Last Update Status: 18/03/2022
The Internet and Technology related systems, including but not limited to computer equipment, software, operating systems, storage media, network accounts providing electronic mail and internet browsing are to be used for business purposes in serving the interests of the company, and of our clients and customers in the course of normal operations. POS Works’ intentions for publishing an Information and Technology Policy is to impose restrictions to protect POS Works established culture of openness, trust and integrity.
Effective IT security is a team effort involving the participation and support of every POS Works employee and associate who deals with information and/or information systems. It is the responsibility of every computer user to know these guidelines, and to conduct their activities accordingly.
It is expected that all reasonable steps are taken to comply with the Australian Cyber Security Center’s published “Essential Eight” cyber security controls.
1. UTILIZE APPLICATION/PROGRAM CONTROLS:
Use application and program controls to prevent the execution of unapproved/malicious programs and installers.
2. PATCH APPLICATIONS:
Patch/mitigate computers with ‘high risk’ vulnerabilities. Use the latest version of applications including Flash, web browsers, Microsoft Office, Java, and PDF viewers.
3. CONFIGURE MICROSOFT OFFICE MACRO SETTINGS
Block macros from the internet, and only allow vetted macros either in ‘trusted locations’ with limited write access or digitally signed with a trusted certificate.
4. USER APPLICATION HARDENING.
Configure web browsers to block Flash (ideally uninstall it), ads, and Java on the internet. Disable unnecessary features in Microsoft Office web browsers, and PDF viewers.
5. RESTRICT ADMINISTRATIVE PRIVILEGES
Restrict operating systems and applications based on user duties. Regularly revalidate the need for privileges.
6. PATCH OPERATING SYSTEMS.
Patch/mitigate computers (including network devices). Use the latest operating system version. Don’t use unsupported versions.
7. USE MULTI-FACTOR AUTHENTICATION
Use MFA where possible particularly for programs that perform a privileged action or access an important (sensitive/high-availability) data repository.
8. REGULAR BACKUPS
Regular back-ups of important new/changed data, software, and configuration settings, stored disconnected, retained for at least three months.
The purpose of this policy is to outline the acceptable use of computer equipment at POS Works. These rules are in place to protect the employee and POS Works. Inappropriate use exposes POS Works to risks including virus attacks, compromise of network systems and services, and legal issues.
This policy applies to the use of information, electronic and computing devices, and network resources to conduct POS Works business or interact with internal networks and business systems, whether owned or leased by POS Works, the employee, or a third party. All employees, contractors, consultants, temporary, and other workers at POS Works and its subsidiaries are responsible for exercising good judgment regarding appropriate use of information, electronic devices, and network resources in accordance with POS Works policies and standards, and local laws and regulation.
This Policy specifically deals with the following areas:
Management will verify compliance to this policy through various methods, including but not limited to, periodic walk-thrus, business tool reports, internal and external audits, and feedback to the policy owner.
Non-Compliance
Violations of this policy may be subject to disciplinary action.
Allowing employees to install software on company computing devices opens the organization up to unnecessary exposure. Conflicting file versions can prevent programs from running, the introduction of malware from infected installation software, unlicensed software which could be discovered during audit, and programs which can be used to hack the organization’s network are examples of the problems that can be introduced when employees install software on company equipment.
Passwords are an important aspect of computer security. A poorly chosen password may result in unauthorized access and/or exploitation of our resources. All staff, including contractors and vendors with access to POS Works systems, are responsible for taking the appropriate steps, as outlined below, to select and secure their passwords.
Password Creation
Password Protection
Passwords are a critical component of information security. Passwords serve to protect user accounts; however, a poorly constructed password may result in the compromise of individual systems, data, or network. This guideline provides best practices for creating secure passwords.
Strong passwords are long, the more characters you have the stronger the password.
We recommend a minimum of 13 characters in your password. In addition, we highly encourage the use of passphrases, passwords made up of multiple words. Examples include “It’s time for vacation” or “block-curious-sunny-leaves”. Passphrases are both easy to remember and type, yet meet the strength requirements.
Poor, or weak, passwords have the following characteristics:
In addition, every work account should have a different, unique password. To enable users to maintain multiple passwords, we highly encourage the use of ‘password manager’ software that is authorized and provided by the organization. Whenever possible, also enable the use of multi-factor authentication.
Electronic email is often the primary communication and awareness method within an organization. At the same time, misuse of email can post many legal, privacy and security risks, thus it’s important for users to understand the appropriate use of electronic communications.
