Attachment A.pdf

SOUTH CAROLINA DEPARTMENT OF MOTOR VEHICLES

POLICY AD-500 – APPROPRIATE USE OF COMPUTING RESOURCES

THE LANGUAGE USED IN THIS DOCUMENT DOES NOT CREATE AN EMPLOYMENT CONTRACT BETWEEN THE EMPLOYEE AND THE AGENCY.

THIS DOCUMENT DOES NOT CREATE ANY CONTRACTUAL RIGHTS OR ENTITLEMENTS. THE AGENCY RESERVES THE RIGHT TO REVISE THE CONTENT OF THIS DOCUMENT, IN WHOLE OR IN PART. NO PROMISES OR ASSURANCES, WHETHER WRITTEN OR ORAL, WHICH ARE CONTRARY TO OR INCONSISTENT WITH THE TERMS OF THIS PARAGRAPH CREATE ANY CONTRACT OF EMPLOYMENT.

SECTION OF LAW: NA REQUIRED ACTION

• All employees are responsible for reading and following this policy.

• All contractors, vendors, and third-parties who make use of SCDMV’s network and/or computer resources are responsible for reading and following this policy.

• Supervisors/Managers are responsible to have every employee and new hire read this policy and electronically acknowledge it in PowerDMS. Supervisors/Managers must maintain acknowledgement reports for their area.

• SCDMV personnel must be in full compliance with Policy AD-551 Information Security before access will be granted to

SCDMV-owned data or systems.

DEFINITIONS

Personally Identifiable Information (PII): Refer to Policy AD-502 Personally Identifiable Information for this definition.

Personnel: All individuals employed by SCDMV and contractors/vendors/third parties who are authorized to perform services or jobs for SCDMV.

GUIDELINES

A. GENERAL REQUIREMENTS

1. Multifactor Authentication

a. SCDMV personnel shall use biometric devices in combination with identity tokens and token readers provided by SCDMV as the primary means of securely authenticating users’ credentials prior to granting users access to the SCDMV network.

b. SCDMV personnel should keep their identity tokens on their persons at all times. It is a policy violation to leave the identity token on the token reader even while the user is present.

c. Identity tokens are SCDMV property and shall be afforded reasonable protection from loss, theft, or compromise at all times even while the individual is not on duty.

d. SCDMV IT, with approval of the appropriate Director, will identify and train individuals who are authorized to install soft identity tokens.

e. Personnel authorized to install soft tokens will ensure the user receiving the token understands how to use the token.

f. Any SCDMV personnel who are unable to use the provided biometric devices will be required to use hard or soft tokens issued by the Agency in lieu of the biometric requirement. Agency issued soft identity tokens are only allowed to be installed on SCDMV owned systems or devices by authorized personnel.

g. Users with laptops or tablet devices must use SCDMV provided hard or soft identity tokens along with biometric authentication. If biometric is not available the user may use his passphrase ensuring that no other persons are able to observe him entering it.

h. The biometric devices will only grant access to SCDMV networks once users’ credentials have been authenticated. SCDMV Information Technology does not support use of the devices to log users into any other accounts including SCEIS or other passphrase secured applications and services.

i. The SCDMV IT Help Desk will only assist users to access the SCDMV network.

j. SCDMV personnel shall not use their passphrases in lieu of the biometric device to access any SCDMV system without prior written approval from the CIO or designated representative.

k. Users shall report lost, stolen, or compromised tokens to the IT Help Desk and the ISO immediately.

2. Passphrases

It is critical that SCDMV personnel develop strong passphrases to properly protect the SCDMV network, PII, and other data requiring protection. SCDMV network management tools are designed and configured to enforce complex passphrases including length of passphrases and expiration periods.

a. General Rules for Passphrases

1. Passphrases are to be kept confidential will not be shared with any other individuals, and will not be written down in clear text and/or stored in the same general area as PCs, laptops, or other password https://powerdms.com/link/IDS/document/?id=1225574 http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-551.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-502.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-502.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-502.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-502.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-502.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-502.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-502.pdf enabled devices. However, passphrases may be written down if they are securely maintained as in a wallet or handbag.

