Attachment 7 - PD 715-04 Use Of OIG Information Technology Resources.pdf

Policy Directive 715-04 August 2, 2011

Use of OIG Information Technology Resources

This policy covers OIG owned or leased information technology (IT) resources. This policy supplements Treasury Policy TD P 85-01 Treasury Information Technology Security Program and Treasury Directive TD 87-04 Personal Use of Government Information Technology Resources.

Government IT resources includes but is not limited to: office and telephone equipment, personal computers, laptops and tablets, related peripheral equipment and application software, library resources, telephone equipment and services (including phone sets, cell phones, smart phones, blackberries, pagers, palm pilots, and voice mail), fax machines, photocopiers, Internet connectivity and access to Internet services, and e-mail but does not include the use of franked or official envelopes and stationary, and mailing labels.

Information technology means any equipment or interconnected system or subsystem of hardware or application software that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data.

Limited personal use means activity by employees that is conducted during personal time in the course of the business day and is considered an "authorized use" of government property as the term is used in the Standards of Conduct for Employees of the Executive Branch (5 CFR§ 2635.101 (b) (9) and § 2635.704 (a)). Employees are specifically prohibited from the pursuit of private commercial business activities or profit-making ventures using Government IT resources. The ban also includes employees using the Government IT resources to assist relatives, friends, or other persons in such activities (e.g., employees may not operate or participate in the operation of a business with the use of the Department’s IT and Internet resources), nor does the privilege extend to modifying the equipment used, including loading personal software, copying existing software, or making configuration changes.

When necessary for OIG work, the Deputy Inspector General or Assistant Inspector General for Management can authorize use that is normally prohibited.

The use of a warning/security message is an important security practice. It lets us know we lack reasonable expectation of privacy when using OIG IT resources. Management can and may monitor all computer use. Inappropriate use can result in disciplinary action. Also, the message may aid the prosecution of intruders.

Do not use another employee’s account information to log onto the OIG network or access OIG resources. Every employee gets a unique network account to access the OIG network. Only use the account assigned to you and do not give your password to anyone else.

Wireless devices

• Users may not use privately owned Blackberry, smart phones, tablets or other wireless devices to connect to OIG IT resources.

• Users wishing to load additional software to include free smart phone apps but excluding free ring tones and “skins”, on their government issued wireless device must have approval of the IT Director. If users have a need to install new software, outline the need and submit a Service Desk ticket containing your AIG’s approval of your justification.

• Encryption is enabled by default on all OIG wireless devices. Users are prohibited from changing these settings.

• Smart phones may not be used as flash storage devices. Your OIG issued thumb drive is the only device to be used for flash storage.

• Adding, changing or removal of media card (micro SD) is not allowed. Insertion of personally owned media cards in an OIG wireless device is prohibited.

• Loss of any wireless device must be reported as soon as discovered to supervisors and IT support staff.

Instant Messaging (IM) applications

• Use of IM system will be for official use only as outlined in the appropriate use explanation above.

• IM is for use within the OIG local area network (LAN) only. Any attempts to connect to IM servers outside the OIG LAN will be considered an attempt to circumvent security controls and will be handled accordingly.

Attachment 7

• All IM message traffic will be archived and retained per applicable OIG, Treasury and Federal guidelines. All IM message traffic is subject to monitoring for appropriate use. Users should have no expectation of privacy.

File sharing technology or peer-to-peer (P2P) applications

Use of file sharing technology or peer-to-peer applications is prohibited. File sharing technology, also known as Peer-to-Peer (P2P), generally refers to any software or system allowing individual users of the Internet to connect to each other and trade computer files. These systems are usually highly decentralized and are designed to facilitate connections between persons who are looking for certain types of files. A number of studies show the vast majority of files traded on P2P networks are copyrighted music files and pornography. P2P is a common avenue for the spread of computer viruses within IT systems, and has been known to dominate a disproportionate segment of an organization’s available bandwidth.

