IT System - OIRM

Computer Security Policies, Procedures and Rules of Behavior

Last Updated: 12/02/2003

**NEH IT System**

**Rules of Behavior**

## A. NEH IT System

The National Endowment for the Humanities (NEH) Information Technology
(IT) system, "NEH IT System", comprises all computer systems managed by
the NEH Office of Information Resources Management (OIRM). The rules of
behavior synopsized on this page are to be followed by all users of the
NEH IT System, including staff from the NEH, the Institute of Museum and
Library Services (IMLS), the President\'s Committee on the Arts and the
Humanities (PCAH), and any contracted staff or interns working for those
agencies.

**B. Accountability**

Users will be held accountable for their actions on the computer system.
If an employee violates computer security policy, they may be subject to
disciplinary action.

**C. Policy Documents**

In addition to this document (\"Computer Security Policies, Procedures
and Rules of Behavior\"), system users should also familiarize
themselves with Administrative Directive M-109, \"Automated Systems and
Services\" located at: http://intranet/directives/admindirs/m-109.doc

D. Specific Rules of Behavior:

1\) **ID\'s and Passwords**

Logon ID\'s and passwords must be kept private. They should never be
shared for any reason. If you suspect that someone else knows your
password, please change it immediately.

2\) **Installing Software**

Do not install or modify the software on any computer system without
prior authorization from OIRM. This includes personally owned software
or software downloaded from the Internet. When in doubt, contact OIRM.

3\) **Software Licensing**

Use only software that has been licensed and authorized by OIRM and your
agency.

4\) **Moving Equipment**

Do not move or relocate any IRM equipment within or outside the building
without prior consent from OIRM. Equipment taken out of the building
will require a property pass from ASO.

5\) **Viruses**

E-mail of unknown or unexpected origin could be or include a virus. If
in doubt, do not open the mail. Call OIRM for further assistance.
Downloading information from the Internet should be done with great
care.

6\) **Locking and Logging out Workstations**

Users must lock their workstation if they are away for more than 5
minutes. This can be accomplished via the screen saver or by pressing
CTRL-ALT-DEL and choosing \"lock.\" When users are leaving for the day,
they must log off their system or shut down and turn it off. For further
instructions, see the section below on "Procedure Controls".

7\) **Computer File Permissions**

The IT system uses authentication and access control lists to keep your
files private. If you are creating files of a sensitive nature, please
ensure that you use file permissions appropriately. If you need
assistance, please contact the Helpdesk. Please respect the privacy of
other users and do not attempt to access other users\' files unless
authorized.

8\) **Authorized Use of Government Automated Systems**

NEH and IMLS provide office automation equipment and programs (e.g.,
E-mail, word processing, spreadsheets, and databases), as well as access
to the Internet, to support system users in the performance of their
job-related responsibilities. System users are permitted limited use of
government office automation equipment in an office or official duty
station for personal needs if the use does not interfere with official
business and involves minimal additional expense to the Government. For
more information, please consult NEH/IMLS Administrative Directive
M-109.

9\) **Unauthorized Use of Government Automated Systems**

Users are expected to conduct themselves professionally in the workplace
and to refrain from using government office equipment for activities
that are inappropriate. For more information, please consult NEH/IMLS
Administrative Directive M-109.

10\) **Release of Information**

Electronic communications are subject to the same basic procedures as
hard-copy communications. Users should exercise caution when sending any
non-public or confidential information over the Internet, including
e-mail. For more information, please consult NEH/IMLS Administrative
Directive M-109.

11\) **Privacy Expectations for Use of Automated Systems**

System Users do not have a right or expectation of privacy while using
any Government office equipment at any time, including accessing the
Internet, using E-mail, or for limited personal use. To the extent that
system users wish that their non-government activities remain private,
they should avoid using the NEH computer system, including the Internet
or E-mail. By using a Government computer system, system users imply
their consent to disclosing the contents of any files or information
maintained on said Government office equipment. In most circumstances,
agency officials will treat electronic communications as private as a
courtesy to employees and other system users. They have no intention of
routinely monitoring, accessing, or disclosing the electronic
communications, documents, etc., of system users including those of a
personal nature. Nonetheless, agency officials do reserve the right to
access and disclose the contents of such electronic communications and
other documents or files when necessary. For more information, please
consult NEH/IMLS Administrative Directive M-109.

