## Migrant Student Information Exchange (MSIX) **Rules of Behavior Rules of Behavior**  **Responsibilities** The Migrant Student Information Exchange (MSIX) is a Department of Education (ED) information sy stem and is to be used for official use only . Users must read, understand, and comply with these Rules of Behavior. Failure to comply with the MSIX Rules of Behavior may result in revocation of yo ur MSIX account privileges, job action, or criminal prosecution. MSIX users must complete a basic securit y awareness train ing course prior to being granted access to the sy stem. The securit y topics addressed in this document provide the required securit y awareness content, so it is important that you read through this entire text. Users must also complete annual security awar eness refresher training. MSIX will prompt y ou to reread the Rules of Behavior annually (or more often due to changes in the s ys tem or regulations) to meet this requirement. **MSIX users are responsible for notifying their MSIX User Administrator when they n o**  **longer require access to MSIX. This may occur when a user gets new responsibilities that do not include a need to access MSIX or when the user gets another job or position.**  

### Monitoring This is a Department of Education computer s ys tem. Sy stem usage may b e monitored, recorded, and subject to audit by

authorized personnel. THERE I S NO RIGHT OF PRI VACY IN THIS SYSTEM. Unauthorized use of this sy stem is prohibited and subject to criminal and civil penalties. Sy stem personnel may

provide to law enforcement off icials an y potential evidence of crime found on Department of Education computer s ys tems. USE OF THIS SYSTEM BY ANY USER, AUTHORIZED OR UNAUTHORIZED, CONSTI TUTES CONSENT TO THIS MONITORING, RECORDI NG, and AUDIT. 

### MSIX Security ControlsMSIX securit y contro ls have been implemented to protect the information processed and stored

within the sy stem. MSIX users are an integral part in ensuring the MSIX security controls provide the intended level of protection. It is important to understand these securit y contro ls, especiall y those with which you directl y interface. The sections below provide detail on some of those controls and the expectations for MSIX users. MSIX securit y controls are designed to:

 Ensure onl y authorized users have access to the s ystem;  Ensure users are uniquely identified when using the sy stem;  Tie actions taken within the sy stem to a specific user;  Ensure users onl y have access to perform the actions required b y their position;  Ensure MSIX information is not inappropriately released; and  Ensur e MSIX is available to users when needed. Examples of security

controls deploy ed within MSIX include:

 Automated Session Timeout

– Users are automatically logged out of MSIX after thirt y minutes of inactivity . This helps ensure unauthorized users do not gai n access to the sy stem.  Role - Based Access Control

– User ids are assigned a specific role within MSI X. This role corresponds to the user's job function and restricts access to certain MSIX capabilities.  Audit L ogging

– Actions taken within MSI X are captured in log files to help identify unauthorized access and enforce accountability within the sy stem.  In cident Response

– If a user suspects their user id has been subject to unauthorized use, contact the MSIX help desk immediately .  Communication Protection

– Traf fic between a user's web browser and the MSIX servers is encry pted to protect it during transmission. The sections below describe several other security controls in place within MSIX. It is important that y ou understand and comply with these controls to en sure the MSIX security is maintained. 

### User Credentials User credentials are the mechanism by which MSIX identifies and verifies users. These are your user id and password. User ids uniquely identify each MSIX user and allow the MSI X S ys tem Administrators to attribute actions taken within the sy stem to a specific user. This tracking is important in enforcing accountability within the system. Passwords are used by MSIX to verify

a user’s identity . I t is important for y ou to compl y with the following rules go verning user credentials:

 Protect y our logon credentials at all times.  Never share your user id and/or password with anyone else. You are responsible for all actions taken with your user credentials. Your passwords must: o Be changed upon initial login to MS IX; o Contain at least eight (8) characters; o Contain a mix of letters (upper and lower case), numbers, and special characters (#, @, etc.); o Be changed at least every ninety (90) day s; and o Not reuse your previous six (6) passwords.  Do not write your password down or keep it in an area where it can be easily discovered.  Avoid using the “remember password” feature.  User accounts are disabled after three (3) consecutive invalid attempts are made to supply a password.  Reinstatement of a disabled user account can o nl y be reinstated b y a Help Desk technician or a s ys tem administrator. 

