With choice and freedom, inevitably comes some guidelines, rules or policies. This is also the case with the university’s  approach to the usage of electronic equipment, such as laptops, phones and tablets in the near future.

Due to our ever changing technological landscape Information Technology recently saw the need to  compile a policy to act as a guide for the use of SU and private devices. (Read our previous article on BYOD.)

Then End-user equipment and media policy establishes rules for the appropriate use of end-user equipment and media in the Stellenbosch University environment in order to protect the confidentiality and the integrity of academic and institutional information and applications as well as the availability of services at the University. It specifies the University and individual user responsibilities for processing, managing, and securing academic and institutional information on University and privately owned equipment (devices) and media.

These guidelines apply to all staff, students and associates who access the University network and information that relates to University owned or privately owned end-user equipment that will be used to connect to, access and/or process academic and institutional information.

This week we’ll look at the measures that have to be taken when it comes to access control to devices.

Prior to initial use via a physical connection to the University internal network or related infrastructure, all end-user equipment (with the exception of devices that are used to connect via Virtual Private Network (VPN)) must be registered with University Information Technology (IT) Division.

The IT Organisation reserves the right to:

– Refuse, by physical and non-physical means, the ability to connect privately owned or non-sanctioned end-user equipment to the University Network. The IT Organisation will engage in such action if it feels such equipment is being, or may be, used in a way that puts the University’s systems, information or users at risk.

– Summarily ban the use of a privately owned end-user device at any time. The IT Organisation need not provide a reason for doing so, as protection of the University Network and information is of the highest priority.

– Physically disable communication ports (such as Universal Serial Bus (USB) ports, other ports that can connect to storage devices or media) on University-owned IT assets to limit physical and virtual access to University systems and information.

– Users who wish to connect privately owned or non-sanctioned end-user equipment to the University Network to gain access to University applications or information and/or the Internet must implement, for their devices and related infrastructure, appropriate and up-to-date:

* personal firewall;

* anti-virus software;

* anti-malware software;

* any other security measure deemed necessary by the IT Organisation;

* operating systems (e.g. Microsoft Windows, Android, Apple iOS, etc.) and operating system updates.

– Users must implement physical security practices to prevent the theft or loss of end-user equipment and media, especially mobile devices, and academic and institutional information, including:

– If it is absolutely necessary to leave a portable device unattended, it should be secured with a cable lock or similar security device,

– Ensure that portable devices are not visible when left in a vehicle. If portable devices are left unattended in a vehicle it is recommended that they be locked in the boot.

– Lock portable devices away when not in use.

– Portable end-user media or devices which contain confidential academic and institutional information must be protected by an access control mechanism (e.g. password, biometric, PIN code or pattern lock, etc.). If the latter is not possible, access to data files on these devices or media, must be protected by an access control mechanism. Devices that are unprotected by an access control mechanism may not hold confidential1 academic and institutional information.

Dis onvermydelik dat, saam met keuse en vryheid, daar ongelukkig ook riglyne, reёls en beleid moet wees. Dis ook die geval met die universiteit se benadering tot die gebruik van elektroniese toerusting, byvoorbeeld skootrekenaars, selfone en tablette, in die nabye toekoms.

As gevolg van die voortdurend veranderende tegnologiese omgewing het daar`n behoefte ontstaan om `n beleid saam te stel wat as gids dien vir die gebruik van US-en privaattoerusting. (Lees ons vorige artikel oor BYOD.)

Die eindgebruikertoerusting- en mediabeleid vestig die reёls vir die toepaslike gebruik van eindgebruiker toerusting en media in die Universiteit Stellenbosch-omgewing. Die doel daarvan is hoofsaaklik om die vertroulikheid en integriteit van akademiese en institusionele inligting en toepassings, sowel as die beskikbaarheid van dienste by die universiteit, te beskerm.

Hierdie riglyne is van toepassing op alle personeel, studente en belanghebbendes wat toegang tot die universiteit se netwerk en akademiese en institusionele inligting deur middel van US-toerusting of privaattoerusting.

Die week kyk ons na die vereistes wat gestel word rakende toegangsbeheer na die toestelle. 

Voordat toegang tot die interne Universiteitsnetwerk of verwante infrastruktuur deur middel van `n fisiese verbinding bewerkstellig kan word, moet alle eindgebruikertoerusting (met die uitsondering van toestelle wat gebruik word om aan die VPN (Virtual Private Network) te verbind), registreer word by Informasietegnologie. 

Informasietegnologie behou die reg om: 

– te weier (op `n fisiese of nie-fisiese wyse) dat privaattoerusting of nie-goedgekeurde eindgebruikertoerusting aan die US-netwerk verbind word. IT sal hierdie besluit neem indien daar bepaal word dat die toerusting in so `n mate gebruik word dat dit die universiteit se stelsels, informasie of gebruikers tot nadeel strek.

– privaattoerusting te enige tyd te verban. IT hoef nie `n rede te verskaf vir die aksie nie, aangesien die universiteit se netwerk en informasie die hoogste prioriteit dra.

– fisies kommunikasiepoorte (soos USB’s of ander poorte wat kan verbind aan stoortoestelle of media) op universiteitsbates se fisiese en virtuele toegang tot universiteitstelsels en informasie te beperk. 

Gebruikers wat privaattoerusting of nie-goedgekeurde toerusting wil gebruik om toegang via die us-netwerk te kry na toepassings of informasie, se toerusting moet op datum wees met die volgende sagteware en hardeware:

* persoonlike vuurmuur;

* anti-virus sagteware;

* anti-“malware” sagteware;

* enige ander sekuriteitsmaatreels wat vereis word deur IT;

* bedryfstelsels (byvoorbeeld, Microsoft Windows, Android, Apple iOS, ens.) en bedryfstelselopdaterings.

Daar word ook van gebruikers vereis om sekuriteitsmaatreels in plek te sit om te voorkom dat toerusting, veral mobiele toestelle, media en akademiese en institusionele inligting, verlore raak of gesteel word. Hierdie maatreels sluit die volgende in:

– draagbare toestelle, indien nie onder toesig, moet beveilig word met `n kabelslot of soortgelyke toestel, 

– maak seker dat draagbare toestelle nie sigbaar is wanneer dit in `n voertuig gelos word nie. Sluit dit eerder in die kattebak toe.

– sluit draagbare toestelle indien nie in gebruik nie,

– draagbare eindgebruikertoestelle wat vertroulike akademiese en institusionele inligting bevat moet beskerm word deur `n toegangsbeheermeganisme (byvoorbeeld `n wagwoord, biometrie, PIN-kode of patroonslot, ens.) Indien laasgenoemde nie moontlik is nie, moet toegang tot data leers of media op die toestelle, beskerm word deur `n toegangsbeheermeganisme. Toestelle wat nie beskerm word deur genoemde meganisme nie, mag onder geen omstandighede vertroulike akademiese of institusionele inligting bevat nie.