INFORMATION SECURITY
POLICIES
Supplementary Document of Kuwait University Information Security Policy Statements.
Audience
The intended audience for this document includes the following categories of individuals:
System managers, executives, and information officers making decisions about initiatives.
Security professionals, including security officers, security administrators, auditors, and others with responsibility for information technology security.
Information technology program managers.
System and network administrators.
Users of public computing services.
Privacy Policy Statement
This privacy policy has been compiled to better serve those who are concerned with how their 'Personally identifiable information' (PII) is being used online. PII is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. Please read our privacy policy carefully to get a clear understanding of how we collect, use, protect or otherwise handle your Personally Identifiable Information in accordance with our website.
When registering on our site, as appropriate, you may be asked to enter your name, email address, mailing address, phone number or other details to help you with your experience.
We collect information from you when you register on our site, fill out a form or enter information on our site.
We may use the information we collect from you when you register sign up for our newsletter, respond to a survey, surf the website, or use certain other site features in the following ways:
To personalize user's experience and to allow us to deliver the type of content and product offerings in which you are most interested.
To improve our website in order to better serve you
operating our website, conducting our business, or servicing you, so long as those parties agree to keep this information confidential. We may also release your information when we believe release is appropriate to comply with the law, enforce our site policies, or protect ours or others' rights, property, or safety.
Occasionally, at our discretion, we may include or offer third party services on our website. These third party sites have separate and independent privacy policies. We therefore have no responsibility or liability for the content and activities of these linked sites. Nonetheless, we seek to protect the integrity of our site and welcome any feedback about these sites.
We have not enabled Google AdSense on our site but we may do so in the future.
The Fair Information Practices Principles form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect personal information.
We will notify the users via in site notification within an appropriate period, whilst we undergo the suitable security measurements.
We also agree to the individual redress principle, which requires that individuals have a right to pursue legally enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or a government agency to investigate and/or prosecute non-compliance by data processors.
If there are any questions regarding this privacy policy you may contact us using the information below.
Security Policies:
Information Systems Terms of Use
Purpose
KUWAIT UNIVERSITY considers its information resources (i.e. information maintained in electronic form and systems that process, store or transmit such information) as assets
This policy documents the responsibilities of the users of Kuwait University’s information resources. Compliance with this policy is essential in creating an environment that is conductive to sound security practices.
Scope
This policy applies to all users of information assets at KUWAIT UNIVERSITY regardless of geographic location.
This Policy covers all Information Systems (IS) environments operated by KUWAIT UNIVERSITY or contracted with a third party by KUWAIT UNIVERSITY. The term “IS environment” defines the total environment and includes, but is not limited to, all documentation, physical and logical controls, personnel, hardware (e.g. mainframe, distributed, desktop, network devices, and wireless devices), software, and information
Although this policy explicitly covers the responsibilities of users, it does not cover the matter exclusively. Other KUWAIT UNIVERSITY Information Security policies, standards and procedures define additional responsibilities. All users are required to read, understand and comply with this Information Security policy. If any user requires further clarifications on this policy, he/she should contact their line manager, IS HELPDESK, or the MANAGER INFORMATION SECURITY.
Manager Information Security and the concerned department/division units shall jointly resolve any conflicts arising from this policy.
Responsibilities
The Manager Information Security is responsible for maintenance and accuracy of the policy. Any questions regarding this policy should be directed to Manager Information Security
Custodians responsible for implementing this policy are listed in Section 1.9
Definitions
Definition of some of the common terms:
Basic Assumptions
(None)
Policy Statements
Please read these Terms of Use ("Terms") carefully before accessing or participating in any chat room, newsgroup, bulletin board, mailing list, website, transaction or other on-line forum available at kuniv.edu or other Kuwait University sites. By using and participating in these sites, you signify that you have read these terms and agree to be bound by and comply with them. If you do not agree to be bound by these terms, please promptly exit all sites. Kuwait University reserves the right to modify these terms at any time and will publish notice of any such modifications on-line at this site or elsewhere on-line. By continuing to access a site after notice of such modifications has been published, you signify your agreement to be bound by them.
Disclaimer
Sites may include immoderate forums containing the personal opinions and other expressions of the people who post entries on a wide range of topics. Neither the content of these Sites, nor the links to other web sites, are screened, approved, reviewed or endorsed by Kuwait University. The text and other material on these Sites are the opinion of the specific author and are not statements of advice, opinion, or information of Kuwait University. If you feel you might be offended by the content of the Sites, you should not continue.
Rules for Online Conduct
You agree to use the Sites in accordance with all applicable laws. Because Kuwait University is a non-profit organization, you agree that you will not use the Site for organized partisan political activities. You further agree that you will not e-mail or post any of the following content anywhere on the Site, or on any other Kuwait University computing resources:
Content that defames or threatens others
Harassing statements or content that violates federal or state law
Content that discusses illegal activities with the intent to commit them
Content that infringes another's intellectual property, including, but not limited to, copyrights, trademarks or trade secrets
Material that contains obscene (i.e. pornographic) language or images
Advertising or any form of commercial solicitation
Content that is otherwise illegal
Copyrighted material, including without limitation software, graphics, text, photographs, sound, video and musical recordings, may not be placed on the Site without the express permission of the owner of the copyright in the material, or other legal entitlement to use the material.
Kuwait University students using this Site are expected to abide by the Fundamental Standard which has set the standard of conduct for students at Kuwait University since 1966 and which provides:
"Subject.7: Students in relation to the university should respect university standard systems; furthermore he shall build his relations with the university family upon kindness and respect to others rights."
“Subject.8: It is strictly prohibited to insult University members; should they be students, employees, or faculty; may that be on a personal level or referring to their dignity”
Although Kuwait University does not routinely, screen or monitor content posted by users to the Site, Kuwait University reserves the right to remove content, which violates the above rules of which it becomes aware, but is under no obligation to do so. Finally, you agree that you will not access or attempt to access any other user's account, or misrepresent or attempt to misrepresent your identity while using the Sites.
