New University IT Policies Promulgated in June 2004

The Director of IT Policy and the University Computer Policy and Law Program assists with the development, formulation and promulgation of university level IT policies through the University Policy Office.

Three new policies to be promulgated in June 2004:

• Policy 5.4.1, Security of Information Technology Resources

  If you own your own computer, or manage the software on a university-owned computer, you are responsible for ensuring the security of that computer on the net. This includes keeping the operating system software up to date and following sound security practices such as having virus protection that is regularly updated and a personal firewall. Additionally, you are responsible for responding to and assisting with security incident response as required. Full text of policy | Interpretation | Security guidelines

• Policy 5.4.2, Reporting Electronic Security Incidents

  Security incidents such as "hacking" or a compromised or abused computer connected to the Cornell network must be reported promptly. Computer users should notify the local support provider of such incidents; support providers should notify the Network Operations Center at noc@cornell.edu or the Security Team at security@cornell.edu. The person responsible for the affected device should disconnect it from the network to avoid spreading the problem, collect and report information about the incident, and repair the problem before reconnecting to the network. Full text of policy | Interpretation

• Policy 5.7, Network Registry

  All devices (including wireless hubs and switches) connected to the Cornell network must be registered in a central network registry maintained by CIT. Network administrators or users must provide, at a minimum, the following information for each computer, printer, or other device: MAC address (the serial number of the network interface card), IP address (if static), and the NetID of the primary user or the person responsible for the administration of the device. CIT makes tools available to assist with registration, such as web forms that can automatically detect the MAC and IP addresses. Full text of policy | Documentation

And another recent policy promulgated in April 2004:

• Policy 5.6, Recording and Registration of Domain Names

  Three-part domain names such as bigred.cornell.edu, and other names served by Cornell's domain name servers or purchased with university funds, must be registered or recorded in the Cornell Domain Name Registry. Full text of policy | Documentation

For more information:

• The Policy Drafts page has links to the most recent drafts of all proposed IT policies as well as established policies.

• The IT Policy Framework chart and accompanying paper summarize the status of current and proposed IT-related policies.

Questions or Comments:

The Director of IT Policy would always be happy to answer any questions you have regarding IT policy development, or to come and give presentations to your campus group, committee or association. Please contact her at it-policies@cornell.edu or at 4-3584.