E-mail use Realize that use of business e-mail address is a direct reflection on the OIG.

• When sending sensitive information via e-mail outside of the OIG, you must use encryption.

• Do not send harassing, intimidating, abusive, objectionable language or offensive material.

• Do not send greeting cards, video, sound, or other large file attachments that could degrade the performance of the network.

• Do not forward chain letters.

• Do not use auto forwarding to forward your email to other locations.

Inappropriate use of IT resources includes:

• Creating, downloading, viewing, storing, or transmitting graphics, images, or sound, which are sexually explicit, discriminatory, offensive, obscene, or intended to harass.

• Unlawful or malicious activities prohibited on Federal property.

• Engaging in any activity which would compromise the security of any Government information system or adversely affect the performance of the Treasury or OIG network.

• Installing, copying, or deleting software without authorization. OIG security policy does not allow users to install software on OIG IT resources. Unauthorized software installations may make our network more vulnerable to viruses. IT personnel test all software packages before installation.

Software packages can only be installed with IT assistance and must be approved by the IT Director. If you want to install new software, outline the need and submit a Service Desk ticket.

Do not attempt to bypass security permissions to install software. IT validates the OIG software inventory to prevent unauthorized software use.

• Exchanging or removing IT resources without authorization. For example, this would include removing a printer from a departing employee’s office.

• OIG security policy does not allow employees to attach or use personally owned equipment on the OIG network for any reason including accessing servers, files or systems. Only government issued IT resources, laptops, PDAs, and fully encrypted USB thumb drives are allowed on the OIG network.

• OIG security policy does not allow processing and/or storage of sensitive, personal, or classified information on personally owned computers.

• Use of Instant Messaging (IM) applications outside of the OIG network or visiting internet chat rooms.

• Use of File Sharing Technology, also known as Peer-to-Peer (P2P).

• Posting OIG information to external news groups, bulletin boards, or forums.

• Engagement in matters directed toward the success or failure of a political party, candidate for partisan political office, or partisan political group, or activity to support political fund raising.

• Downloading illegal or unauthorized copyrighted content, including illegal downloads using file sharing programs, and downloading un-trusted, unapproved, or malicious software.

• Downloading, copying, and/or playing of computer video games, movies or any other copyrighted material.

• Viewing, storage, or transmission of materials related to all gambling (legal and illegal), illegal weapons, terrorist activities, and any other illegal activities or activities otherwise prohibited.

• Using the Internet as a video, radio or music player. Such live stream use of the Internet could strain the OIG network and significantly slow communications, inhibiting OIG employees from conducting official business.

• Using "push" technology on the Internet or other continuous data streams, unless they are directly associated with the employee's job. Push technology from the Internet means daily, hourly or continuous updates via the Internet; e.g., news, traffic, stock quotes, weather, and similar information. Continuous data streams could degrade the performance of the entire network.

If you have any questions regarding this policy please contact the Office of Management by email at OIG- OM@oig.treas.gov or call our main line at (202) 927-5200.

Attachment 7 mailto:OIG-OM@oig.treas.gov mailto:OIG-OM@oig.treas.gov

Office of the Inspector General GSS Acceptance of User Responsibility

Violations of OIG GSS computer policies or Department of Treasury computer policies may lead to disciplinary action, consistent with the personnel policies and practices of the violator’s organization, and, in some cases, criminal prosecution. Signing this form acknowledges your understanding of the requirements for access to the GSS system and your responsibilities regarding appropriate use of the system.

Contractor Name: ___________________________________________________ (Print)

Company / Work Email: ___________________________________________________

Work Phone:

Employee Signature:

OIG COR:

Supervisor:

Contractor Signature: ___________________________________________________

Return completed form and Annual Cyber Security Training Certificate of Completion to following email recipients OIG COR cc: LimY@oig.treas.gov, EldredgeE@oig.treas.gov, HaymoreJ@oig.treas.gov, DavisA@oig.treas.gov