General Security Policies and Procedures

Introduction

A. Policy

The National Endowment for the Humanities (NEH) Information Technology
(IT) systems are a valuable asset and resource for NEH, the Institute of
Museum and Library Service (IMLS) and the President's Committee on the
Arts and Humanities (PCAH). Ensuring security and availability of the
systems to users is of utmost importance. In order to ensure security
and availability, policies and procedures will be put in place to
facilitate the proper operation and protection of the systems. These
policies and procedures must strike an appropriate balance between cost,
ease of use for the user, and sufficient security to ensure the
integrity of the systems.

B. Scope

The security policy applies to all computer systems owned by the NEH,
including PC's, mainframes, notebook computers and such equipment
provided to PCAH. It also applies to computer systems and equipment
owned by IMLS, which contracts with the NEH for IT services per the
NEH/IMLS agreement. It applies to all users of the NEH IT system, be
they Federal employees, interns, or contracted employees. All such users
must comply with the policies put forth in this manual as well as those
promulgated in any Federal IT standards, such as the Computer Security
Act of 1987 and others as applicable.

C. Ownership

All data, programs, and computers stored or created on the NEH IT system
are property of the Federal government. Issues surrounding the
appropriate use of the system as well as the privacy afforded to users
of the system are covered in Administrative Directive M-109, which can
be found on the NEH Intranet at this address:
http://intranet/directives/admindirs/M-109.doc.

D. Violations

Violations of this policy may result in the suspension of access to NEH
computer systems or other disciplinary action as appropriate.

Policy Development and Maintenance

A. Responsibility for Policy

The NEH Security Officer, in consultation with agencies staff, is
responsible for planning, testing, enforcing, and recommending security
policy to the agency Chief Information Officer (CIO). The CIO is the
agency approval authority for putting these policies into practice.

B. Changes to Policy

Proposed changes to the security policy should be sent to the CIO via
e-mail or discussed in-person. The CIO, in consultation with the NEH
security officer and the OIRM staff, will determine if changes are
appropriate.

C. Exceptions to Policy

If an exception is required, a written request via e-mail must be sent
to the CIO. The CIO will answer in writing with a decision on the
request.

**D. Agency Policy Documents Related to IT Security**

  -------------------- ------------------------ ---------------------------------------
  Document Name        Description              Location

  Administrative       Covers authorized use of http://intranet/directives/admindirs/
  Directive M-109,     the IT systems; general  
  \"Automated Systems  IT Security policy;      
  and Services\"       release of information;  
                       privacy expectations;    
                       individuals with         
                       disabilities.            

  \"Computer Security  Covers specific IT       http://intranet/irm/
  Policies, Procedures security policies for    
  and Rules of         users, including the     
  Behavior\"           rules of behavior for    
                       system users.            

  \"Security           Documents the specific   Due to the sensitive information in
  Operations and       security configuration   this document, it is not posted
  Architecture         and risk assessment for  publicly. Please contact the CIO if you
  Manual\"             each mission-critical    need access.
                       system.                  

  \"IT Disaster        Documents how to recover http://intranet/irm/
  Recovery Manual\"    specific IT systems      
                       after a disaster.        

  \"Enterprise         As per the Clinger Cohen http://intranet/irm/
  Architecture\"       Act, this documents the  
                       current and future       
                       states of our enterprise 
                       and the role IT plays in 
                       our mission.             

  \"Agency IT          Documents how the IT     http://intranet/irm/
  Strategic Plan\"     strategy dovetails with  
                       the agency-wide          
                       strategic plan;          
                       discusses *the who,      
                       what, why* and *when* of 
                       upcoming IT projects     
                       which will help us reach 
                       the future state         
                       documented in the        
                       Enterprise Architecture. 
  -------------------- ------------------------ ---------------------------------------

Security Roles

Numerous offices and individuals play important roles in NEH security.
An expanded list can be found in M-109, below are offices and
individuals with primary responsibilities.

A. Chief Information Officer (CIO)

Is responsible for ensuring that proper policies and procedures are put
in place to meet NEH security needs and to meet Federal law and best
practices. The CIO is also responsible for yearly GISRA (Government
Information Security Reform Act) reporting to the Office of Management
and Budget.

**B. Human Resources Office (HR)**

HR is responsible for issuing security badges to all employees, temps,
interns, or others who need to access the building. They are also
responsible for determining when computer accounts should be created or
deleted. Typically, when a user goes to HR to receive his security
badge, HR will ask OIRM to create a computer account for the user if
needed. When a user leaves the agency, HR will ask OIRM to remove the
computer account. Keeping this responsibility in HR enables the agency
to maintain a separation of duties between those who authorize accounts
(HR) and those who actually put them in place (OIRM). This separation of
duties is an important part of IT security.

C. IMLS Administrative Officer

Shall be responsible for informing OIRM when IMLS temps, contractors, or
other non-federal workers need to have accounts created or deleted. IMLS
employees will have computer accounts created or deleted through the HR
Office, as described in section B.