A clean desk policy can be an important tool to ensure that all sensitive/confidential materials are removed from an end user workspace and locked away when the items are not in use or an employee leaves his/her workstation. It is one of the top strategies to utilize when trying to reduce the risk of security breaches in the workplace. Such a policy can also increase employee’s awareness about protecting sensitive information.
All printers and fax machines should be cleared of papers as soon as they are printed; this helps ensure that sensitive documents are not left in printer trays for the wrong person to pick up.
The following activities are, in general, prohibited. Employees may be exempted from these restrictions during the course of their legitimate job responsibilities (e.g., systems administration staff may have a need to disable the network access of a host if that host is disrupting production services).
Under no circumstances is an employee of POS Works authorized to engage in any activity that is illegal under local, state, federal or international law while utilizing POS Works- owned resources.
The lists below are by no means exhaustive, but attempt to provide a framework for activities which fall into the category of unacceptable use.
The following activities are strictly prohibited, with no exceptions:
Internet connectivity presents the company with new risks that must be addressed to safeguard the facility’s vital information assets.
Access to the Internet by personnel that is inconsistent with business needs results in the misuse of resources. These activities may adversely affect productivity due to time spent using or “surfing” the Internet. Additionally, the company may face loss of reputation and possible legal action through other types of misuse.
Access to the Internet will be provided to users to support business activities and only on an as-needed basis to perform their jobs and professional roles.
The Internet usage Policy applies to all Internet users (individuals working for the company, including permanent full-time and part-time employees, contract workers, temporary agency workers, business partners, and vendors) who access the Internet through the computing or networking resources. The company’s Internet users are expected to be familiar with and to comply with this policy, and are also required to use their common sense and exercise their good judgment while using Internet services.
Allowed Usage
Internet usage is granted for the sole purpose of supporting business activities necessary to carry out job functions. All users must follow the corporate principles regarding resource usage and exercise good judgment in using the Internet. Questions can be addressed to the IT Department.
Acceptable use of the Internet for performing job functions might include:
Personal Usage
All users of the Internet should be aware that the company network creates an audit log reflecting request for service, both in-bound and out-bound addresses, and is periodically reviewed.
Users who choose to store or transmit personal information such as private keys, credit card numbers or certificates or make use of Internet “wallets” do so at their own risk. The company is not responsible for any loss of information, such as information stored in the wallet, or any consequential loss of personal property
Prohibited Usage
Activities that are strictly prohibited include, but are not limited to:
Bandwidth both within the company and in connecting to the Internet is a shared, finite resource. Users must make reasonable efforts to use this resource in ways that do not negatively affect other employees. Specific departments may set guidelines on bandwidth use and resource allocation, and may ban the downloading of particular file types.
Software License
The company strongly supports strict adherence to software vendors’ license agreements. When at work, or when company computing or networking resources are employed, copying of software in a manner not consistent with the vendor’s license is strictly forbidden. Questions regarding lawful versus unlawful copying should be referred to the IT Department for review or to request a ruling from the Legal Department before any copying is done.
Similarly, reproduction of materials available over the Internet must be done only with the written permission of the author or owner of the document. Unless permission from the copyright owner(s) is first obtained, making copies of material from magazines, journals, newsletters, other publications and online documents is forbidden unless this is both reasonable and customary. This notion of “fair use” is in keeping with international copyright laws.
Expectation of Privacy
Users should consider their Internet activities as periodically monitored and limit their activities accordingly.
Management reserves the right to examine E-mail, personal file directories, web access, and other information stored on company computers, at any time and without notice. This examination ensures compliance with internal policies and assists with the management of company information systems.
E-mail Confidentiality
Users should be aware that clear text E-mail is not a confidential means of communication. The company cannot guarantee that electronic communications will be private. Employees should be aware that electronic communications can, depending on the technology, be forwarded, intercepted, printed, and stored by others. Users should also be aware that once an E-mail is transmitted it may be altered. Deleting an E-mail from an individual workstation will not eliminate it from the various systems across which it has been transmitted.
Maintaining Corporate Image
When using company resources to access and use the Internet, users must realize theyrepresent the company. Whenever employees state an affiliation to the company, they must also clearly indicate that “the opinions expressed are my own and not necessarily those of the company”.
Company Materials
Users must not place company material (examples: internal memos, press releases, product or usage information, documentation, etc.) on any mailing list, public news group, or such service. Any posting of materials must be approved by the employee’s manager and the public relations department and will be placed by an authorized individual.