Adopted by the Information Technology Center Management Committee on
December 11, 2013
Revised by the Committee on February 25, 2016
Revised by the Information Security Committee on February 14, 2018
Revised by the Information Security Committee on February 13, 2020

The University of Electro-Communications IT Systems Operations and Administration
Procedural Manual
1. About this Procedural Manual
1.1 Purpose of the Procedural ManualThis procedural manual identifies procedures pertaining to the appropriate operation andadministration of Information Technology (IT) systems at the University of ElectroCommunications (hereinafter referred to as “UEC”) in conformance with the provisions in
Article 28 of UEC’s Basic Operating Rules for IT Systems and the provisions in Article 40 of
UEC’s IT Systems Operations and Administration Rules.
1.2 Extent of This Procedural Manual’s Applicability
This procedural manual applies to everyone who operates, administers or uses IT systems
belonging to UEC.

2. Organization That Operates and Administers UEC Information Networks and IT Systems
The Information Technology Center (ITC) is the administrative operation section that
operates and administers information networks and IT systems at UEC as per the supervisionof the chief information officer (hereinafter referred to as “CIO”).
The heads of each section, e.g. Faculty, Center, Administration Bureau etc., are appointed
to the supervisors who are responsible for supervision, and also appoint the persons below:

Section Operations Managers
Section Operations Managers are appointed from among personnel that belong to their
specific section etc, and are in charge of practical information network and IT systems
operations and administration. They are allowed to appoint assistants from among theSection Systems Administrators（See below）.
Section Systems Administrators
Section Systems Administrators are appointed from among personnel that belong to their
specific section etc, and are responsible for operating information networks and IT systems
belonging to their sections. Multiple Section Systems Administrators may be appointed.
ITC primarily communicates with the Section Operations Managers. When assistants of theSection Operations Manager have been appointed, and the section is being operated andadministered by multiple personnel, however, a mailing list or other method must be preparedso that Section Operations Managers and their assistants can all read e-mails from ITC, incase of emergencies.
Apart from the above-mentioned system personnel, the following personnel are currently
involved in UEC information networks and IT systems.
Section operations managers and section systems administrators shall cooperate inoperating and managing UEC information networks and IT systems.
IP Address Managers
The IP Address Managers handle the administration of logical IP address blocks for thecampus network. They are appointed from among the users of those logical IP address
blocks. ITC manages IP addresses if an IP address administrator cannot be selected.
Building Network Administrators
Building Network Administrators handle the administration of physical networks (LAN wiringand network devices) installed in each building.
These personnel, each Section Operations Managers, and Section Systems Administrators
must cooperate with each other to operate and administer the information networks and IT
systems.

3. Instructions for Accounts and Passwords
3.1 Passwords
Passwords are the most important means of protecting IT system users. As such, allpasswords must fulfill the following conditions:・ Be a minimum of twelve characters, and sixteen or more characters if possible
・ Include upper- and lowercase letters, numbers, and symbols
・ Not be words found in dictionaries or proper nouns
Even if passwords are sufficiently complex, it is recommended that they are changed
regularly. Furthermore, in the case of a partial data leak all passwords thought to have leaked
are to be changed immediately, even if they were encrypted or hashed.
The temporary passwords provided to users must be changed within a certain period of time.
Users must not be allowed to continue using their temporary passwords.
Passwords must not be shared with multiple systems either inside or outside of campus.
3.2 Using Accounts
Systems which have account features must create accounts for users. Multiple individuals
must not share a single account, except in the case of an IT system that does not allow
multiple accounts.
Account administration must be especially rigorous when a device (such as an inexpensive
broadband router) has no multiple account features or has only one account withadministrative privileges but is operated and administered by several people. Accountinformation must not be divulged to personnel who are not involved in the system’s
administration and operations.
3.3 Active Use of Passwords
PCs have screen lock features that users can employ when temporarily stepping away fromtheir workstations. Users must always lock the screen to maintain security when they step
away, no matter how briefly. There is also a feature that makes entering a password

compulsory for waking a PC from a sleep or standby state. These features must be usedwithout fail.