D. Office of Information Resources Management (OIRM)

Is responsible for managing the NEH computer systems and ensuring that
security policies are applied and enforced on a day-to-day basis. This
includes the creation and deletion of user accounts needed to access the
systems.

E. The NEH Security Officer (SO)

The agency's subject-matter expert on computer security. The SO will
keep up-to-date on the latest security best practices and security tools
to ensure the integrity of NEH data. The SO will be responsible for
testing and updating the agency's security systems. The SO reports
directly to the CIO regarding security matters.

Protection of Data

A. Data Types

Not all data are of equal sensitivity. For example, some data are
designed for public release and consumption (e.g. press releases) while
other data are sensitive and should not be viewed by the public (e.g.
grant applications). In addition, access to certain data within the
agency may be appropriate only for some individuals or some groups of
individuals.

B. Access Control

The process by which data is protected to ensure only the appropriate
users or groups can see it. Users are given access control over data
that they create. This access control is designed to enable them to keep
data private or to share it only with appropriate users. Each user must
take particular care to ensure that access controls are used correctly
to ensure only appropriate parties can read their files. By default,
users are set up so they solely have access to their own home directory.
This ensures a degree of baseline security for all users, even if they
are not personally knowledgeable about how file security functions. OIRM
can provide access control instruction to any NEH user who needs
assistance on its proper use. Please see administrative directive M-109
for more information about the privacy of users on the NEH systems.

C. User IDs

Each user is assigned a unique user ID for the general NEH IT system and
if needed, the Wang system. This unique user ID is used as part of the
access control process to restrict access to particular files or
programs. This user ID can also be used to track certain actions taken
by the user. For example, the creation or deletion of a file. **Users
are responsible for all access gained through the use of their user
ID**. Refer to paragraph 3 of M-109 for the responsibilities of each
user and/or office. No group accounts are allowed since that would
render auditing useless and accountability unenforceable. Group accounts
also limit the privacy users have over their documents.

D. Passwords

Passwords are used in conjunction with each user ID as part of the
access control process. All user ID's must have a password. In addition,
this password must be changed periodically to limit the chances of its
being compromised. Our agencies do not process classified information,
yet the Privacy Act of 1974 mandates federal agencies keep their data
secure. The database(s) that contain reviewers, applications, grants,
and mailing lists, for example, hold enough information for a person's
identity to be stolen. Currently some of this information resides on the
Wang system, which requires a second user ID and password to access.
This provides a second level of security. Eventually NEH and IMLS will
be moving all the databases to the Windows NT environment. Windows NT
incorporates a Single Sign-On (SSO) model of security. This means that
all data can be accessed through a single user ID and password. For
example, the Exchange/Outlook e-mail database and NEH's Grant Management
System allow access based only on your Windows NT logon. For this reason
password requirements may change to enhance security. As stated before,
you are responsible for all processes under your account. If your
password is weak, suspect, or written down, then you have reduced the
amount of time an individual needs to gain access to sensitive
information on the system.

E. Selecting a Password

The objective when choosing a password is to make it as difficult as
possible for someone to make educated guesses about what you\'ve chosen.
This leaves him/her no alternative but a brute force search, trying
every possible combination of letters, numbers, and punctuation.

*Current system password requirements (2/02)*

-   Minimum length of 6 characters.

-   Maximum password age is 60 days.

-   Password expiration warning is 14 days prior to expiring.

-   Account locked after four unsuccessful attempts -- User must call
    OIRM/HELP (x8399) to have their account unlocked. Accounts will not
    be unlocked if requested by a third party or if OIRM cannot identify
    the requesting user.

*What Not to Do*

-   Don't share your password with anyone, even IT staff.

-   Don't write it down and stick it on your monitor, the wall, under
    your keyboard or throw it away. Really desperate intruders will go
    "dumpster diving" for such information.

-   Don\'t use a word contained in English or foreign language
    dictionaries, spelling lists, or other lists of words.

-   Don\'t use a password of all digits, or all the same letter. This
    significantly decreases the search time for someone trying to steal
    your password.

-   Don\'t use your login name, e.g., jsmith, in any form (as-is,
    reversed, capitalized, doubled, etc.).

-   Don\'t use your first or last name in any form, the names of your
    spouse, children or pets.

-   Don\'t use number(s) or special character(s) only at the beginning
    or the end of a word, e.g. pass22 or !!work. Instead, mix them
    within the password, e.g. p2a4s#s.