Permission to Use Materials
In consideration for your agreement to the terms and conditions contained here, Kuwait University grants you a personal, non-exclusive, non-transferable license to access and use the Sites. User may download material from the Sites only for User's own personal, non-commercial use. User may not otherwise copy, reproduce, retransmit, distribute, publish, commercially exploit or otherwise transfer any material. The burden of determining that use of any information, software or any other content on the Site is permissible rests with User.
Limitation of Use
You may use sites for legal purposes only. Furthermore, you agree that, if a third party claims that any material you have contributed to a site is unlawful, you will bear the burden of establishing that the material complies with all applicable laws. Although Kuwait University does not monitor the content of the sites, Kuwait University has the right to remove material from the sites, block access, or take other action with respect to the Material in its sole discretion, although Kuwait University is under no obligation to do so. You may not use Kuwait University computing resources or sites to disseminate unsolicited advertising or promotional material of any kind.
Links to Other Sites
Kuwait University’s Site may include hyperlinks to websites maintained or controlled by others. Kuwait University is not responsible for and does not routinely screen, approve, review or endorse the contents of or use of any of the products or services that may be offered at these websites.
Choice of Law/Forum Selection
Sites are hosted by Kuwait University on computing resources located on Kuwait University campus or elsewhere. You agree that any dispute arising out of or relating to these Terms or any content posted to a Site, including copies and republication thereof, whether based in contract, tort, statutory or other law, will be governed by the laws of the State of Kuwait.
Disclaimer of Warranty/Limitation of Liability
THESE SITES AND ANY INFORMATION, PRODUCTS OR SERVICES THEREIN ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR USE OF A PARTICULAR PURPOSE, OR NONINFRINGEMENT.
Kuwait University does not warrant, and hereby disclaims any warranties, either express or implied, with respect to the accuracy, adequacy or completeness of any Site, information obtained from a Site, or link to a Site. Kuwait University does not warrant that Sites will operate in an uninterrupted or error-free manner or that Sites are free of viruses or other harmful components. Use of information obtained from or through these Sites is at your own risk.
YOU AGREE THAT KUWAIT UNIVERSITY WILL NOT BE LIABLE TO YOU FOR ANY LOSS OR DAMAGES, EITHER ACTUAL OR CONSEQUENTIAL, ARISING OUT OF OR RELATING TO THESE TERMS, OR TO YOUR (OR ANY THIRD PARTY'S) USE OR INABILITY TO USE A SITE, OR TO YOUR PLACEMENT OF CONTENT ON A SITE, OR TO YOUR RELIANCE UPON INFORMATION OBTAINED FROM OR THROUGH A SITE. IN PARTICULAR, KUWAIT UNIVERSITY WILL HAVE NO LIABILTY FOR ANY CONSEQUENTIAL, INDIRECT, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES, WHETHER FORESEEABLE OR UNFORESEEABLE, (INCLUDING, BUT NOT LIMITED TO, CLAIMS FOR ERRORS, LOSS OF DATA, OR INTERRUPTION IN AVAILABILITY OF DATA), ARISING OUT OF OR RELATING TO THESE TERMS, YOUR USE OR INABILITY TO USE A SITE, OR ANY PURCHASES ON THIS SITE, OR YOUR PLACEMENT OF CONTENT ON A SITE, OR TO YOUR RELIANCE UPON INFORMATION OBTAINED FROM OR THROUGH A SITE, WHETHER BASED IN CONTRACT, TORT, STATUTORY OR OTHER LAW, EXCEPT ONLY IN THE CASE OF DEATH OR PERSONAL INJURY WHERE AND ONLY TO THE EXTENT THAT APPLICABLE LAW REQUIRES SUCH LIABILITY.
Kuwait University makes no representation regarding your ability to transmit and receive information from or through the Sites and you agree and acknowledge that your ability to access the Sites may be impaired. Kuwait University disclaims any liability resulting from or related to such events.
Trademarks
The logo, name and all graphics on the Sites of Kuwait University, or any of its affiliates, are trademarks of Kuwait University or its affiliates. Use, reproduction, copying or redistribution of trademarks, without the written permission of Kuwait University or its affiliates is prohibited. All other trademarks or service marks appearing on the Site are the marks of their respective owners.
Indemnification
You agree to indemnify and hold Kuwait University harmless from any claims, losses or damages, including legal fees, resulting from your violation of these Terms, your use of a Site or your placement of any content onto a Site, and to fully cooperate in Kuwait University's defense against any such claims.
Your Account
If you use this site, you are responsible for maintaining the confidentiality of your account and password, if any, and for restricting access to your computer, and you agree to accept responsibility for all activities that occur under your account or password.
Other
The Sites may contain errors and omissions relating to product description, pricing and availability. We reserve the right to correct errors or omissions without prior notice. We also reserve the right to cancel any offered product or service in the event of an error or omission in the description, including price, unavailability or other reason.
General
These Terms constitute the entire agreement between you and Kuwait University and its affiliates with respect to the subject matter herein and supersedes any prior or contemporaneous oral or written agreements.
Acceptable Usage
Unauthorized access to network, telecommunications, or computer systems;
The apparent presence of a virus on a PC;
The apparent presence of any information resource prohibited by this policy;
Apparent tampering with any file for which the user established restrictive discretionary access controls; and
Violation of this policy or any other Information security policy or procedure by another user, employee, contractor or third party service provider
Related Information Security Policies
Corporate Security Policy
Internet & E-Mail Security Policy
Virus & Malware Protection Policy
Password Policy
Access Control Policy
Compliance Measurement
Compliance with Information Systems Terms of Use is mandatory. KUWAIT UNIVERSITY managers must ensure continuous compliance monitoring within their organization.
Compliance with Information Systems Acceptable use Policy will be matter for periodic review by Audit Division as per the audit guidelines and procedures.
Compliance measurement should also include periodic review for Security Quality Assurance.
Violations of the policies, standards and procedures of KUWAIT UNIVERSITY will result in corrective action by management. Disciplinary action will be consistent with the severity of the incident, as determined by an investigation, and may include, but not limited to:
Verbal or written warning
Other actions as deemed appropriate by management, Human Resources, and the Legal Department.
