ࡱ; :  !"#$%&'()*+,-./0123456789;<=Root Entry  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNPRSTU ®`VTextStarWriter 5.04! SfxDocumentInfo  }1 Bob Johnson }1 uK Info 0 Info 1 Info 2 Info 3 }1i%<44Standard LIBIMBEDDED LIBIMBEDDEDTASK,2,74/200/945/687,H)2,0,100,1,6688;928;100;0;0;13335;8655;0;0SW5HDR.}1!< Internet linkVisited Internet LinkOutline0 #ZSWG, A<  #$%&'()*./0123456789:;<=>?@ABCDGHK  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFQRSTU0!'J@XXX&X2'6@Times helveticaXX'4@#d d hd XXX"' @JX'@iX'@X1'#@dX+'$@X'(8@ . `'. . !. XX!@'1}@ddddddpdddp@ ddd@ dddXX!X4XGXZA'2J@dddddxddxdXXX&X27S;"@XX8S<&@LXX9S=(@XX('@@XR'D@XJJ@Xd$ChU ?`P' Times Roman$' '(. . p. @ . . . . . P. . . !. $. `'. 0*. -. /. 2. p5. @8. ;. =. @. 6')&.2  Internet link Internet link@!''Visited Internet LinkVisited Internet Link@!''FrameFrame;7S<8S=9S>> GraphicsGraphics;7S<8S=9S>> OLEOLE;7S<8S=9S>> StandardStandard@NormalStandardNormal!'''#1'2A'@('CellNormalCell2A'FootnoteNormalFootnote HdrFtrNormalHdrFtr('html_hyperlink_textNormalhtml_hyperlink_text!'' Level 1 ( I )Normal Level 1 ( I ) Level 2 (A) Level 1 ( I ) Level 2 (A)1@' Level 3 (1) Level 1 ( I ) Level 3 (1)1@' Level 4 (a) Level 1 ( I ) Level 4 (a)1@' Level 5 (i) Level 1 ( I ) Level 5 (i)1@' ParagraphNormal Paragraph Paragraph 1 Paragraph Paragraph 11@' Paragraph 2 Paragraph Paragraph 21@' Paragraph 3 Paragraph Paragraph 31@' Paragraph 4 Paragraph Paragraph 41@' Paragraph 5 Paragraph Paragraph 51@'HeadingStandard Text body''2A'DR'  Text bodyStandard Text body2A'TitleNormalTitle@''$+'(SubtitleHeading Text body' '$+'(HeaderStandardHeader('JJFooterStandardFooter('JJR<6j4{ P O#c)SBX sb Z Standard StarBASICSBX ARSBX AR SBX AR2c%bqqOh+'0 h t 8@I/@!@z<7@1 Bob JohnsonSW5HDR.}1!'' Frameformat ZeichenformatTextformatvorlageStandardNormalCell FootnoteHdrFtrhtml_hyperlink_text Level 1 ( I ) Level 2 (A) Level 3 (1) Level 4 (a) Level 5 (i) Paragraph Paragraph 1 Paragraph 2 Paragraph 3 Paragraph 4 Paragraph 5 Heading Text body(Title(SubtitleHeaderFooter Internet linkVisited Internet Link Frame Graphics OLERoot 32StandardRTF-SectionPage(1)RTF-FirstSectionPage(2)  Illustration Table TextDrawingY #.Y $.Y %.Y &.q\ GeneralGeneraldNC#,###.00#,###.00SystemNC #,##0.00 CCC#,##0.00 CCCNC$#,##0.--;[RED]-$#,##0.-- $#,##0.---$#,##0.--REDNC$ MM/DD/YYYYMM/DD/YYYY def/SystemNC%MM/DD/YYMM/DD/YY def/SystemNC&NNNNMMMM DD, YYYYNNNNMMMM  DD, YYYYSystemNC' MMM D, YYMMM D, YY def/SystemNC. [HH]:MM:SS.00 [HH ]:MM:SS .00NC3MM/DD/YYYY HH:MM:SS MM/DD/YYYY HH :MM:SS  NCK MMM D, YYYYMMM D, YYYY def/SystemNCL MMMM D, YYYYMMMM  D, YYYY def/SystemNCM NN, MMM D, YYNN, MMM D, YY def/SystemNCNNN, MMMM D, YYYYNN, MMMM  D, YYYY def/SystemNCONNNNMMMM D, YYYYNNNNMMMM  D, YYYY def/SystemNCP D. MMM. YYYYD. MMM. YYYYDIN 5008 (EN 28601)NCQ D. MMMM YYYYD. MMMM  YYYYDIN 5008 (EN 28601)NCRMM-DDMM-DDDIN 5008 (EN 28601)NCSYY-MM-DDYY-MM-DDDIN 5008 (EN 28601)NCT YYYY-MM-DDYYYY-MM-DDDIN 5008 (EN 28601)NCUWWWWNCGeneralGeneraldNC#,###.00#,###.00SystemNC #,##0.00 CCC#,##0.00 CCCNC$#,##0.--;[RED]-$#,##0.-- $#,##0.---$#,##0.