-   Don\'t use other information easily obtained about you. This
    includes license plate numbers, telephone numbers, social security
    numbers, the brand of your automobile, the name of the street you
    live on, etc.

*What to Use*

-   Do use a password with at least 3 of these 4 characters: UPPER/lower
    Alphabetic, numeric, and special characters, e.g., punctuation or
    ASCII characters. Example of a good password - ro\$B!o2

-   Do create a new password every time you change it. Changing the
    numbers at the end is not a new password.

-   Do use a password that is easy to remember, so you don\'t have to
    write it down.

-   Do use a password that you can type quickly, without having to look
    at the keyboard. This makes it harder for someone to steal your
    password by watching over your shoulder.

```{=html}
<!-- -->
```
-   Do change your password if you think it has been compromised. Alert
    OIRM of the possible system breach.

### Hints

-   HINT -- Use the first character of a catchy phrase, varying case and
    use special characters

> One for the money, two for the show = 1ft\$Tfts
>
> To be or not to be = 2bon2B?
>
> I don't want to change my password! = I'wt\$mp
>
> Start training within the month = St!9tm

-   HINT - Choose two or more short words, link them together, vary the
    case and use special characters

> remote island = rE\~h2o

-   HINT - Avoid obvious replacements, s with \$ or L and I with 1 and
    placing one or two special characters at the beginning or end

-   HINT -- Deliberately misspell words but not by reversing words
    (sdrow), reflection (worddrow), or by doubling (wordword).

> cracker jack = vRavk\$avk

F. Event Logging

The computer systems log various events, including such things as
unsuccessful attempts to log in, the creation or modification of files,
errors, e-mail usage, web usage, and the like. OIRM will review these
logs periodically to ensure that no security violations are occurring.
Please see administrative directive M-109 for more information about the
privacy of users on the NEH systems.

Operational Controls

A. Backup

All user data is backed up each day, Monday-Friday, by OIRM staff.
Systems backups are done on a periodic basis. This data is kept for 30
days and then the tapes are reused. Some tapes are kept for long-term
storage (see paragraph D. below). OIRM staff will monitor the size of
these backups to ensure that sufficient tapes are available to complete
the backups.

B. Backups and Records Retention

Backups are made so that data that is lost or damaged can be replaced,
as when a hard disk fails or a file is accidentally deleted. Backups are
not designed to substitute for proper records management and records
retention. See paragraph H. below for more information about records
management.

C. Recovery

All backups must be tested periodically by OIRM to ensure they can be
restored properly. If a user needs a file restored, a message should be
sent to the OIRM help desk. The message should include the name(s) of
the files to be restored, the directory the file was in, the directory
the restored file should be placed into, and the date of the tape from
which it should be taken.

D. Long-term Storage

Periodically, tapes are taken to an off-site location. This is done in
the event that a disaster occurs and damages the tapes kept at the NEH.

E. Contingency and Disaster Planning

The Chief of Systems Operations is responsible for developing
contingency and disaster recovery plans for the agency IT systems. The
CIO must approve these plans. These documents must address the
procedures and information needed to recover from typical disasters that
could take place in a computing environment. It must explain in a
step-by-step fashion how to recover specific services (e.g. e-mail
server) back to normal operations in the event of a disaster like a
failed hard drive or failed CPU. Please see the \"NEH Disaster Recovery
Manual\" for more information. It is available at: http://intranet/irm.

F. Physical Security

Access to offices where computers, networking equipment, and computer
data are kept is extremely important. By gaining unauthorized physical
access to our computer room, for example, a person would be able to
circumvent many of our security measures. Thus it is important to keep
such rooms locked and secure. The backup tapes are particularly
sensitive and should be kept in a locked, fireproof safe at all times.
The CIO shall make recommendations to ASO about any physical security
issues.

G. Separation of Duties

It is important to have distinct separation of duties to ensure that no
one person has the authority for all security matters. The policies set
forth in this document are designed, in part, to set up separate duties
for various parties, including the CIO, the SO, HR, the Chief of Systems
Operations, and the IG. This will ensure an appropriate checks and
balances system.

H. Records Management

None of the agencies on the NEH IT system have an electronic records
management system. Hence, any data that is found to be a federal record
must be printed out and filed into an agency's records system. Records
should never be stored solely on the computer system until such time
that the agencies acquire an electronic records management system
approved by the National Archives. Please contact your agency's records
person for more information about records management.

I. Data Disposal

When users leave the agency, they are required to dispose of their data
appropriately. This means transferring documents to other users as
needed, printing records and putting them in the official agency record
system, and deleting non-record information which is not deemed
important enough to retain. Once the user is gone, OIRM staff will
delete the user directory and any remaining files. When computers hard
drives are disposed of, they will be wiped of data before being
excessed.