Custodians
Policy Reference | Custodian |
6.1 | All Users / Managers Information Security / IT |
6.2 | All Users / Managers Information Security / IT |
Internet & E-Mail Security Policy
Purpose
The purpose of the policy is to minimize risk associated with Internet and services, and defines controls against the threats of unauthorized access, theft of information, theft of services, and malicious disruption of services.
Scope
This policy applies to all users of information assets at KUWAIT UNIVERSITY regardless of geographic location.
This Policy covers all Information Systems (IS) environments operated by KUWAIT UNIVERSITY or contracted with a third party by KUWAIT UNIVERSITY. The term “IS environment” defines the total environment and includes, but is not limited to, all documentation, physical and logical controls, personnel, hardware (e.g. mainframe, distributed, desktop, network devices, and wireless devices), software, and information
Although this policy explicitly covers the responsibilities of users, it does not cover the matter exclusively. Other KUWAIT UNIVERSITY Information Security policies, standards and procedures define additional responsibilities. All users are required to read, understand and comply with this Information Security policy. If any user requires further clarifications on this policy, he/she should contact the line manager, IS HELPDESK, or the MANAGER INFORMATION SECURITY.
Manager Information Security and the concerned department/division units shall jointly resolve any conflicts arising from this policy.
Responsibilities
The Manager Information Security is responsible for maintenance and accuracy of the policy. Any questions regarding this policy should be directed to Manager Information Security
Custodians responsible for implementing this policy are listed in Section 9
Definitions
Definition of some of the common terms:
Basic Assumptions
(None)
Policy Statements
Internet Security Policies
There is no quality control process on the Internet, and a considerable amount of its information is outdated or inaccurate. Unless tools and solutions like Privacy Enhanced Mail (PEM), Pretty Good Privacy (PGP), and Public Key Infrastructures (PKI - certificate authority based solutions) are used, it is also relatively easy to spoof another user on the Internet.
Information Protection
Unauthorized access to network, telecommunications, or computer systems;
Apparent transmittal of a virus or worm via networking technologies; and
Apparent tampering with any file for which the user established restrictive discretionary access controls.
Internet Usage
Internet Networking Services
General E-Mail Policy
E-Mail should be used in compliance with the Corporate Security Policy and associated Supplementary Information Security Policies. All access to electronic messages should be limited to properly authorized personnel.
Personal or non-business use of the Systems is NOT permitted.
KUWAIT UNIVERSITY information resources should not be used to transmit or receive statements that contain any material that is offensive, defamatory, or threatening to others.
The Systems should not be used to communicate statements, messages, or images consisting of pornographic material, ethnic slurs, racial epithets, or anything that may be construed as harassing, offensive, or insulting to others based on race, religion, national origin, color, marital status, citizenship status, age, disability, or physical appearance.
Any statements or comments made via E-Mail that could in any way be considered as an action of KUWAIT UNIVERSITY should bear a disclaimer such as “These statements are solely my own opinion, and do not necessarily reflect the views of my employer.” Even with this disclaimer, all practices regarding decency and appropriate conduct still apply.
To monitor performance,
Ensure compliance with KUWAIT UNIVERSITY policies,
Prevent misuse of the Systems,
Troubleshoot hardware and software problems,
Comply with legal and regulatory requests for information, and
Investigate disclosure of confidential business, proprietary information, or conduct that may be illegal or adversely affect KUWAIT UNIVERSITY or its associates.
KUWAIT UNIVERSITY may also gain access to communications deleted from the Systems.
Description
A feature of E-Mail is the ability to send and receive attachments. However, sending large attachments causes mail servers and gateways to external services (such as the Internet) to run slower and can cause significant delay in the delivery of E-Mail. To prevent the degradation of KUWAIT UNIVERSITY’s E-Mail systems, employees should limit the transmission of large attachments.
Firewall Configuration
All non-essential networking or system services must be eliminated or removed from the firewall.
The system logs generated from the firewall must be reviewed on a continuing basis to detect any unauthorized entry attempts.
All unauthorized access through the firewall must be reported to the security manager and network administrator.
Proxy accounts must be used on the firewall at all times.
Networking traffic will be subject to filtering based on current security requirements.
Legal
World Wide Web Policy (WWW)
Access level security
Secure hardening of operating systems
Load balancing and high availability
Secure network architecture (Perimeter security, Firewall, IPS, DMZ, etc.)
Associated application and database security
Proprietary Information
Related Information Security Policies
Corporate Security Policy
Password Policy
Access Control Policy
Compliance Policy
Compliance Measurements
Compliance Internet & email Security policy is mandatory. KUWAIT UNIVERSITY managers must ensure continuous compliance monitoring within their organization.
Compliance with Internet & email Security policy will be matter for periodic review by Audit Division as per the audit guidelines and procedures.
Compliance measurement should also include periodic review for Security Quality Assurance.
Violations of the policies, standards and procedures of KUWAIT UNIVERSITY will result in corrective action by management. Disciplinary action will be consistent with the severity of the incident, as determined by an investigation, and may include, but not limited to:
Verbal or written warning
Other actions as deemed appropriate by management, Human Resources, and the Legal Department.
Custodians
Policy Reference | Custodian |
6.1 | All Users / Manager Information Security / IT |
6.2 | All Users / Manager Information Security / IT |
6.3 | All Users / Manager Information Security / IT |
6.4 | All Users / Manager Information Security / IT |
6.5 | All Users / Manager Information Security / IT |
6.6 | All Users / Manager Information Security / IT |
6.7 | All Users / Manager Information Security / IT |
6.8 | All Users / Manager Information Security / IT |
6.9 | All Users / Manager Information Security / IT |
Virus and Malware Protection Policy
Purpose
Viruses and Malicious Software (Malware) are a potential risk to the confidentiality, integrity and availability of Kuwait University’s Information Systems.
This document relates Kuwait University’s policy for the prevention, detection and removal of Viruses and Malware.
Scope
This policy applies to all users of information assets at KUWAIT UNIVERSITY regardless of geographic location.