4. Email Usage Manual
4.1 Prohibition of Using an Email System Other than that Established by the University
Organizations (ITC and each section)
1. In principle, UEC email system users shall use an email system established byuniversity organizations (ITC, each section, laboratory, etc.) to send/receive emails
containing information related to learning, education, and research activities.
2. If users intend to send/receive emails using IT systems (personal email address,etc.) other than the email system established by university organizations, then theyshall obtain the permission of the section supervisors in IT systems, unless explicitly
permitted by the terms of use in IT systems.
3. If users intend to send/receive emails using IT systems other than the email systemestablished by university organizations (personal email address, etc.), then users
shall take security management measures (e.g., protection of authentication
information by multi-factor authentication, application passwords, and protection of
the computer environment by introducing security software).
4. Users shall inform the section supervisors and section operations managers if theyno longer use email on IT systems (personal email address, etc.) established byuniversity organizations.
4.2 Prohibition of Auto-Forwarding Email1. In principal, users of university organization email are prohibited from autoforwarding email containing sensitive information outside of university facilities(campus).
2. If users automatically forward email containing sensitive information outside ofuniversity facilities (campus), then they shall clarify the forwarding destination,reason for forwarding, period, security measures, etc., and submit an application inadvance to the section system administrators to obtain the approval of the section
supervisors.
3. Users shall inform section supervisors and section system managers if autoforwarding emails is no longer necessary.

5. Allocation, Administration and Use of IP Addresses
5.1 Types of IP Addresses
The following four types of IP addresses are allocated and used as needed on the campus
network. ITC specifies the ranges of these address blocks.
・ Global IPv4 address blocks
・ Private IPv4 address blocks
・ IPv6 address blocks
・ Other special use address blocks
Allocation criteria are as shown below:
・ Global IPv4 address blocks
These IPv4 address blocks are primarily allocated to servers that need to be open forcommunicating with off-campus networks directly. They must not be allocated tomultifunction printers, printers, NAS appliances, network cameras, administrationinterfaces for IT devices or Internet of Things (IoT) devices. Sufficient oversight must also
be exercised when allocating them to devices that hold personal information.
・ Private IPv4 address blocks
Private IPv4 address blocks are divided into two types: those for which only on-campus
communication is possible, and those that can only communicate within a physicalsegment of the network. These are allocated to clients that have no need to communicate
directly with anyone outside the university, multifunction printers, printers, NASappliances, network cameras, administration interfaces for IT devices, and IoT devices.
・ IPv6 address blocks and other special-use address blocks
These IP address blocks are used for experiments and collaborating with institutions

other than UEC as well as local communities. ITC allocates these as needed.
5.2 IP Address Allocation
The IP address administrator allocates IP addresses according to the following procedures:
1. Systems administrators that want to allocate IP addresses fill out an application form
available at ITC and submit a request to the IP address administrator.
2. The IP address administrator carefully checks the applications. If there are no
problems, the IP address administrator sends these applications to ITC. When private
IP address blocks are requested, the administrator briefly check the application andallocates private IP addresses.
3. When applications for global IP address are requested, ITC carefully examines theapplication. If there are no problems, ITC notifies the IP address administrator thatrequested global IP addresses may be allocated. And then, ITC opens the firewalls
to have external connections via those IP addresses.
4. Systems administrators configure and operate IT devices according to theirapplications, and record what they did in their ledgers.
5. ITC retains all applications.
5.3 Using IP Addresses
Systems administrators must promptly notify the IP address administrator when an IP
address is no longer in use. In the case of global IP addresses, the IP address administrator
must then notify ITC of this change. To prevent the illicit use of terminated global IP addresses,
ITC must promptly change its firewall configurations after being informed by the IP addressadministrator.
IP addresses are allocated in accordance with requests. Systems administrators are notallowed to maintain inactive IP addresses. When IP addresses are allocated dynamically, an
allocation system that matches the allocated IP addresses with their users should be used,
and logs should be maintained.

6. Installing, Using and Disposing of IT Systems
6.1 Installing IT Systems
When planning to install IT systems, the following issues must be considered・ Who will be the system’s supervisors and administrators?
・ Who will use the system?
・ When will the system be used?
・ Why is this system needed?
・ What will the system be used for?
・ Where will the system be used?
IT systems shall be selected based on the clarification of the issues mentioned above. In
addition, pay attention to the subsequent support period of the following IT system to beinstalled when selecting IT systems.
・ Hardware
・ All software required to configure and operate the IT system, including the operating
system, antivirus software, and various other kinds of software
In particular, software shall not be operated if the support period has expired. If the support
period is shorter than the length of time the software will be used, then schedule support inadvance and include it in the initial plan.
Measures for IT systems that require high availability—such as multiplexing and enhancing
support systems—must be implemented.
IT systems for which high confidentiality is required must be installed on locked racks inlocked rooms whose keys are strictly controlled and positioned in such a way that no one but
their administrators can physically reach them.
6.2 IT System Installation
IT system installation must be performed in the following sequence:1. Gather the required information
2. Configure administrators’ accounts and passwords
3. Update the operating system and firmware and initiate security measures
4. Install and update antivirus software
5. Install, update and customize various types of software
6. Configure the firewalls
7. Check operations
8. Document the work and enter it in the log
9. Give users access and monitor them
Changing the sequence of the work is allowed if it can be guaranteed that there will be no
malware incursions. IT systems must be able to adequately withstand all known malware andattacks after the installation is completed. Data leaks must be prevented in the case of IT
systems that contain personal information by using firewalls that restrict communication
between the university and the outside campus.
Making backups of an IT system as needed is preferable. However, regular backups mustbe performed without fail on systems that must maintain high availability.
Be sure to set acquire logs for IT systems that have the function of acquiring logs. In principal,
the retention period is one year or more.
ITC distributes software products under campus-wide licenses. These licenses shall be
actively used under the conditions of use in an effort to reduce costs.