--REDNC MM/DD/YYYYMM/DD/YYYY def/SystemNCMM/DD/YYMM/DD/YY def/SystemNCNNNNMMMM DD, YYYYNNNNMMMM  DD, YYYYSystemNC MMM D, YYMMM D, YY def/SystemNC [HH]:MM:SS.00 [HH ]:MM:SS .00NCMM/DD/YYYY HH:MM:SS MM/DD/YYYY HH :MM:SS  NC MMM D, YYYYMMM D, YYYY def/SystemNC MMMM D, YYYYMMMM  D, YYYY def/SystemNC NN, MMM D, YYNN, MMM D, YY def/SystemNCNN, MMMM D, YYYYNN, MMMM  D, YYYY def/SystemNCNNNNMMMM D, YYYYNNNNMMMM  D, YYYY def/SystemNC D. MMM. YYYYD. MMM. YYYYDIN 5008 (EN 28601)NC D. MMMM YYYYD. MMMM  YYYYDIN 5008 (EN 28601)NCMM-DDMM-DDDIN 5008 (EN 28601)NCYY-MM-DDYY-MM-DDDIN 5008 (EN 28601)NC YYYY-MM-DDYYYY-MM-DDDIN 5008 (EN 28601)NCWWWWNCBoeoePp 2$99 SAAP/=AP8d8dd8APddSAAP/=AP8d8dd8APddp  !!2$99 SAP/=AP8d8dd8APhdhdAPr HeaderSAP8APdddAvPNmTd$. DRAFT -- NOT FOR DISTRIBUTION -- DRAFT Page SA@SA0-A Pr FooterSwAPdddAP8ddAJPNAT8$S-Ad A  A@SSAAP/=AP8d8dd8APhdhdp "!2$99 S\AP/=AP8d8dd8APhdhdAPr~ HeaderSlAP8APdddA<PN3T*$SA@SA @A Pr FooterSwAPdddAP8ddAJPNAT8$S-Ad A  A@SSAAP/=AP8d8dd8APhdhdZSW5HDR.}1C(569a(Build:5169)(SV569)]D!Address Book Fileaddress!'' Frameformat ZeichenformatTextformatvorlageStandardNormalCell FootnoteHdrFtrhtml_hyperlink_text Level 1 ( I ) Level 2 (A) Level 3 (1) Level 4 (a) Level 5 (i) Paragraph Paragraph 1 Paragraph 2 Paragraph 3 Paragraph 4 Paragraph 5 Heading Text body(Title(SubtitleHeaderFooter Internet linkVisited Internet Link Frame Graphics OLERoot 32StandardRTF-SectionPage(1)RTF-FirstSectionPage(2)  Illustration Table TextDrawingd;1 4 5*jK standard.dic soffice.dicXsun.dic@ IgnoreAllListY #.Y $.Y %.Y &.6N&;Th$=College of Engineering Information Technology Security PolicyS A P"A@ST$ SA@ST7$ I. Scope of this PolicySA@ST9$ This document establishes high-level policies intended to insure the integrity, availability, and confidentiality of the Local Area Networks within the College of Engineering; IT devices controlled by the college; and information stored or manipulated by those networks and devices.SA@ST$ Procedures intended to implement these policies are described in the College of Engineering Information Technology Security Plan [to be written].SA@SA8 T$ All units within the College of Engineering must comply with the requirements of this policy, as well as other documents that may be published by the college to facilitate implementation of this policy. SA@ST$ SA@ST:$ II. Background InformationSA@ST&$ The College of Engineering IT infrastructure includes the local area networks of twelve academic departments and their subsidiary units; a number of research centers; the college administration; several service units; and off-campus units with specific missions. IT operational support for the college administration and affiliated service units is provided by the college's Management Information Systems group. Departments and other units not in the college administration arrange for their own operational support.SA@ST$ Under this policy, the college provides an IT Security Manager (ISM) who coordinates security activities within the college with the University of Florida's IT Security Manager. The college ISM also provides IT security support for individual units within the college. Departments and other department-level units within the college each provide an IT Security Manager to coordinate activities with the College ISM.SA@ST$ SA@ST:$ III. Responsible PersonnelSA@ST1$ A. ImplementationSA@ST$Implementation of this policy is the responsibility of all IT staff in the college, as defined by the University of Florida Information Technology Security Policy.SA@SAD8 f)#http://www.it.ufl.edu/policies/security/T$ SA@ST.