J. Training

All users of NEH IT systems are required to take periodic computer
security training. This training will familiarize them with good
security practices, including, how to choose appropriate passwords,
properly logout, secure data, etc. New users will be given a summary of
the security training. All users must attend this training to continue
receiving system access.

K. Incident Response

When any NEH IT system user discovers a security violation, the incident
should be immediately reported to the Security Officer. This report will
generally take the form of e-mail or telephone call to the OIRM
Helpdesk. The SO will analyze the incident to determine the level of
threat. The incident may turn out to be a false alarm. In the event of a
real threat, the SO is responsible for taking appropriate action to
remove the threat. One important duty of the SO in responding to an
incident is to notify the appropriate parties. If the SO deems an
incident to have agency impact, he will notify the CIO. If the incident
has the potential for interagency impact, the SO will also notify
FedCIRC, using the guidelines set forth in their October 29, 2000 memo
entitled \"Agency Interaction with GSA\'s FedCIRC.\" (That memo is
available at http://intranet/irm). The CIO will inform the agency IG of
security incidents with agency or interagency impact.

Procedure Controls

A. File Security

Each user has a Home, Settings and Shared directory. Division/Offices
have a directory for sharing major project documents and storing former
employee documents.

-   The Home directory, sometimes referred to as the "F:\\" drive, is
    the default and preferred directory for all data. Only that user ID
    has access to the Home directory and permissions cannot be changed
    on this directory to ensure security of their documents. Any
    information that is confidential, such as your personal agency
    related personnel information (i.e. EPPA, TSP information, etc) or
    documentation on grant applications and/or reviews, should be stored
    here.

-   The Settings directory is for system information unique to your user
    ID login. Your ID requires rights to this directory for the system
    to change such things as your desktop settings, store your favorites
    and your system profile. Please do not access this directory to
    change, delete or copy the material contained within.

-   The Shared directory, sometimes referred to as the "H:\\" drive, is
    used to store information that anyone in the system is allowed to
    read. Everyone has "read" rights to your Shared directory unless you
    change the permissions. You can allow/restrict individual users on
    the system with various degrees of access to your shared directory.

-   Division/Office shared directory should only be used to share major
    project documents or documents that need to be accessed by the whole
    office. If a former employee fails to disperse their files, OIRM
    will temporarily move them to this directory so that staff can
    review and obtain needed documents. Employees should not store their
    files here due to the inability to determine ownership and concerns
    with long term storage space.

-   The "C:\\" drive has been locked down so users cannot place data or
    install programs on the desktop computer. This prevents data from
    being lost due to a computer failure, provides uniformity of the
    computers for easy swap outs when one does fail, and ensures that
    all data is backed up.

**B. Workstation Security**

As with most functions in the Microsoft world, securing your workstation
can be done a couple of different ways. The "Ctrl-Alt-Delete" option
(Fig. 1) or the "Start, Shut Down" dialog box (Fig. 2) provide the
controls for securing your workstation.

![](media/image1.png)

Use the "Ctrl-Alt-Delete" option:

-   *Lock Workstation*: Use this quick and easy option if you are going
    to be away from your desk for a few minutes, such as when you go to
    grab a print job or to the restroom. It will keep someone from
    accessing you PC.

-   *Logoff*: Use this when you leave your desk for extended periods of
    time, like lunch, meetings, or at the end of the day. This option
    closes your session with the server and allows another person, such
    as system administrators, to use the computer if needed.

-   *Shut Down*: Used at the end of the day or week, or when you are
    leaving for extended periods of time i.e. vacation. PLEASE NOTE that
    the Shut Down option DOES NOT turn the computer off! The computer
    closes your session, disconnects from the network and displays a
    RESTART dialog box, which indicates that it is safe to turn the
    computer off. If you want to save energy, wait until the restart box
    is on the screen, then turn off the computer. Another reason to wait
    for the restart box is to ensure the computer shuts down properly.
    If it does not, someone could gain access to the system. NOTE: OIRM
    does not have a policy regarding computer shut down in terms of
    nightly or on weekends. We do however ask that you logoff or
    shutdown/turn off your computer when leaving for the day.

-   *Change Password:* Allows you to change your password anytime you
    want or need to. Note: if you are going to be working off site or on
    travel about the time your password is scheduled to expire, it would
    be wise to change the password before you leave. You cannot create a
    new password outside of the network.

-   *Task manager:* Activates the Windows NT Task Manager monitoring
    box, a system administrator utility that is used to end task
    applications that fail or get stuck.