This Policy covers all Information Systems (IS) environments operated by KUWAIT UNIVERSITY or contracted with a third party by KUWAIT UNIVERSITY. The term “IS environment” defines the total environment and includes, but is not limited to, all documentation, physical and logical controls, personnel, hardware (e.g. mainframe, distributed, desktop, network devices, and wireless devices), software, and information
Although this policy explicitly covers the responsibilities of users, it does not cover the matter exclusively. Other KUWAIT UNIVERSITY Information Security policies, standards and procedures define additional responsibilities. All users are required to read, understand and comply with this Information Security policy. If any user requires further clarifications on this policy, he/she should contact the line manager, IS HELPDESK, or the MANAGER INFORMATION SECURITY.
Manager Information Security and the concerned department/division units shall jointly resolve any conflicts arising from this policy.
Responsibilities
The Manager Information Security is responsible for maintenance and accuracy of the policy. Any questions regarding this policy should be directed to Manager Information Security
Custodians responsible for implementing this policy are listed in Section 3.9
Definitions
Definition of some of the common terms:
Basic Assumptions
(None)
Policy Statements
The objective of this policy is to protect the integrity of software and information. Precautions are required to prevent and detect the introduction of malicious software. Software and information processing facilities are vulnerable to the introduction of malicious software, such as computer viruses, network worms, Trojan horses and logic bombs. Users should be made aware of the dangers of unauthorized or malicious software, and managers should, where appropriate, introduce special controls to detect or prevent its introduction. In particular, it is essential that precautions be taken to detect and prevent computer viruses on personal computers.
Viruses and Malware are unauthorized programs that may replicate themselves and spread to other computer systems across a network. The symptoms of Virus infection include considerably slower response time, inexplicable loss of files, changed modification dates for files, increased file sizes, and total failure of a computer system.
Virus & Malware Protection Policy
Virus and Malware detection infrastructure shall be implemented at points where Viruses and Malware can be introduced into Kuwait University’s network.
Kuwait University’s process to update the Virus and Malware detection infrastructure with the latest product and Virus signature updates as soon as these updates are released must be implemented.
The installation of Virus and Malware protection software on any new potential point of entry (new PC’s, servers, etc.) of Viruses or Malware or to determine that the new (potential) point of entry is covered by an existing installation of such software must be in accordance with the defined procedures.
Kuwait University’s process to ensure that Virus and Malware detection infrastructure remains active and is not disabled at any potential entry point must be implemented.
Configuration should be such that, the anti-virus updates can be installed automatically on the computers with little or no user intervention
Educating all users on symptoms and best practices.
Anti virus must automatically check removable media like CD, USB drives when attached to and KUWAIT UNIVERSITY system / network.
restricting the use of mobile code from undesirable sources, such as by producing a ‘white list’ of code only allowed from specified web sites
preventing the downloading of specific types of mobile code with known vulnerabilities, such as ActiveX controls
using cryptographic techniques, such as code signing, to confirm that downloaded mobile code comes from a recognized source and has not been tampered with
Screening mobile code in quarantine areas, for example, using a ‘sandbox’, prior to use.
Implementation of memory resident components of Virus and Malware detection infrastructure in PC’s, servers, laptop computers and other appropriate components of Kuwait University’s information systems infrastructure.
Anti-Virus software scans must be performed on all PC’s, servers, laptop computers and other components of Kuwait University’s information systems architecture at periodic intervals to detect potential Viruses and Malware.
Kuwait University’s process must be implemented to update the Virus and Malware detection infrastructure with the latest product and Virus signature updates as soon as these updates are released.
Kuwait University’s process must be implemented to install Virus and Malware protection software on any new components (new PC’s, servers, etc.) of the network or to determine that the new (potential) point of entry is covered by an existing installation of such software.
The steps /decisions to be taken in the event of the entry of a Virus into Kuwait University’s information systems infrastructure must be in accordance with the Incident response procedures
The infected system must be immediately isolated (through notice or by force; as the security requirements demand) from the network infrastructure and handled in accordance with the Virus and Malware Contingency Plan.
The Virus must be removed using appropriate anti-Virus software.
Virus scans of all components of the Information Systems infrastructure must be conducted to detect any further cases of infection.
The Desktop support team (helpdesk) must investigate the path used by the Virus to enter the network and appropriate prevention measures must be implemented to prevent recurrence.
Related Information Security Policies
Corporate Security Policy
Internet & E-Mail Security Policy
Information Systems Terms of Use
Compliance Policy
Compliance Measurement
Compliance with Virus and Malware policy is mandatory. KUWAIT UNIVERSITY managers must ensure continuous compliance monitoring within their organization.
Compliance with Virus and Malware Policy will be matter for periodic review by Audit Division as per the audit guidelines and procedures.
Compliance measurement should also include periodic review for Security Quality Assurance.
Violations of the policies, standards and procedures of KUWAIT UNIVERSITY will result in corrective action by management. Disciplinary action will be consistent with the severity of the incident, as determined by an investigation, and may include, but not limited to:
Verbal or written warning
Other actions as deemed appropriate by management, Human Resources, and the Legal Department.
Custodians
Policy Reference | Custodian |
6.1 | All Users / Manager Information Security |
Password Policy
Purpose
The purpose of this policy is to establish a standard for creation of strong passwords, the protection of those passwords, and the frequency of change
This policy applies to all users of information assets at KUWAIT UNIVERSITY regardless of geographic location.
This Policy covers all Information Systems (IS) environments operated by KUWAIT UNIVERSITY or contracted with a third party by KUWAIT UNIVERSITY. The term “IS environment” defines the total environment and includes, but is not limited to, all documentation, physical and logical controls, personnel, hardware (e.g. mainframe, distributed, desktop, network devices, and wireless devices), software, and information
Although this policy explicitly covers the responsibilities of users, it does not cover the matter exclusively. Other KUWAIT UNIVERSITY Information Security policies, standards and procedures define additional responsibilities. All users are required to read, understand and comply with this Information Security policy. If any user requires further clarifications on this policy, he/she should contact the line manager, IS HELPDESK, or the MANAGER INFORMATION SECURITY.
Manager Information Security and the concerned department/division units shall jointly resolve any conflicts arising from this policy.