2. Passphrases will be reset every 180 days. If IT personnel determine that a passphrase has or may have been compromised, a user may be required to create a new passphrase.

3. Passphrases may contain words commonly found in a dictionary provided the passphrases are at least fifteen characters long and meet the requirement in paragraph 2b below.

4. Variations of user names or login IDs are not allowed.

5. Re-using a passphrase incremented sequentially by number is prohibited.

6. A passphrase can be reused only after the fifth change.

b. Creating a Strong Passphrase

1. A strong passphrase must contain at least fifteen characters to include spaces.

2. Avoid using upper case as the first letter of the passphrase.

3. Avoid using a number as the last character of the passphrase.

4. A strong passphrase must contain at least three characters from the four following categories:

a. Uppercase character (A, B, C, D, E, F, G)

b. Lowercase character (a, b, c, d, e, f, g)

c. Number (0,1, 2, 3, 4, 5, 6, 7, 8, 9)

d. Special Character (~, !, @, #, $, ^, &, *, and space)

c. Some examples of strong passphrases include the following (do not use these as your passphrase):

1. pr0ud of my 4 grandch!ldren

2. retired 2 my G@rden

3. favorit3 color is Blue!

4. farewell Going 2 fish

d. Re-setting or changing a passphrase

1. SCDMV personnel will be locked out of SCDMV’s network after five failed attempts to access the network. Users must contact the IT Help Desk to immediately reset or change their passphrases.

2. The IT Help Desk will follow established procedures to positively validate the identity of the user before the passphrase will be reset or changed.

3. Internet Security

The following procedures are intended to protect customer data (Personally Identifiable Information) and to protect the network from potential threats through unauthorized access from Internet borne attacks including malware/spyware/viruses/trojans. These restrictions apply to all SCDMV personnel who access the SCDMV network while using an Internet browser (Internet Explorer, Google Chrome, Mozilla Firefox, etc.) to connect to the Internet.

a. SCMDV users are to: do the following.

1. Set browser home pages for the SCDMV Intranet or SCDMV browser-based applications.

2. Ensure PCs and laptops are connected to the SCDMV network regularly but no less than monthly so that they maintain the latest operating system software updates.

3. Ensure PCs and laptops have up-to-date anti-virus software loaded and enabled.

4. Ensure PCs and laptops have up-to-date firewalls loaded and running when the devices are not connected directly to the DMV network.

5. Set Internet security options in browsers to the highest available settings. If necessary, users can always back the settings down a level if the settings are preventing users from opening websites.

6. Turn on pop-up blockers and adjust the settings to high. The pop-up settings are adjustable to allow pop-ups when necessary.

7. Pay attention to the websites visited and avoid downloading “free” software. (Usually free means there might be hidden code in the software.)

8. If users have business needs, they should download software from reputable sites. If a user is in doubt, he should contact the IT Help Desk.

9. Ensure websites are secure before entering PII or financial information. A user should look for “https:”

prefacing the URL on the address line of the site.

NOTE: If a user is in doubt, he should ask the IT Help Desk. They are there to help.

b. SCDMV users are not to do the following.

1. Download software from the Internet without management approval. SCDMV policy prohibits downloading software (stock tickers, weather bugs, screen savers, tool bars, etc.) to PCs and laptops.

2. Leave browsers open for extended time periods when not in use.

3. Visit unauthorized sites. A few examples are: gambling, porn, sites with violent content, hate sites, etc.

4. Enter PII on websites unless absolutely necessary. (This can lead to identity theft.)

5. Enter SCDMV email addresses on websites (unless for Agency business). (That usually results in unsolicited, unwanted email.)