-   *Cancel:* Closes the Windows NT Security box and returns you to the
    desktop.

![](media/image2.png)

The "Start, Shut Down" option (Fig. 2) allows you to shut down the
computer, restart the computer, and close all programs and log on as a
different user. Notice that shut down and logoff are available both here
and through the "Ctrl-Alt-Delete" option (Fig. 1). The options "Logoff"
and "Close all programs and log on as a different user" are one in the
same. The Restart option performs a "warm" reboot of the computer. This
option is used administratively when the computer is not properly
responding or acting "funny".

Note: When you want to shut down (turn off) or restart (reset) the
computer, these respective options should be used. **[Unless instructed
otherwise you should never power off your computer. Instead, you should
use the shut down option. If you shut down the computer without going
through the normal procedures, you could corrupt system files,
applications and/or data files.]{.underline}**

After a computer has been idle for a period of time (that is you haven't
typed anything or moved the mouse), the screensaver will start. This is
a security feature that will secure your logon in the event you forget
to lock, logoff, or shutdown your computer. You must enter your password
to regain access to the system. Non-standard screensavers are not
allowed. For further information, see the Internet section about
downloading and loading programs (below).

C. E-mail Security Principles

According to M-109 e-mail "allows employees to exchange messages with
outside entities..." and colleagues. Attention should be focused on
M-109 sections 4 and 5 that specifically state the agencies' policy on
use of e-mail. Types of messages to be concerned about are hoax, spam
and false identity messages that are passed along or generated from
inside the agencies. To our knowledge no one has generated any of these
within the agencies but all bases must be covered. Filters are in place
to reduce but not eliminate unwanted messages and certain incoming
attachments. Passing along hoaxes (warnings about a "new virus" or bad
product) and/or spam (non-requested information sent to numerous people)
should be avoided. Hoax messages in general cause time loss, anxiety in
some people and drain system resources. Unless you verify the
information with a reputable source by phone or Web site, do not pass it
along. If you must pass it along or think it is legitimate but are
unable to verify it, send it to the OIRM mailbox and we will look into
it. Spam messages should be deleted or sent to the Abuse mailbox for
evaluation and possibly blocked. DO NOT reply to them to be removed from
their list, because they will just add you to the "live" mailbox list
and send you more.

E-mail attachments have become a major concern. OIRM has had incidents
of messages arriving from KNOWN constituents with attachments that are
viruses. You should be wary when receiving an attachment from anyone.
Don't open it unless you are expecting it. As stated before, filters are
blocking certain attachments before they even reach the agency. If
someone is attempting to send you a legitimate attachment that is being
blocked, contact OIRM for assistance.

One final note on e-mail again stresses the policy of M-109. Section 8
details when, what and why OIRM would be viewing e-mail and/or logs. As
stated in Section 8, paragraph c, "...employees should be aware that the
capability to do so exists..." and will be provided to the appropriate
officials when requested.

D. Internet Guidelines

Although OIRM does not "police" Internet access, they do monitor the IT
system for adverse changes. The Internet's openness allows you to
download just about anything and attempt to install it on your computer
or store it some place. The threat from downloads comes in the form of
viruses or program tools for intruders to access the system. It is a
known fact that news groups, gaming sites, movie sites,
screensaver/wallpaper sites, risqué sites and other similar places
provide a launching place for viruses and tools. These places provide
the virus writers and system attackers an abundant supply of people that
can be used to perpetuate and amplify destructive programs.

A specific area of concern here at NEH/IMLS/PCAH is the downloading and
installing of screensavers. The problem with screensavers and most other
programs downloaded from the Internet is that they are not compatible
with the Windows NT operating system, since they are written for Windows
9x and cause system problems with NT. In addition to this
incompatibility, the "C:\\" of the tower computer has been locked down.
Installation of a program to the "C:\\" drive should fail because of the
lock down, but, if successful, it may cause other problems elsewhere and
eventual computer failure.

All of these programs can cause system degradation and take up limited
resources of the system. Some of these files take up large amounts of
space and in a matter of minutes one person can fill the storage space
that is currently available to everyone. The most troubling aspect of
this type of user behavior is that it is almost never related to NEH
business. Games and political jokes are not mission critical!

A few guiding principle's, while not inclusive, that OIRM ask you to
follow:

-   Do bring to OIRM's attention programs and web resources that may be
    useful to the agencies. We will test, evaluate and discuss pros and
    cons of the resource. Be prepared to justify the need!

-   Do utilize the Internet as a resource to help you with your job.

-   Do [not]{.underline} download and/or attempt to install any
    programs, e.g. screensavers, games, winzip, etc.