Responsibilities
The Manager Information Security is responsible for maintenance and accuracy of the policy. Any questions regarding this policy should be directed to Manager Information Security
Custodians responsible for implementing this policy are listed in Section 4.8
Definitions
Definition of some of the common terms:
Basic Assumptions
(None)
Policy Statements
Passwords are an important aspect of computer security. They are the front line of protection for user accounts. A poorly chosen password may result in the compromise of KUWAIT UNIVERSITY's entire corporate network. As such, all users of KUWAIT UNIVERSITY’s information systems (including employees, contractors and vendors with access to KUWAIT UNIVERSITY systems) are responsible for taking the appropriate steps, as outlined below, to select and secure their passwords.
Password Policy
Description
For example, select different passwords for different information systems or operating systems.
User-level passwords must be at least 8 characters, while system-level passwords must be at least 12 alphanumeric characters long.
System-level passwords must contain both upper and lower case characters (e.g., a-z, A-Z)
Passwords must not be a dictionary word in any language, slang, dialect, jargon, etc.
Passwords must not be based on personal information, names of family, date of births, etc.
Passwords must NOT be the same as the username.
Passwords must never be written down or stored on-line. As far as possible, they should be easy to remember. For this purpose pass-phrase based passwords may be used.
Description
For example, the phrase might be: "This May Be One Way To Remember" and the password could be: "TmB1w2R!" or "Tmb1W>r~" or some other variation. (NOTE: Do not use either of these examples as passwords!)
Passwords must not be revealed on any questionnaires or security forms.
Passwords must not be revealed to family members or co-workers.
Related Information Security Policies
Corporate Security Policy
Access Control
Compliance Policy
Compliance Measurement
Compliance with password policy is mandatory. KUWAIT UNIVERSITY managers must ensure continuous compliance monitoring within their organization.
Compliance Password Policy will be matter for periodic review by Audit Division as per the audit guidelines and procedures.
Compliance measurement should also include periodic review for Security Quality Assurance.
Violations of the policies, standards and procedures of KUWAIT UNIVERSITY will result in corrective action by management. Disciplinary action will be consistent with the severity of the incident, as determined by an investigation, and may include, but not limited to:
Verbal or written warning
Other actions as deemed appropriate by management, Human Resources, and the Legal Department.
Custodians
Policy Reference | Custodian |
6.1 | Manager Information Security / System and Network Administrators / All Users |
Wireless Communication Policy
Purpose
This document sets out Kuwait University’s policy towards Wireless Communications
Scope
This policy applies to all users of information assets at KUWAIT UNIVERSITY regardless of geographic location.
This policy covers all wireless data communication devices (e.g., personal computers, cellular phones, PDAs, etc.) connected to any of Kuwait University's internal networks. This includes any form of wireless communication device capable of transmitting packet data. Wireless devices and/or networks without any connectivity to Kuwait University’s networks do not fall under the purview of this policy.
Although this policy explicitly covers the responsibilities of users, it does not cover the matter exclusively. Other KUWAIT UNIVERSITY Information Security policies, standards and procedures define additional responsibilities. All users are required to read, understand and comply with this Information Security policy. If any user requires further clarifications on this policy, he/she should contact the line manager, IS HELPDESK, or the MANAGER INFORMATION SECURITY.
Manager Information Security and the concerned department/division units shall jointly resolve any conflicts arising from this policy.
Responsibilities
The Manager Information Security is responsible for maintenance and accuracy of the policy. Any questions regarding this policy should be directed to Manager Information Security
Custodians responsible for implementing this policy are listed in Section 9
Definitions
Definition of some of the common terms:
Basic Assumptions
(None)
Policy Statements
All wireless Access Points / Base Stations connected to the corporate network must be registered and approved by InfoSec. These Access Points / Base Stations are subject to periodic penetration tests and audits. All wireless Network Interface Cards (i.e., PC cards) used in corporate laptop or desktop computers must be registered with InfoSec
All wireless LAN access must use corporate-approved vendor products and security configurations.
All computers with wireless LAN devices must utilize a corporate-approved Virtual Private Network (VPN) configured to drop all unauthenticated and unencrypted traffic. To comply with this policy, wireless implementations must maintain point to point hardware encryption of at least 56 bits. All implementations must support a hardware address that can be registered and tracked, i.e., a MAC address. All implementations must support and employ strong user authentication which checks against an external database such as TACACS+, RADIUS or something similar.
The SSID shall be configured so that it does not contain any identifying information about the organization, such as the company name, division title, employee name, or product identifier.
Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
Related Information Security Policies
Corporate Security Policy
Internet & E-Mail Security Policy
Asset Management Policy
Access Control Policy
Compliance Measurement
Compliance with Information Communication, labeling and handling policy is mandatory. KUWAIT UNIVERSITY managers must ensure continuous compliance monitoring within their organization.
Compliance with Information Communication, labeling and handling policy will be matter for periodic review by Audit Division as per the audit guidelines and procedures.
Compliance measurement should also include periodic review for Security Quality Assurance.
Violations of the policies, standards and procedures of KUWAIT UNIVERSITY will result in corrective action by management. Disciplinary action will be consistent with the severity of the incident, as determined by an investigation, and may include, but not limited to:
Verbal or written warning
Other actions as deemed appropriate by management, Human Resources, and the Legal Department.
Custodians
Policy Reference | Custodian |
6.1 | All Users / MANAGER INFORMATION SECURITY / IT DEPT. |
Information Communication, Labeling, and Handling Policy
Purpose
This document sets out Kuwait University’s policy towards information communication, labeling and handling of its information assets
Scope
This policy applies to all users of information assets at KUWAIT UNIVERSITY regardless of geographic location.
This Policy covers all Information Systems (IS) environments operated by KUWAIT UNIVERSITY or contracted with a third party by KUWAIT UNIVERSITY. The term “IS environment” defines the total environment and includes, but is not limited to, all documentation, physical and logical controls, personnel, hardware (e.g. mainframe, distributed, desktop, network devices, and wireless devices), software, and information
Although this policy explicitly covers the responsibilities of users, it does not cover the matter exclusively. Other KUWAIT UNIVERSITY Information Security policies, standards and procedures define additional responsibilities. All users are required to read, understand and comply with this Information Security policy. If any user requires further clarifications on this policy, he/she should contact the line manager, IS HELPDESK, or the MANAGER INFORMATION SECURITY.