$ B. College ISMSA@ST$,The Dean of the College of Engineering will appoint an IT Security Manager to fulfill, for all units within the college, the functions defined for the position by the University of Florida Information Technology Security Policy. All units within the college will be represented by the college ISM.SA@SAD8 )#http://www.it.ufl.edu/policies/security/T$SA@ST>$ C. College IT Security OfficerSA@ST $The Dean of the College of Engineering will appoint an IT Security Officer who will oversee the work of the college ISM. The IT Security Officer will be responsible for establishing official goals and policy to be implemented by the ISM.SA@ST$SA@ST+$ D. Unit ISMSA@ST$Each Unit in the College of Engineering must appoint a Unit IT Security Manager (ISM), who is responsible for coordinating with the college ISM and supervising implementation of IT security policy and plans. SA@STN$/The College recommends that whenever feasible, each unit appoint both a unit ISM, and an IT Security Officer (or committee) to provide oversight and guidance to the unit ISM. This practice reduces the likelihood of serious omission in security planning and implementation. It also helps mitigate the conflict of interest that develops in the typical situation in which the unit ISM is the unit's Network Administrator, and is thus responsible both for maximizing user access to the network, and implementing security measures which may inconvenience users.SA@ST$SA@ST;$ IV. Unit Policies and PlansSA@ST$vEach administrative unit within the college must develop an IT security policy, and supporting plans, and other documents required to ensure implementation of their policy. Each unit policy must address any security issues specific to the unit not adequately addressed by the UF IT Security Policy, the college policy, and associated plans, procedures, and guidelines. SA@ST$`The college will publish guidelines and requirements for development of unit policies and plans.SA@ST $Each unit may elect to develop multiple policies that apply to different subunits within the unit, rather than a single policy for the entire unit. No unit may establish policy that is independent of policy published by a parent unit.SA@ST$SA@ST5$ V. Scope of AuthoritySA@STp$QThe scope of authority for any unit's IT security policy or plan is the network address space assigned to the unit; any equipment owned by the unit; and any information directly controlled by the unit. Ultimate authority for the security of address space belongs with the unit to which that address space is assigned (provided that the unit complies with college and university requirements); units using the address space of another unit must comply with the security policies of the hosting unit unless the hosting unit explicity agrees to transfer security authority for the address space.SA@ST$~No computer or other device may be connected to a college network unless it is under the authority of a published unit policy.SA@ST$SA@STK$ ,VI. Critical Resources, Sensitive ResourcesSA@ST=$ A. Mission-critical ResourcesSA@ST$^Any resource which will significantly impair the operation of a unit if the resource is unavailable for an extended time should be given special consideration in the unit's IT security planning. Each such resource should be considered for official declaration as a "Critical IT Resource" as defined by the University of Florida's IT Security Policy.SA@SA[8 3]@./UF IT Security Policy#http://www.it.ufl.edu/policies/security/T$SA@ST6$ B. E-Commerce SecuritySA@STx$YAny server engaged in accepting monetary