6.3 IT System Administration Tasks
IT system users must routinely undertake the following measures as IT system administration
tasks:
6.3.1 Security Measures
Apply security update for operating system and application software
Configuring the system to enable automatic update is preferable. Systems

administrators must instruct users on how to apply updates when such updates are
released.
Updating antivirus software’s virus definition files
The automatic update frequency should be set for once or more per day. Before they
begin using IT systems, users must check their antivirus software to confirm that it isoperating, and ensure that the latest virus definition file is installed.
Acquiring and checking security information for the operating systems and application
software being used
Personnel must obtain updates for the operating systems and application software theyuse. Systems administrators must also have an understanding of how the operating
systems and application software under their supervision are used. Systems
administrators provide users with information of the most recent updates.
6.3.2 Checking Logs
Logs must be checked regularly to confirm that no illicit access or attacks are occurring.
Instances of illicit access must be reported immediately and countermeasures must be
devised. Logs must be checked when attacks are being blocked, and additionalcountermeasures must be devised and reviewed. Read “10. Information Security Incident
Responses” for more information about submitting reports.
6.3.3 Backups
Backup plans must be devised according to the level of importance of specific IT systems.
Backups should be made regularly.
6.4 Tasks Related to IT System Termination and Disposal
The following tasks must be carried out when terminating an IT system. The termination work
reports regarding the following tasks must also be submitted to ITC and IP addressadministrator when a system has global IP addresses:

・ Transfer and backup information that will be needed thereafter・ Deletion of private/personal data
・ Safety measure to ensure that the system is not used by mistake
The following tasks must be carried out when reviving IT systems that have been terminated.
IP addresses must be allocated in the same way for a new IT system installation.
・ Confirm the duration of support for all installed operating systems, application andantivirus software
・ Update operating system, application and antivirus software. Apply other security
measures・ Check that the personal data were deleted if the system will longer be usedby the different users. Whenever possible, format all hard drives and otherstorage media before reinstalling the operating system and applications.
The following tasks must be carried out when disposing of IT systems:
・ Check the licenses of all software installed. Deactivate software license registrations
whenever it is possible to do so.
・ Delete all information recorded on storage media such as hard disks, etc., using an
unreadable method before disposing.
・ In the case of hard drives, use devices or programs designed to wipe hard drives, andthen physically destroy the hard drives. CD-ROMs and other medias are to be destroyed
with shredders or other devices.
・ In case of outsourcing the erasure or destruction of storage media such as hard disks,etc., a reliable waste control vender shall be entrusted. When undertaking the consigned
actual operations, it is desirable to confirm the erasure and destruction in person orreceive a disposal certificate with photographs as evidence. Confirm the disposal method
at the time of pre-approval if the operation is re-entrusted.
・ Follow the instruction of Accounting and Procurement Office when disposing of IT system
hardware.
・ Record IT system disposal in ledgers

7. System Ledger Preparation
In terms of IT systems and the software operated by IT systems, each laboratory or section
shall create ledgers that require the following:
The following ledger items are required:・ IT systems are as follows:
Hardware names; installation dates; equipment numbers; supervisor, administrator anduser names; purposes of use; operating systems; IP addresses; places of use; anddisposal dates
・ Chargeable software are as follows:
Software names; numbers of licenses purchased; installation dates; numbers of usage
licenses; names of the IT systems on which they are installed; and the places where
media are stored
The IP address administrator must prepare an IP address management ledger for IT systems
having global addresses that enable direct connections from off-campus. The IP address
management ledger must also be shared with ITC, which oversees the administration of theledgers. Follow ITC’s instructions for sharing methods.
Hardware names; installation dates; equipment numbers; supervisor, administrator, and usernames; usage purposes; operating systems; IP addresses; places of use; and a list of public
ports
When global IP addresses are used for transmissions not recorded in the IP address
management ledger, ITC and IP address manager may determine that the information
networks are being used illicitly. And ITC will work
alongside the section operations managers and section systems administrators to handle theissue.
Ledgers are to be updated whenever there are changes. The actual number of IT systems in
use and in the ledger must match.