Manager Information Security and the concerned department/division units shall jointly resolve any conflicts arising from this policy.
Responsibilities
The Manager Information Security is responsible for maintenance and accuracy of the policy. Any questions regarding this policy should be directed to Manager Information Security
Custodians responsible for implementing this policy are listed in Section 6.9
Definitions
Definition of some of the common terms:
Basic Assumptions
(None)
Policy Statements
Information Labeling
Description
Labeling systems should not be overcomplicated to ensure that the overhead does not outweigh the value of the items being protected.
Information Handling
The Information Handling Procedures would identify controls over the storage and handling of information that will be consistent with the classification label assigned to the information (in accordance with the Asset Classification and Control Policy and associated procedures).
Description
Media containing sensitive information should be disposed of securely and should be logged. All media items should be collected and disposed together. Adequate controls should be ensured while outsourcing disposal of media. The disposal procedures must cover all media including hardcopy materials, carbon paper, one-time-use printer or fax ribbons, magnetic tapes, removable disks or cassettes, etc.
Description
Some methods of secure disposal of media are described below:
Physically destroying the drive, rendering it unusable.
Degaussing the drive to randomize the magnetic domains - most likely rendering the drive unusable in the process.
Overwriting the drive’s data so that it cannot be recovered.
Description
Some methods are as follows:
Using single opaque envelope that indicates the classification.
Receipt at discretion of originator either passed by hand between people who have the ‘need to know’ or placed in locked container and delivered direct, by hand or by an authorized messenger.
Description
Guidelines should be developed and implemented to promote Kuwait University’s clear desk policy. These could include the following: -
Paper and computer media should be stored in suitable locked cabinets and/or other forms of security furniture when not in use, especially outside working hours.
Sensitive or critical business information should be locked away (ideally in a fire-resistant safe or cabinet) when not required, especially when the office is vacated.
Personal computers and computer terminals and printers are not to be left logged on when unattended and should be protected by password protected screen savers.
Sensitive or classified information, when printed, is to be cleared from printers immediately.
Information Transmission / Communication Handling
To prevent loss, modification, destruction, or misuse of information, KUWAIT UNIVERSITY departments should protect and control exchange of critical business information assets and software.
Portable Computer and Work-at-Home Situations
Related Information Security Policies
Corporate Security Policy
Internet & E-Mail Security Policy
Asset Management Policy
Access Control Policy
Compliance Measurement
Compliance with Information Communication, labeling and handling policy is mandatory. KUWAIT UNIVERSITY managers must ensure continuous compliance monitoring within their organization.
Compliance with Information Communication, labeling and handling policy will be matter for periodic review by Audit Division as per the audit guidelines and procedures.
Compliance measurement should also include periodic review for Security Quality Assurance.
Violations of the policies, standards and procedures of KUWAIT UNIVERSITY will result in corrective action by management. Disciplinary action will be consistent with the severity of the incident, as determined by an investigation, and may include, but not limited to:
Verbal or written warning
Other actions as deemed appropriate by management, Human Resources, and the Legal Department.
Custodians
Policy Reference | Custodian |
6.1 | All Users / MANAGER INFORMATION SECURITY / IT DEPT. |
6.2 | All Users / MANAGER INFORMATION SECURITY/IT DEPT./IT User Support |
6.3 | All users / IT DEPT. |
6.4 | Business Heads / IT DEPT. |
6.5 | All Users |
LDAP Policy
Purpose
This document sets out Kuwait University’s policy towards LDAP
Scope
This policy applies to all users of information assets at KUWAIT UNIVERSITY regardless of geographic location.
Although this policy explicitly covers the responsibilities of users, it does not cover the matter exclusively. Other KUWAIT UNIVERSITY Information Security policies, standards and procedures define additional responsibilities. All users are required to read, understand and comply with this Information Security policy. If any user requires further clarifications on this policy, he/she should contact the line manager, IS HELPDESK, or the MANAGER INFORMATION SECURITY.
Manager Information Security and the concerned department/division units shall jointly resolve any conflicts arising from this policy.
Responsibilities
The Manager Information Security is responsible for maintenance and accuracy of the policy. Any questions regarding this policy should be directed to Manager Information Security
Custodians responsible for implementing this policy are listed in Section 7.9
Definitions
Definition of some of the common terms:
Basic Assumptions
(None)
Policy Statements
KU will maintain a standard LDAP Directory Service. Function
Maintain contact, role and course details for all staff and students at the University. VPN Encryption and Authentication
Act as a central collection point for sets of data about people, departments, courses or any other data sets which are important to the running of the University.
Support for any application which required LDAP and which is of general use to the University. Example - Internet connectivity
Implement any data storage/retrieval requirement for which LDAP access is a viable solution.
Authentication will be by Kerberos.
LDAP passwords will still be supported for legacy systems, such as the company name, division title, employee name, or product identifier.
Related Information Security Policies
Corporate Security Policy
Internet & E-Mail Security Policy
Asset Management Policy
Access Control Policy
Compliance Measurement
Compliance with Information Communication, labeling and handling policy is mandatory. KUWAIT UNIVERSITY managers must ensure continuous compliance monitoring within their organization.
Compliance with Information Communication, labeling and handling policy will be matter for periodic review by Audit Division as per the audit guidelines and procedures.
Compliance measurement should also include periodic review for Security Quality Assurance.
Violations of the policies, standards and procedures of KUWAIT UNIVERSITY will result in corrective action by management. Disciplinary action will be consistent with the severity of the incident, as determined by an investigation, and may include, but not limited to:
Verbal or written warning
Other actions as deemed appropriate by management, Human Resources, and the Legal Department.
Custodians
Policy | Custodian |
Reference | |
6 | All Users / MANAGER INFORMATION SECURITY / IT DEPT. |
Network Servers Policy
Purpose
The purpose of this policy is to establish a set of roles and requirements to control all servers connected to KUWAIT UNIVERSITY’s demilitarized networks (DMZ) which has servers published on the internet. It is also to establish standards for the base configuration of internal server equipment that is owned and/or operated by KUWAIT UNIVERSITY. Effective implementation of this policy will minimize unauthorized access to KUWAIT UNIVERSITY proprietary information and technology
Scope
This policy applies to all users of information assets at KUWAIT UNIVERSITY regardless of geographic location.
