developed, published and maintained. And where CCC standards and procedures do not exist, each college is responsible for policy implementation.
Informational Material. Each college shall ensure that users of CCC IT resources are aware of all IT policies, standards, and procedures as appropriate.

E. VIOLATIONS OF LAW AND POLICY

The CCC considers any violation of this Policy to be a serious offense and reserves the right to copy and examine any files or information resident on CCC IT resources to ensure compliance. Violations of this policy should be reported to the appropriate CCC authority.

Sanctions of Law. Both federal and state law prohibit theft or abuse of IT resources. Abuses include (but are not limited to) unauthorized entry, use, transfer, tampering with the communications of others, and interference with the work of others and with the operation of IT resources. Any form of harassing, defamatory, offensive, illegal, discriminatory, obscene, or pornographic communication, at any time, to any person is also prohibited by law. Violations of law may result in criminal penalties.

Disciplinary Actions. Violators of this Policy may be subject to disciplinary action up to and including dismissal or expulsion pursuant to applicable Board policies and collective bargaining agreements.

F. NO EXPECTATION OF PRIVACY

There is no expectation of privacy in the use of CCC IT resources. CCC reserves the right to inspect, monitor, and disclose all IT resources including files, data, programs and electronic communications records without the consent of the holder of such records.

III. WIRED AND WIRELESS NETWORKS

All network resources are under the purview of the cognizant CCC IT authority. Only network resources explicitly managed or authorized by the cognizant CCC IT authority are permitted. As such, unless authorized:

devices can not run network services (including but not limited to DHCP, WINS, DNS, Active Directory Domain Controllers).

the use of any device in "promiscuous mode" is not permitted.

extending the network (including but not limited to hubs, wireless access points, modems) is not permitted.

All network resources must:

be physically secured from theft or vandalism, that are owned by CCC;

employ active network management (including but not limited to usage, activity, access);

be secured from unauthorized access;

adhere to all applicable health, building, fire codes and federal and state regulations;

have upgradeable firmware for devices that have active components; and

employ appropriate operating system service packs and patches to comply with the End User Device Security Policy.

IV. WIRELESS NETWORKS ONLY

Wireless networking is not a strategic replacement for a wired network. In the future, wired technologies are likely to improve significantly faster than those of wireless. A wireless network must be an augmentation of a wired network and is only appropriate for “common or transient areas” where students, staff, and faculty gather. Those areas include, but are not limited to: instructional labs, public areas, and research labs.

Due to the limited and shared bandwidth constraint of wireless networks, it is only appropriate for applications that have very low bandwidth requirements such as general email and web browsing. The shared bandwidth constraint also limits the number of users connected to a wireless network at one time.

The FCC does not license use of the frequencies used by wireless devices and therefore other devices that use the same frequencies may disrupt wireless communications. These devices include but are not limited to cordless phones, microwave ovens, and personal network devices. Areas with high interference from such devices may not be suitable for wireless networks.

Wireless Networks must:

be centrally administered as a component of the local area network (LAN);

be regularly scanned for rogue APs; and

use supported radio frequency bands.

Access Points must:

be physically secured from access to the data port by locked security boxes;

be physically located towards the center of the intended coverage area so that radio waves do not radiate beyond the perimeter of the intended coverage area;

be managed over a hard wired administration port and never over the wireless network;

have wireless access to the administration port disabled at all times;

have passwords changed initially and at regular intervals thereafter; and

be configured to have encryption enabled; where encryption keys must be changed at regular intervals and must not be posted publicly.

V. NETWORK ACCESS

Prior to attempting to access CCC IT resources, users must be presented with the IT Resource Access Message. Encrypted user authentication is then required and subsequent access is based on the following chart. The cognizant CCC IT authority determines the appropriate access.

Network Access Chart

Ref #	Device Ownership	Device Auth	User Auth	Vetted	Access	Function
1	CCC owned	Yes	Yes	Yes	Access based on credentials/ permissions.	CCC workstations (default).
2	CCC owned	Yes	Limited	Yes	Internet available resources only.	Exclusively for library public devices.
3	CCC owned	Yes	Isolated	Not required but recommended	Internet available resources only.	Exclusively for isolated, high-tech classes where authorized.
4	Non-CCC owned	None	Yes	Not required but recommended	Internet available resources only.	Exclusively for non-CCC owned devices.
5	Any	None	None	No	No access.	No network connectivity.

VI. ACCESS RESTRICTIONS

Use of CCC IT resources may be wholly or partially restricted or rescinded by CCC without prior notice and without the consent of the user under conditions such as:

when required by and consistent with law;

when there is reason to believe that violations of law or the CCC policies have taken or may take place; or

when there are compelling circumstances.

Restriction of use under such conditions is subject to appropriate procedures or approval of appropriate CCC authority.

VI. DISCLAIMER

CCC disclaims any responsibility for and does not warranty information and materials residing on non-CCC systems or available over publicly accessible networks. Such materials do not necessarily reflect the attitudes, opinions or values of CCC, its faculty, staff or students.

VII. NOTICE TO USERS

As laws, technology and standards change from time to time, this Policy may be revised as necessary to reflect such changes. It is the responsibility of users to ensure that they have reference to the most current version of CCC Policies.

Revision History

Obsoletes Wireless Policy