8. Handling Privately Owned PCs
Personnel working for the university must not connect their personal PCs to on-campus
networks or copy confidential UEC data to their personal PCs.
Students can connect their personal PCs to on-campus networks with the permission ofSection Systems Administrators. However, Section Systems Administrators must confirm thefollowing:・ That the PC has sufficiently strong security measures
・ The status of update for the operating system and application software installed, andwhether the virus definition file for antivirus software is up to date. Personal PCs that do
not have the latest updates may not be connected.
・ Whether the PC has peer-to-peer (P2P) file sharing software installed The use ofanonymous P2P file sharing software is prohibited on campus. This type of software can
automatically start up in the background, sharing files without users even realizing it.
Section systems administrators must check this aspect carefully.
It is preferable for students to connect their personal PCs to networks with restricted access;
specifically, to private IP networks or networks with restricted access to ports. Barring a
special reason such as research, these restrictions must apply to access ports for off-campus
communications when connecting personal PCs to Network Address Translation (NAT)
routers to acquire off-campus connectivity.

9. Taking Out, Transporting and Saving Data
Users shall obtain permission from section supervisors for taking out or transporting
notebook PCs used for work and research outside the university.
Notebook PCs intended to be taken out or transported shall have encrypted HDDs using the
OS functions.
Notebook PCs that cannot encrypt the HDD shall be prohibited from being taken out ortransported.
Confidential information containing university affairs, etc., shall be prohibited from beingremoved or transported outside of the university. If such a situation arises, a user shall obtainthe section supervisor’s permission in advance. Strong encryption shall be applied on suchdata. Use the encryption method below. Information that requires integrity shall consider
using digital signatures.
・ Encryption folders that are a feature of operating systems
・ Various kinds of software file and drive encryption
Confidential data must be encrypted and stored in a safe place whether it is saved on or offcampus.
Encryption keys must be saved and transported separately from these kinds of encrypteddata.

10. Using Networks Other Than Campus Networks
Section Operations Managers and ITC must be notified about any intention to use networks
other than campus networks for research use or clerical work, except for the short-term useof mobile telecommunications such as cellular networks and the wide area Wi-Fi.
Any IP Routing must not be allowed over campus networks, even for research purposes.

11. Information Security Incident Responses
When they detect information security incidents, Chief Information Security Officer(hereinafter referred to as “CISO”) and UEC-CSIRT (Computer Security Incident ResponseTeam) take the measures needed to prevent further damage and to ascertain the causes.
・ Blocking communications through relevant IT systems on and off-campus
・ Cutting the connections of relevant IT systems to campus networks
・ Requesting that the administrators of relevant IT systems investigate and respond・ Investigative interviews with the administrators of relevant IT systems
・ First-hand investigations of the relevant IT systems
・ Examination of the relevant IT systems’ storage and other devices

CISO and UEC-CSIRT will take the lead in responding to information security incidents withthe section operations managers and IP address administrator when information security
incidents occur in university IT systems.
11.1 Determining That an Information Security Incident Has Occurred
Confirm that an incident has occurred from log data on IT systems, including Intrusion
Detection Systems, public information, and notifications from off-campus.
11.2 Communication and Initial Responses to Information Security Incidents
Section Operations Managers must notify UEC-CSIRT promptly upon discovering
information security incidents of the IT system in their sections.
Section Systems Administrators must act in accordance with the instruction manual of “Theinformation security incident” which is specified separately in order to prevent further damage.

12. Vulnerability Diagnosis
UEC-CSIRT must conduct regular vulnerability diagnosis of the university’s IT systems,
gathering information about IT system vulnerabilities, and recommend improvements to thesection operations manager and section systems administrator when they discovervulnerable IT systems. Measures similar to those for information security incidents can beundertaken if improvements related to the relevant IT systems’ vulnerabilities are not made.

13. Security Audits
The IT Security Auditor conducts regular internal audits of how Section Operations Managers
run IT systems and maintain their information security. Section Operations Managers must
instruct the section systems administrators to cooperate with internal audits. The outcomesof internal audits are reported to the CISO. The CISO must recommend improvements to IT
system operations and the maintenance of their information security based on those results,
maintaining a high level of information security on UEC’s IT systems.

14. Information Security Training
CIO must create and implement plans for the regular training of faculty and staff in UEC’s
administrative and operations sections (ITC) on the topics of information security andinformation ethics. The administrative and operations sections must prepare teachingmaterials on these topics that UEC personnel can present, and request that training on
information security and information ethics be implemented regularly for individual sections.
The administrative and operations sections (ITC) are also to request that each section
conduct this training for their newly enrolled students. The administrative and operations
sections (ITC) can undertake measures—including halting the use of UEC information
networks—to lock out users who do not attend the information security and information ethics
training each section specifies.