-   Be careful before submitting your e-mail address to a Web site.
    Please read the "Privacy Policy" of any site to avoid your address
    being sold to other non-reputable sites that send out junk e-mail.

E. Remote Access

Remote access presents security issues unique to the type of connection.
OIRM currently provides access through Outlook Web Access (OWA) for
e-mail and dial-up access through laptops while on travel. With new
telecommuting policies and security concerns, OIRM is evaluating other
means of access.

With Outlook Web Access (OWA) the major security issue is when a user
forgets to logoff. If you are in a public place such as a Cyber Coffee
shop or a public library, and you forget to logoff, the next user will
have access to your mailbox. Another concern is the "Save this password
in your password list" check box. This feature stores your password on
that system and would allow anyone access to your mailbox until you
changed your password. Do not check this box. If already checked, remove
the check by clicking on the box. Also be aware of someone "shoulder
surfing" and shield the keyboard when entering your password.
Instructions on how to use OWA are on the Intranet site at
http://intranet/irm/ under "How to Read E-Mail from Home."

The agencies' laptop computers have been configured for long distance
calls to be charged to the appropriate agencies phone cards. Secure
laptops when on travel. When logging in, shield the keyboard as you
enter your password. A misplaced laptop provides someone a way in or
they can obtain the phone card information and use it for long distance
calls. Please report any lost or misused laptops immediately.

# 

F. Virus Protection

New virus threats occur almost daily. You need to use the same mental
awareness that you use when driving defensively: watch out for everyone
and everything. OIRM has set up a three tiered "protection" level to
combat viruses but this will not catch all them. As stated before, OIRM
blocks certain attachments that are known to possibly contain viruses.
At the server level (mail server and file server), anti-virus software
scans messages as they come in and files as they are opened. At the
desktop, anti-virus software scans floppy disks as they are accessed and
files that are downloaded from the Internet as they are opened.

As a user, you can be a forth level of "protection" by remaining
vigilant. Do NOT open an attachment in e-mail from some unknown person,
or unexpected e-mail with an attachment from someone you do know. If
either of these occurs, call OIRM immediately and let them know that you
may have a virus.

G. Closing

The automated world of computers has made data processing, writing
letters/documentation, number crunching, storing information and
communication less time consuming. At the same time it has opened new
avenues for devious people to steal, snoop, and/or destroy that
information. Security at the workplace is an individual and agency
responsibility just as it is an individual and family responsibility at
home. Now you have an understanding of why OIRM requires individual
accounts and passwords; ask that you lock or logoff your computer when
away; be wary of strange e-mail; and resist downloading stuff from the
Internet.

**User Accounts Policy**

**1.0 Purpose**

The purpose of this policy is for the adding, extending and removing of
accounts on the Information Technology System, \"IT System.\" The IT
System is utilized by the National Endowment for the Humanities (NEH),
Institute of Museum and Library Services (IMLS), and the President\'s
Committee on Arts and Humanities (PCAH). To facilitate a \"checks and
balances\" approach, accounts are authorized solely by the Office of
Human Resources (OHR), the NEH Administrative Services Office (NASO) and
the IMLS Administrative Officer (IAO). Then those accounts are created
solely by the Office of Information Resource Management (OIRM).

**2.0 Scope**

This policy applies to all system users, including employees, temporary
employees, contractors, interns and volunteers of NEH, IMLS and PCAH.

**3.0 Definitions**

1\. For the purposes of this policy, \"system users\" shall be divided
into two categories:

**Category 1 System Users** \-- to include Federal government employees,
interns, volunteers, and any other non-contracted users.

**Category 2 System Users** \-- to include employees of private sector
firms who are doing contract work for the government. This would include
temporary laborers, administrative staff, consultants, and other types
of contractors.

2\. The **\"New User Form\"** is a web-based application used by OHR,
NASO, and IAO to notify OIRM about adding, deleting, and extending
computer system accounts.

**4.0 Policy**

**4.1 General**

1.  It is solely and only the responsibility of OHR staff to authorize
    (i.e., add, extend, and remove) accounts for Category 1 System
    Users.

2.  It is solely and only the responsibility of NASO staff to authorize
    (i.e., add, extend, and remove) accounts for Category 2 System Users
    contracted by the NEH.

3.  It is solely and only the responsibility of IAO staff to authorize
    (i.e., add, extend, and remove) accounts for Category 2 System Users
    contracted by the IMLS.

4.  OIRM will add, extend and remove accounts only when authorized by
    OHR, NASO, or IAO as applicable.

5.  All IT user accounts will have expiration dates. If the person is
    also issued an ID badge by OHR, the user account expiration date
    will correspond with the expiration date on the ID badge.