This Policy covers all Information Systems (IS) environments operated by KUWAIT UNIVERSITY or contracted with a third party by KUWAIT UNIVERSITY. The term “IS environment” defines the total environment and includes, but is not limited to, all documentation, physical and logical controls, personnel, hardware (e.g. mainframe, distributed, desktop, network devices, and wireless devices), software, and information
Although this policy explicitly covers the responsibilities of users, it does not cover the matter exclusively. Other KUWAIT UNIVERSITY Information Security policies, standards and procedures define additional responsibilities. All users are required to read, understand and comply with this Information Security policy. If any user requires further clarifications on this policy, he/she should contact the line manager, IS HELPDESK, or the MANAGER INFORMATION SECURITY.
Manager Information Security and the concerned department/division units shall jointly resolve any conflicts arising from this policy.
Responsibilities
The Manager Information Security is responsible for maintenance and accuracy of the policy. Any questions regarding this policy should be directed to Manager Information Security
Custodians responsible for implementing this policy are listed in Section 8.9
Definitions
Definition of some of the common terms:
Basic Assumptions
(None)
Policy Statements
Network Servers Requirements
Description:
Test this Patches for compatibility with the applications and systems running on the platform in a test environment prior to implementation in the production
/live environment.
Description:
Manager Information Security will request for example Server IP, Owner Dept., Backup Administrator(s) etc. for incident responding procedure so they can contact the right person if such incident occurs.
All security related logs shall be kept online for a minimum of 1 week.
Daily incremental tape backups shall be retained for at least 1 month.
Weekly full tape backups of logs shall be retained for at least 1 month.
Monthly full backups shall be retained for a minimum of 2 years.
Port-scan attacks
Evidence of unauthorized access to privileged accounts
Anomalous occurrences that are not related to specific applications on the host
Related Information Security Policies
Corporate Security Policy
Communications & Operations Management Policy
Access Control Policy
Backup & Restoration Policy
Password Policy
Compliance Measurement
Compliance with Network Servers Policy is mandatory. KUWAIT UNIVERSITY managers must ensure continuous compliance monitoring within their organization.
Compliance with Network Servers Policy will be matter for periodic review by Audit Division as per the audit guidelines and procedures.
Compliance measurement should also include periodic review for Security Quality Assurance.
Violations of the policies, standards and procedures of KUWAIT UNIVERSITY will result in corrective action by management. Disciplinary action will be consistent with the severity of the incident, as determined by an investigation, and may include, but not limited to:
Verbal or written warning
Other actions as deemed appropriate by management, Human Resources, and the Legal Department.
Custodians
Policy Reference | Custodian |
6.1 | Manager Information Security / IT DEPT. |
Network Servers Policy
Purpose
The purpose of this policy is to establish a set of roles and requirements to control all servers connected to KUWAIT UNIVERSITY’s demilitarized networks (DMZ) which has servers published on the internet. It is also to establish standards for the base configuration of internal server equipment that is owned and/or operated by KUWAIT UNIVERSITY. Effective implementation of this policy will minimize unauthorized access to KUWAIT UNIVERSITY proprietary information and technology
Scope
This policy applies to all users of information assets at KUWAIT UNIVERSITY regardless of geographic location.
This Policy covers all Information Systems (IS) environments operated by KUWAIT UNIVERSITY or contracted with a third party by KUWAIT UNIVERSITY. The term “IS environment” defines the total environment and includes, but is not limited to, all documentation, physical and logical controls, personnel, hardware (e.g. mainframe, distributed, desktop, network devices, and wireless devices), software, and information
Although this policy explicitly covers the responsibilities of users, it does not cover the matter exclusively. Other KUWAIT UNIVERSITY Information Security policies, standards and procedures define additional responsibilities. All users are required to read, understand and comply with this Information Security policy. If any user requires further clarifications on this policy, he/she should contact the line manager, IS HELPDESK, or the MANAGER INFORMATION SECURITY.
Manager Information Security and the concerned department/division units shall jointly resolve any conflicts arising from this policy.
Responsibilities
The Manager Information Security is responsible for maintenance and accuracy of the policy. Any questions regarding this policy should be directed to Manager Information Security
Custodians responsible for implementing this policy are listed in Section 9.9
Definitions
Definition of some of the common terms:
Basic Assumptions
(None)
Policy Statements
Network Servers Requirements
Description:
Test this Patches for compatibility with the applications and systems running on the platform in a test environment prior to implementation in the production
/live environment.
Description:
Manager Information Security will request for example Server IP, Owner Dept., Backup Administrator(s) etc. for incident responding procedure so they can contact the right person if such incident occurs.
All security related logs shall be kept online for a minimum of 1 week.
Daily incremental tape backups shall be retained for at least 1 month.
Weekly full tape backups of logs shall be retained for at least 1 month.
Monthly full backups shall be retained for a minimum of 2 years.
Port-scan attacks
Evidence of unauthorized access to privileged accounts
Anomalous occurrences that are not related to specific applications on the host
Related Information Security Policies
Corporate Security Policy
Communications & Operations Management Policy
Access Control Policy
Backup & Restoration Policy
Password Policy
Compliance Measurements
Compliance with Network Servers Policy is mandatory. KUWAIT UNIVERSITY managers must ensure continuous compliance monitoring within their organization.
Compliance with Network Servers Policy will be matter for periodic review by Audit Division as per the audit guidelines and procedures.
Compliance measurement should also include periodic review for Security Quality Assurance.
Violations of the policies, standards and procedures of KUWAIT UNIVERSITY will result in corrective action by management. Disciplinary action will be consistent with the severity of the incident, as determined by an investigation, and may include, but not limited to:
Verbal or written warning
Other actions as deemed appropriate by management, Human Resources, and the Legal Department.
Custodians
Policy Reference | Custodian |
6.1 | Manager Information Security / IT DEPT. |
Employee Exit Policy
Purpose
The purpose of this policy is to reduce risk with respect to Confidentiality, Integrity and Availability (CIA) of KUWAIT UNIVERSITY information assets from an employee, contractor or other third party service provider who exits KUWAIT UNIVERSITY or is voluntarily terminated. This document relates to Kuwait University’s policy towards such employees, contractors and other third party service providers
Scope
This policy applies to all users of information assets at KUWAIT UNIVERSITY regardless of geographic location.