B. AUTHORIZED USES OF COMPUTER RESOURCES

1. Official SCDMV Business

Use of department computer resources includes purposes related to the administration and execution of SCDMV business. This includes but is not limited to the following examples:

a. The execution of vehicle and/or driver-related transactions by authorized users.

b. The scanning, indexing, retrieval, and dissemination (by authorized users) of source documents provided by customers in support of DMV-related transactions.

c. The data entry of records, accident reports, tickets and other forms/correspondence as required to update and maintain agency data.

d. Use of personal computers and desktop office automation software (such as Microsoft Word, Excel, Outlook or Access) to create, update, store, delete, retrieve, print, and disseminate agency documents, correspondence, emails, calendars, spreadsheets, project plans, presentations, databases as required by an user’s job duties.

e. Use of the agency’s personal computers, network, Intranet and Internet for work-related research, training, and communications, including social media sites.

2. Incidental Personal Use

a. Uses of the Internet e-mail that do not conflict with other provisions of this policy are permitted.

b. Use of the Internet is permitted only under the following conditions:

1. Only when Phoenix and the Customer Queuing system are closed (not minimized) prior to accessing the Internet. (These applications must be closed because they access and contain customer Personally Identifiable Information.)

2. Only when on break.

3. Never in the presence of customers or the public.

4. Never while on the telephone assisting a customer.

5. All browser home pages must be set for the DMV Intranet or DMV browser-based applications.

C. PROHIBITED USES OF COMPUTER RESOURCES

1. Prohibited uses of department computer resources include but are not limited to the following examples:

a. Any use, including Internet usage, for any illegal, fraudulent, pornographic, or malicious activity, or to support or assist any such purpose by others.

b. Any use in violation of the Agency’s Harassment Free Workplace, Workplace Violence, Ethical Conduct, and/or Equal Opportunity policies.

c. Any partisan political or proselytizing religious activity.

d. Any use in activity on the behalf of organizations having no affiliation with the department.

e. Use of department resources to administer, advertise, manage or otherwise operate a personal commercial enterprise such as a web-based business, personal eBay or other on-line store, auction house, or distribution network.

f. Accessing another user’s Active Directory account, email, Internet history, files, and/or folders without permission unless engaged in necessary network and/or server administration and/or maintenance. g.

Sharing of usernames and/or passphrase.

h. Viewing customer records for non-business purposes.

i. Attempting to circumvent, defeat, disable, deceive, or neutralize systems used to: audit network or system devices and applications; maintain network or system security; and/or provide malware/spyware protection.

j. Any use of software in violation of the appropriate vendor’s licensing agreement.

k. Permitting any unauthorized individual to use department issued equipment/devices or to access the SCDMV network or any SCDMV system.

l. Any system configuration change to any SCDMV network device, server, computer, or to the software running on any such device without prior permission from the IT Manager or his/her designee(s). This would include downloading software from the Internet and installing it without prior ISO approval.

m. Deliberately propagating any form of malware, spyware, snooping software, or device designed to disrupt, disable, impair, or otherwise harm SCDMV’s network or systems. This includes any device or software which captures data on the network or from any system for non-business purposes.

n. Using system resources or computers to host or participate in network or internet-based gaming.

o. Monopolizing systems, data storage libraries, bandwidth, printers, printer paper, or any other system or network resource.

p. Participating in constant use of streaming media.

q. Sending agency-wide email not related to Agency business or sending business-related agency-wide email that does not apply to all users.

r. Releasing information about SCDMV systems or the SCDMV network without proper authorization.

s. Intercepting network traffic for any purpose unless engaged in authorized network or server administration and/or monitoring.

2. Electronic Media

a. All non-SCDMV peripheral devices or electronic media (USB drives, external hard drives, CDs, DVDs etc.), including those owned by other state agencies, contractors, vendors, or business partners, shall not be connected to the SCDMV network or inserted into SCDMV owned PCs, laptops, or servers without the written approval of the user’s Director, the ISO, and the Executive Director. Such devices will be scanned by the IT Department before being connected to any PC or device owned by SCDMV.

1. USB Flash Drives: To connect a USB flash drive device to the DMV network, the user must first obtain written approval from both his Director and the Executive Director and must provide a copy of the written approval to the IT Department Network Administrator. The IT Department will provide a new, encrypted, passphrase protected device to the individual. At the time of issuance, the device will be scanned into service by the IT Department and the user will be asked to install a passphrase into the device.