**4.2 Requirements**

1.  ALL new Category 1 System Users shall report to OHR the first day of
    their tour of duty to obtain an ID badge and user account.

2.  User accounts will automatically expire. The System will
    automatically lock an account at the end of the expiration date
    (midnight). The expiration date will be determined by the
    authorizing official (OHR, NASO, or IAO as appropriate).

3.  OIRM will alert the user two (2) weeks before their account expires
    to provide ample time to renew their ID and extend their account.
    Users with a Tour of Duty of less than two weeks that require an
    extension must have the appropriate authorizing official (OHR, NASO,
    IAO) authorize the extension.

4.  A system user must report to OHR or NASO or IAO (as appropriate)
    upon notification AND BEFORE their account expires to extend their
    account. If the individual also has an agency ID badge, they must
    report to OHR to have their ID badge extended as well, as it will
    expire on the same day.

5.  Accounts will not be extended or activated until OHR or NASO or IAO
    (as appropriate) notifies OIRM of extension. USERS WILL NOT HAVE
    ACCESS TO THE SYSTEM ONCE THEIR ACCOUNT/ID EXPIRES.

6.  Category 1 System Users must report to OHR for separation clearance,
    returning their ID badge and for removal of their account. Category
    2 System users must report to NASO or IAO (as appropriate) when they
    depart the agency for the proper removal of their account and to
    return their ID badge if they have one.

**4.3 Actions \-- Examples**

1.  Add Category 1 System User account example

```{=html}
<!-- -->
```
a)  New user reports to OHR. OHR verifies employment and requests
    account through User form.

b)  OHR notifies OIRM via the new user form to add a new user account.

c)  OIRM sets up account according to information provided by OHR.

```{=html}
<!-- -->
```
2.  Add Category 2 System User account example

```{=html}
<!-- -->
```
a)  New NEH Contractor reports to NASO. NASO verifies contract
    employment and requests account through User form.

b)  NASO notifies OIRM via the new user form to add a new user account.

c)  OIRM sets up account according to information provided by NASO.

```{=html}
<!-- -->
```
3.  Extend current Category 1 System User account

```{=html}
<!-- -->
```
a)  User notified by OIRM that account expires in two (2) weeks.

b)  User reports to OHR. OHR verifies continuing employment and request
    extension of account.

c)  OHR notifies OIRM via the new user form to extend a user account..

d)  OIRM extends account to new account/id expiration date.

```{=html}
<!-- -->
```
4.  Extend current Category 2 System User account

```{=html}
<!-- -->
```
a)  IMLS Contractor notified by OIRM that account expires in two (2)
    weeks.

b)  User reports to IAO. IAO verifies continuing contracted employment
    and requests extension of account.

c)  IAO notifies OIRM via the new user form to extend a user account.

d)  OIRM extends account to new account/id expiration date.

```{=html}
<!-- -->
```
5.  Inactive Category 1 System User account (Automatic program runs
    weekly alerting OIRM of accounts inactive for past 22 days.)

```{=html}
<!-- -->
```
a)  If account is suspected to be inactive, OIRM inquires with the user.
    If user unavailable, the supervisor is contacted. If supervisor is
    unaware of users\' status, OHR will be contacted to determine
    users\' status.

b)  If unable to determine users\' status the account will be disabled.

c)  Account will be enabled, but not extended if expired, by OIRM upon
    notification from user or user\'s supervisor that they have returned
    or need access remotely.

d)  Account will remain on the system until OHR notifies OIRM to delete
    it.

```{=html}
<!-- -->
```
6.  Delete Category 1 System User account

```{=html}
<!-- -->
```
a)  User reports to OHR with separation date.

b)  OHR notifies OIRM via the new user form to delete a user account.

c)  OIRM changes the expiration date, if different, on the user account
    according to the date provided by OHR

d)  OIRM will verify with the user or user\'s supervisor that all files
    of agency relevance have been transferred.

e)  OIRM will delete user account within 5 business days of the
    expiration date.

```{=html}
<!-- -->
```
7.  Delete Category 2 System User account

```{=html}
<!-- -->
```
a)  NEH contractor reports to NASO with separation date.

b)  NASO notifies OIRM through the new user form to delete a user
    account.

c)  OIRM will verify with the user or user\'s NEH point of contact that
    all files of agency relevance have been transferred.

d)  OIRM will delete user account within 5 business days of the
    expiration date.

**5.0 Revision History**

**10/30/2003 \--** Policy changed to have contracted personnel
authorized by NASO and IAO rather than by OHR.

**11/5/03** \-- Made minor language changes.