This Policy covers all Information Systems (IS) environments operated by KUWAIT UNIVERSITY or contracted with a third party by KUWAIT UNIVERSITY. The term “IS environment” defines the total environment and includes, but is not limited to, all documentation, physical and logical controls, personnel, hardware (e.g. mainframe, distributed, desktop, network devices, and wireless devices), software, and information
Although this policy explicitly covers the responsibilities of users, it does not cover the matter exclusively. Other KUWAIT UNIVERSITY Information Security policies, standards and procedures define additional responsibilities. All users are required to read, understand and comply with this Information Security policy. If any user requires further clarifications on this policy, he/she should contact the line manager, IS HELPDESK, or the MANAGER INFORMATION SECURITY.
Manager Information Security and the concerned department/division units shall jointly resolve any conflicts arising from this policy.
Responsibilities
The Manager Information Security is responsible for maintenance and accuracy of the policy. Any questions regarding this policy should be directed to Manager Information Security
Custodians responsible for implementing this policy are listed in Section 9
Definitions
Definition of some of the common terms:
Basic Assumptions
(None)
Policy Statements
Exit Policies
All information systems accesses must be revoked effective the date of issuance of termination orders
The concerned party’s physical access to Kuwait University’s internal facilities should be withdrawn immediately.
All information systems access must be revoked on the date of settlement of dues or date of departure from the organization (whichever is earlier)
The concerned party’s physical access Kuwait University’s internal facilities must be withdrawn and restricted effective on the date of settlement of dues or date of departure from the organization (whichever is earlier)
Related Information Security Policies
Internet & E-Mail Security Policy
Password Policy
Access Control Policy
Compliance Policy
HR termination policies and procedures
Compliance Measurement
KUWAIT UNIVERSITY managers must ensure continuous compliance monitoring within their organization.
Compliance with Employee Exit Policy will be matter for periodic review by Audit Division as per the audit guidelines and procedures.
Compliance measurement should also include periodic review for Security Quality Assurance.
Violations of the policies, standards and procedures of KUWAIT UNIVERSITY will result in corrective action by management. Disciplinary action will be consistent with the severity of the incident, as determined by an investigation, and may include, but not limited to:
Verbal or written warning
Other actions as deemed appropriate by management, Human Resources, and the Legal Department.
Custodians
Policy Reference | Custodian |
6.1 | HUMAN RESOURCES / MANAGER INFORMATION SECURITY / Department |
Heads |
Backup and Restoration Policy
Purpose
This document sets out Kuwait University’s policy towards taking backups of its information assets, including their frequency, storage, retention, documentation and restoration.
Scope
This policy applies to all users of information assets at KUWAIT UNIVERSITY regardless of geographic location.
This Policy covers all Information Systems (IS) environments operated by KUWAIT UNIVERSITY or contracted with a third party by KUWAIT UNIVERSITY. The term “IS environment” defines the total environment and includes, but is not limited to, all documentation, physical and logical controls, personnel, hardware (e.g. mainframe, distributed, desktop, network devices, and wireless devices), software, and information
Although this policy explicitly covers the responsibilities of users, it does not cover the matter exclusively. Other KUWAIT UNIVERSITY Information Security policies, standards and procedures define additional responsibilities. All users are required to read, understand and comply with this Information Security policy. If any user requires further clarifications on this policy, he/she should contact the line manager, IS HELPDESK, or the MANAGER INFORMATION SECURITY.
Manager Information Security and the concerned department/division units shall jointly resolve any conflicts arising from this policy.
Responsibilities
The Manager Information Security is responsible for maintenance and accuracy of the policy. Any questions regarding this policy should be directed to Manager Information Security
Custodians responsible for implementing this policy are listed in Section 12.9
Definitions
Definition of some of the common terms:
Basic Assumptions
(None)
Policy Statements
Backup & Restoration
Description
The Backup and Restoration Procedure will determine the type of backups to be performed, the periodicity or schedule of the backup, the protection to be provided to backup media. The level of protection will be based on the criticality of the information backed up as determined by Kuwait University’s Asset Classification and Control Policy and Asset Classification, Protection, Labeling & Handling Scheme.
Description
The on-site backup media log must contain the following information:
Date of taking the backup.
Date of moving the media to the offsite location
Contents of the media (e.g. transaction backup, application backup, entire system backup)
Nature of backup (e.g. full image copy or file copy)
Name of the Carrier
Name of the off-site location
Name and signature of the responsible person at the on-site location
Any other label information
Description
This includes the application and operational software, system data (e.g. initialization files, macro definitions, configuration data, text blocks, password files, and access-right files), the application data as such and the protocol data (such as that relating to log-ins and data transmissions).
Description
A proven standard like the maximum permissible downtime specifies the time period during which the specialized task can be performed without the availability of the relevant data and without the need for resorting to backup copies.
Related Information Security Policies
Corporate Security Policy
Access Classification and Handling Policy
Information Labeling and Handling Policy
Physical and Environmental Security Policy
Communication and Operations Management Policy
Compliance Policy
Compliance Measurements
Compliance Backup and Restoration is mandatory. KUWAIT UNIVERSITY managers must ensure continuous compliance monitoring within their organization.
Compliance with Backup and Restoration Policy will be matter for periodic review by Audit Division as per the audit guidelines and procedures.
Compliance measurement should also include periodic review for Security Quality Assurance.
Violations of the policies, standards and procedures of KUWAIT UNIVERSITY will result in corrective action by management. Disciplinary action will be consistent with the severity of the incident, as determined by an investigation, and may include, but not limited to:
Verbal or written warning
Other actions as deemed appropriate by management, Human Resources, and the Legal Department.
Custodians
Policy Reference | Custodian |
6.1 | System Administrators / IT Ops and support Dept. |
6.2 | BCP / IT Ops and Support Dept |
6.3 | IT Ops and Support Dept |
6.4 | All Users |
KUWAIT UNIVERSITY © 2015