1. Information Technology Acceptable Usage

2. What you should know… Employees provide the first and final defense in addressing and mitigating day-to-day security risks Security is everyone’s responsibility 6/14/2016Security Awareness2

3. PS 1103: IT Acceptable Use Policy Created in 1999, revised in 2002 – Being reviewed, and plans are to update in 2010 Guides users of the Government of Saskatchewan’s IT infrastructure Employees are to follow this policy to ensure that their use of the Government’s IT resources are appropriate 6/14/2016Security Awareness3

4. Government Policy Three usage types for the Government of Saskatchewan’s IT infrastructure 1.Core activities required to conduct business of government e.g. emailing an agenda for upcoming meeting 2. Incidental neither explicitly permitted nor explicitly denied e.g. personal photocopies – employees are to cover costs 3. Unacceptable impedes work of others or needlessly squanders IT resources e.g. objectionable internet sites 6/14/2016Security Awareness4

5. Unacceptable Use Unacceptable use impedes the work of others or needless squanders IT resources The definition of unacceptable use will vary between ministries It is unacceptable to: Use the Government’s IT infrastructure for activities that contravene the law, existing policies or regulations Use any part of the Governments IT infrastructure for personal or financial gain 6/14/2016Security Awareness5

6. Email – Appendix B E-mail is accessible under the terms of The Freedom of Information and Protection of Privacy Act if information is requested that includes e-mail records Employees should have no reasonable expectation of privacy in e-mail transmitted – In government policy government reserves the right to access the contents of messages transmitted through its information technology infrastructure 6/14/2016Security Awareness6

7. Incidental Use… reminder Incidental Use neither explicitly permitted nor explicitly denied e.g. personal email accounts – checking occasionally is incidental However, when you are monitoring it constantly, it is no longer incidental 6/14/2016Security Awareness7

8. An Example of Core, Incidental & Unacceptable usageTechnologyCoreCore/IncidentalIncidentalIncidental/Unacceptable Un- acceptable Against Existing Policy Illegal Phone Answering an inquiry from a member of the public Make a brief personal call You make many personal calls & your work calls are answered by your busy co- workers Accessing 1- 900 lines on gov’t phones Using the office phone during office hours to buy and sell stocks Recording phone conversations without permission 6/14/2016Security Awareness8

9. An Example of Core, Incidental & Unacceptable usage TechnologyCoreCore/IncidentalIncidentalIncidental/Unacceptable Un- acceptable Against Existing Policy Illegal Computer Sending an email to all the members of the department OH & S Committee with minutes of the last meeting. Emails to co-workers with birthday wishes, holiday greetings. Playing solitaire while on break. Sending department- wide emails with puppies 4 sale type messages Distributing chain- emails with attachment that waste limited computing resources and/or contain viruses. Distributing a racist or obscene joke via email. Making a libellous or slanderous statement about a co- worker in an e-mail. 6/14/2016Security Awareness9

10. Questions? 6/14/2016Security Awareness10