payment via the Internet must document and implement security procedures that address the specific security requirements of any associated credit card vendor or other financial services vendor, as well as any additional security measures appropriate to the function of the server and the data it handles.SA@ST$SA@ST2$ C. Server SecuritySA@ST$College and unit planning must specifically address management and security of any servers operated on the College of Engineering networks, including (but not limited to) mail, WWW, FTP, SSH, telnet, and file servers. This requirement applies to servers operated by individuals as well as to servers operated by a unit or groups within the unit, and includes peer-to-peer networking services such as Gnutella or KaZaA.SA@ST$ SA@STF$ 'VII. Effective Date, Revision ScheduleSA@STm$NAll units within the college must comply with this policy by January 1, 2003. SA@ST$The college IT Security Officer will be responsible for conducting an annual review of this policy and making recommendations for updates and improvements.SA@ST$SA@ST.$ VIII. GlossarySA@ST<$CoE - College of Engineering.SA@ST$E-Commerce - Electronic Commerce, defined for the purposes of this document as any activity which accepts monetary payment via the Internet.SA@STF$'Network Address Space - Range of network addresses assigned to an entity, or (depending on context), the set of all possible network addresses. Network address space can be defined by IP number ranges, Netware addresses, or other network address system, as appropriate to the technology in use.SA@ST$qISM - IT Security Manager, the individual assigned to monitor and coordinate IT security practices within a unit.SA@ST;$IT - Information Technology.SA@ST8$LAN - Local Area Network.SA@STZ$;Server -Any computer or other device that provides one or more services to other systems that connect to it via the college network. "Services" can include SMTP, FTP, SSH, telnet, Windows file sharing, peer-to-peer sharing such as Gnutella or KaZaA, and any other service in which connections are initiated by other systems. The general distinction between servers and clients is that connections are initiated by clients, and accepted by servers, and is not dependent on the direction of information flow. It is possible for a system to be both a server and a client.SA@ST$hUnit - An administrative unit of the University. May be a Department, Center, or other distinct unit. SA@ST$SA@ST$ Last updated: SA@SA 0  2002-07-29A0 11:44A!0  Bob JohnsonJGeneric PrinterSGENPRT PostScriptY`Tl`Tld,,lprdefault_queueSGENPRTPageSize:Letter7 U׾V88/ػ?~/=U8h`';P""$U8h`'8H"@`' U8`'1?B`'B`'`' B7`'`' B`'X`'B+`'z`'B `'z`'B `'`' B`'`' BW`'`'b BI`'`' B]`'`'  B`'`'  B`'U$  B1 `'zU!B"`'U$ BG$`'U$ B%`'6U!B*`'U! B+`'U$ BQ-`'XU!-U8d7`'8`'F"@8`'d>/=U8h`';p!!$U8h`'8H!@`' U8`'1?B`' E! B `'U$ B`'XU!B`'U!@B `'U! Bl`'`' B`'6U$B>`'U$ B`'XU$B2`'`' B`'`' Bj`'U$@ FB:#`'zU$!HB%`'`' "IBP'`'`' #JB(`'U$ $KB*`'6U!%OB.`'U! &P-U8d7`'8`'F!@8`'}/=U8h`';P!!$U8h`'8H!@`' PU8`'1?B`' E$ 'QB `'6U!(UBB`'U! )VB`'U$ *WBz`'U!+\B `'`' ,]B*`'`' -^B`'U$ ._Bb`'zU$/aB`'`' 0bBx`'`' 1cB`'U$ 2dB`'zU$3fB*`'6U$4jB` `'zU$5lB"`'U$ 6mBv$`'U$ 7nB&`'U$b8tB,`'zU$9vB~.`'`' :wB0`'`' ;x-U8d7`'8`'F!@8`'lZRoot Entry ®`VCompObj<Ole persist elements" SfxDocumentInfo uStarBASIC BasicManager2 4SfxWindowsFSwNumRulesSfxStyleSheetsStandardOjSummaryInformation( Q0SwPageStyleSheets$ !StarWriterDocument&4