IT01-01180 Use of BYOD sub-policy

Responsible Executive:
Chief Information Officer
Responsible Official:
Chief Information Officer
Responsible Office:
Information Technology
Effective Date:
January 30, 2019
Last Revision Date:
October 4, 2018

Associated Policies

Policy Statement

Personal technology devices (aka: "Bring Your Own Device" – BYOD) such as personal laptops, tablets, and cell phones shall only be deployed on Portland Community College (PCC) networks in accordance with defined PCC connectivity and usage policy.

Policy

  1. Wireless Connectivity
    1. Guests shall connect BYOD to the Wireless Guest Network (PCC-Guest) using a PCC-issued temporary user ID and password.
    2. Students, faculty, staff, and affiliates shall connect BYOD to the Wireless PCC Network (PCC-WiFi) using the required authentication mechanism approved and issued by PCC.
  2. Wired Connectivity
    1. Students, faculty, staff, and affiliates shall not physically connect BYOD to the PCC Wired Network.
      1. For example: shall not connect BYOD devices to the USB ports of PCC networked workstations or wall jacks.
      2. For the purpose of recharging BYOD, PCC provided re-charging stations or charge adaptors shall be used.
  3. VPN Connectivity
    1. If students, faculty, staff, and affiliates connect to PCC networks via VPN using either a BYOD or PCC supported device:
      1. If BYOD, user is responsible for ensuring the device meets PCC security standards.
      2. If PCC supported device, user must ensure that the device is available for regular security patching.
    2. Affiliates
      1. Affiliates may be granted VPN access per the defined authorization process for the required period only.
      2. Where feasible, a PCC owned and managed device shall be issued to the affiliate for this purpose.
  4. The PCC Information Security Department shall perform an annual audit of VPN accounts.
  5. Acceptable Use – Use of BYOD is subject to the same guidelines and restrictions put forth in the Acceptable Use Policy (IT01-02000).
  6. nformation Security – Use of BYOD is subject to the same guidelines and restrictions put forth in the Information Security Policy (IT01-01000).

Exemption

  1. At this time, USB drives ("thumb drives") may be connected to computer USB ports.
    1. Users should only physically connect personal USB drives when no other alternative is feasible (e.g. connecting through wireless network – see "1. Wireless Connectivity").
    2. Users shall scan their USB drives regularly for malware.
    3. It is strongly recommended that users only use FIPS-2 encrypted USB drives for the protection of their data and security in the event a USB is lost or stolen.
  2. Connecting BYOD to HDMI, VGI & VGA ports on classroom podiums, projectors, etc. is permitted.

Definitions

  • Affiliate – Any person or entity that has a contractual relationship with PCC and has been sponsored by a manager to receive controlled temporary access to PCC services.
  • Authentication – Any process by which a system verifies the identity of a User who wishes to access it. Since Access Control is normally based on the identity of the User who requests access to a resource, Authentication is essential to effective Security.
  • Encryption – The process of converting data to an unrecognizable or "encrypted" form. It is commonly used to protect sensitive information so that only authorized parties can view it.
  • Federal Information Processing Standard (FIPS) – U.S. government standards for information technology and computer security. The FIPS program is run by the National Institute of Standards and Technology (NIST). NIST FIPS 140 is the cryptography standard program required by the US federal government for protection of sensitive data. The current NIST validated/approved FIPS version is 140-2 – an Advanced Encryption Standard.
  • High-Definition Multimedia Interface (HDMI) – A proprietary audio/video interface for transmitting uncompressed video data and compressed or uncompressed digital audio data from an HDMI-compliant source device, such as a display controller, to a compatible computer monitor, video projector, digital television, or digital audio device. HDMI is a digital replacement for analog video standards.
  • Malware – Short for “malicious software,” malware refers to software programs designed to damage or do other unwanted actions on a computer system. Common examples of malware include viruses, worms, Trojan horses and spyware.
  • Network – A computer network or data network is a telecommunications network which allows nodes to share resources.
  • Port – A network port is a process-specific or application-specific software construct serving as a communication endpoint, which is used by the Transport Layer protocols of Internet Protocol suite, such as User Diagram Protocol (UDP) and Transmission Control Protocol (TCP).
  • USB “thumb” drive – A USB flash drive, also variously known as a USB drive, USB stick, thumb drive, pen drive, jump drive, flash-disk, or USB memory, is a data storage device that includes flash memory with an integrated USB interface.
  • User – Any person who makes any use of any PCC IT resource from any location (whether authorized or not).
  • Video Graphics Array (VGA) – The standard monitor or display interface used by most personal computers.
  • Virtual Private Network (VPN) – A network constructed using public wires – usually the Internet – to connect to a private network, such as a company's internal network. There are a number of systems that enable you to create networks using the Internet as the medium for transporting data.
  • Volunteered Geographic Information (VGI) – The harnessing of tools to create, assemble, and disseminate geographic data provided voluntarily by individuals. VGI is a special case of the larger Web phenomenon known as user-generated content, and allows citizens to have a more active role in urban planning activities.