Information Technology Acceptable Usage

What you should know… Employees provide the first and final defense in addressing and mitigating day-to-day security risks Security is everyone’s responsibility 6/14/2016Security Awareness2

PS 1103: IT Acceptable Use Policy Created in 1999, revised in 2002 – Being reviewed, and plans are to update in 2010 Guides users of the Government of Saskatchewan’s IT infrastructure Employees are to follow this policy to ensure that their use of the Government’s IT resources are appropriate 6/14/2016Security Awareness3

Government Policy Three usage types for the Government of Saskatchewan’s IT infrastructure 1.Core activities required to conduct business of government e.g. ing an agenda for upcoming meeting 2. Incidental neither explicitly permitted nor explicitly denied e.g. personal photocopies – employees are to cover costs 3. Unacceptable impedes work of others or needlessly squanders IT resources e.g. objectionable internet sites 6/14/2016Security Awareness4

Unacceptable Use Unacceptable use impedes the work of others or needless squanders IT resources The definition of unacceptable use will vary between ministries It is unacceptable to: Use the Government’s IT infrastructure for activities that contravene the law, existing policies or regulations Use any part of the Governments IT infrastructure for personal or financial gain 6/14/2016Security Awareness5

– Appendix B is accessible under the terms of The Freedom of Information and Protection of Privacy Act if information is requested that includes records Employees should have no reasonable expectation of privacy in transmitted – In government policy government reserves the right to access the contents of messages transmitted through its information technology infrastructure 6/14/2016Security Awareness6

Incidental Use… reminder Incidental Use neither explicitly permitted nor explicitly denied e.g. personal accounts – checking occasionally is incidental However, when you are monitoring it constantly, it is no longer incidental 6/14/2016Security Awareness7

An Example of Core, Incidental & Unacceptable usageTechnologyCoreCore/IncidentalIncidentalIncidental/Unacceptable Un- acceptable Against Existing Policy Illegal Phone Answering an inquiry from a member of the public Make a brief personal call You make many personal calls & your work calls are answered by your busy co- workers Accessing lines on gov’t phones Using the office phone during office hours to buy and sell stocks Recording phone conversations without permission 6/14/2016Security Awareness8

An Example of Core, Incidental & Unacceptable usage TechnologyCoreCore/IncidentalIncidentalIncidental/Unacceptable Un- acceptable Against Existing Policy Illegal Computer Sending an to all the members of the department OH & S Committee with minutes of the last meeting. s to co-workers with birthday wishes, holiday greetings. Playing solitaire while on break. Sending department- wide s with puppies 4 sale type messages Distributing chain- s with attachment that waste limited computing resources and/or contain viruses. Distributing a racist or obscene joke via . Making a libellous or slanderous statement about a co- worker in an . 6/14/2016Security Awareness9

Questions? 6/14/2016Security Awareness10