2. All other storage media/drives and devices will be reviewed and allowed to connect to the network on a case by case basis as approved by the Director and the Executive Director.

b. Storage devices owned by SCDMV are to be used on SCDMV owned or approved equipment only.

c. SCDMV owned data (other than business related email) shall not be transferred to or stored on electronic media without the written consent and approval of the data owner and the SCDMV Information Security Officer

(ISO).

d. Software or data shall not be downloaded from electronic media (including the Internet) without the written consent and approval of the ISO.

e. Exceptions

1. The SCDMV IT Department does have approval to download business-related software from electronic media.

2. The IT Department does have approval to store copies of SCDMV owned data on SCDMV owned/provided electronic media for the purposes of back-up files/data.

D. MONITORING

1. SCDMV personnel are required to indicate their awareness of and consent to following terms and conditions of use prior to accessing SCDMV’s network.

WARNING: This is an SC DMV Computer System .

It is for authorized use only. Users have no explicit or implicit expectation of privacy. Any use of this system and all files on this system may be intercepted, monitored, recorded, copied, audited, inspected, and disclosed to authorized SCDMV, and Law Enforcement personnel. By using this system, the user consents to such interception, monitoring, recording, copying, auditing, inspection, and disclosure to and at the discretion authorized SCDMV, and Law Enforcement personnel. Unauthorized or improper use of this system may result in administrative disciplinary action and civil and criminal penalties. By continuing to use this system you indicate your awareness of and consent to these terms and conditions of use.

OK

2. The Chief Information Officer (CIO) will ensure that the above warning notice is displayed during the users’ daily computer log-in process.

3. The ISO, CIO, and designees are the only persons authorized to monitor routine traffic on the SCDMV network.

Should routine monitoring detect any irregular traffic, possible improper conduct or other violations of policy, the CIO/ISO will immediately forward the information to the Office of Inspector General.

4. Requests for non-routine monitoring of traffic must first be approved through the appropriate chain of command.

Once approved, the request must be submitted to IT in writing to the CIO/ISO, such as by email, and copied to the appropriate administrative office before the CIO/ISO will monitor.

E. TRAINING

1. Training & Change Management will ensure that this policy is adequately addressed in relevant user manuals, documents, and publications and in training given to new computer users.

2. Human Resources will ensure that this policy is disseminated during the orientation of all new agency employees.

F. CORRECTIVE ACTION: Employees violating this policy may be investigated in accordance with Policy AD-800, Investigations and Internal Affairs. Employees violating this policy may be subject to corrective action up to and including termination in accordance with HR-202 Progressive Corrective Action Disciplinary Policy.

CONTACT/TELEPHONE: Information Technology (803) 896-0579

APPROVED BY:

DMV Executive Director

ATTACHMENTS: Policy AD-501 Email Retention and Use; Policy AD-502 Personally Identifiable Information; Policy AD551 Information Security; Form AD-551D Reporting Loss of Social Security Administration-PII

EFFECTIVE DATE: September 17, 2018 http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-800.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-800.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-800.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-800.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-800.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-800.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-800.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-800.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/hr-202.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/hr-202.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/hr-202.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/hr-202.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/hr-202.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-501.pdf https://powerdms.com/link/IDS/document/?id=1225586 http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-501.pdf https://powerdms.com/link/IDS/document/?id=1225586 http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-501.pdf https://powerdms.com/link/IDS/document/?id=1225586 http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-501.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-501.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-502.pdf https://powerdms.com/link/IDS/document/?id=1225588 http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-502.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-502.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-502.pdf https://powerdms.com/link/IDS/document/?id=1225588 http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-502.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-551.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-551.pdf https://powerdms.com/link/IDS/document/?id=1225606 https://powerdms.com/link/IDS/document/?id=1225606 http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-551.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-551.pdf http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-551.pdf https://powerdms.com/link/IDS/document/?id=1225606 http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-551.pdf https://powerdms.com/link/IDS/document/?id=1224335 http://intrwebsvr2/dmvintranet/forms/policies%20and%20procedures/NEW%20DMV%20POLICIES/ad-551.pdf