### Protection of MSIX Information You are required to protect MSIX information in any form. This includes information contained on printed reports, data downloaded onto computers and comp uter media (e.g. diskettes, tapes, compact discs, thumb drives, etc.), or an y other format. In order to ensure protection of MSIX information, y ou should observe the following rules:

 Lo g out of MSIX if you are going to be away from y our computer for longer than fifteen minutes.  Lo g out of MSIX or lock y our computer before yo u leave it unattended b y using the < Ctrl > < Alt > < Delete > key sequence when leaving y our seat.  Media (including reports) containing MSIX information should be removed from y our desktops during non - business hours.  Store media containing MSIX information in a locked container (e.g. desk drawer) during non - business hours.  Store digital information in an encry pted format where technicall y possible.  Media containing MSIX information shoul d be properly cleansed or destroy ed. o Shred paper media and compact discs prior to disposal. o Diskettes and other magnetic media should be cleansed using appropriate software or a magnetic field with sufficient strength so as to make the information unreadab le.  Note that simply

deleting files from magnetic media does not remove the information from the media.  Media containing encry pted information can be excluded from the cleansing process, although it is recommended.  If the access which you have been granted within MSIX is more than required to fulfill yo ur job duties, it should be reported to appropriate personnel.  Do not disclose MSI X information to any individual without a "need - to - know" for the information in the course of their business.

### Other Security **Considerations**

This section describes some additional securit y items of which you should be aware.

 In cident Response - If yo u suspect or detect a security violation in MSIX, contact the MSIX Help Desk immediately . For example, if y ou suspect someone may have used your user id to log in to MSIX, y ou should contact the MSIX Help Desk. Other warning signs that MSIX may

have been compromised include, but are not limited to: inappropriate images or text on the web pages, data formats that are not what is expecte d, missing data, or MSIX is not available. While these may not be attributed to a compromise, it is better to have it checked out and be sure than to take no action.  Shoulder Surfing - Shoulder surfing is using direct observation techniques, such as lookin g over someone's shoulder, to get information. An example of shoulder surfing is when a person looks over someone else's shoulder while they are entering a password for a sy stem to covertl y acquire that password. To protect against this type of attack, slo uch over your keyboard slightly when keying in y our password to block the view of a possible onlooker.  Social Engineering - Social engineering is a collection of techniques used to manipulate people into performing actions or divulging confidential information. For example, a ty pical social engineering attack scenario is a hacker posing as an authorized user calling a sy stem help desk posing as that user. The hacker, through trickery , coercion, or simply being nice coaxes the help desk technician into provi ding the login credentials for the user he is claiming to be. The hacker then gains unauthorized access to the sy stem using an authorized user's credentials. The example above is one example of a social engineering technique. Another is when a hacker call s a user at random and pretends to be a help desk technician. Under the guise of purportedl y fixing a problem, the hacker requests the user's login credentials. I f provided, the user has unwittingly provided s ys tem access to an unauthorized person. To defe at social engineering simply question an yt hing that doesn't make sense to y ou. For example, a help desk technician should never ask a user for their login credentials to resolve a problem. If you receive a call from someone and you are not sure who they ar e, ask for a callback number. Hang up the phone and call back to the number provided. Hackers will ty

pically provide a bogus number. Ask questions. I f the answers y ou receive do not make sense, end the call and report the incident to y our local security or ganization.

 Faxing - When faxing MSIX information, call the recipient of the fax and let them know it is coming. Ask them to go to the fax machine so they can pull it off right away so an y sensitive information is not left ly ing around the office.  Virus Sc anning - Scan documents or files downloaded to y our computer from the Internet for viruses and other malicious code. Virus scanning software should also be used on email attachments.