Inappropriate Use of Technology Assets Standard

ADMINISTRATIVE INFORMATION

REASON FOR STANDARD

The following activities are, in general, prohibited. Vanderbilt Community Members may be exempted from these restrictions during the course of their legitimate job responsibilities (e.g., systems administration staff may have a need to disable the network access of a host if that host is disrupting production services). Use of IT assets for private or personal purposes that interferes with work or job performance or interferes with the activities of other employees, students, or other authorized users is prohibited.

SCOPE

This standard applies to any device being used to collect, transmit, process, store or host university data, regardless of ownership, including but not limited to cell phones, tablets, laptops, and notebooks.

STANDARD

The lists below are by no means exhaustive but attempt to provide a framework for activities which fall into the category of inappropriate use.

1. SYSTEM AND NETWORK ACTIVITIES

The following activities are strictly prohibited, with no exceptions:

Violations of the rights of any person or company protected by copyright, trade secret, patent or other intellectual property, or similar laws or regulations, including, but not limited to, the installation or distribution of "pirated" or other software products that are not appropriately licensed for use by Vanderbilt university;
Unauthorized copying of copyrighted material including, but not limited to, digitization and distribution of photographs from magazines, books or other copyrighted sources, copyrighted music, and the installation of any copyrighted software for which Vanderbilt or the end user does not have an active license is strictly prohibited;
Accessing data, a server, or an account for any purpose other than conducting Vanderbilt business, even if you have authorized access, is prohibited;
Exporting software, technical information, encryption software or technology, in violation of international or regional export control laws, is illegal. The appropriate management should be consulted prior to export of any material that is in question;
Introduction of malicious programs into an IT asset (e.g., viruses, worms, Trojan horses, e-mail bombs, etc.);
Revealing your account password to others or allowing use of your account by others. This includes family and other household members when work is being done at home;
Using a Vanderbilt IT assets to actively engage in procuring or transmitting material that is in violation of sexual harassment or hostile workplace laws in the user's local jurisdiction;
Making fraudulent offers of products, items, or services originating from any Vanderbilt account;
Effecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, "disruption" includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes;
Capturing network traffic (e.g., network or port scanning, network mapping, or reviewing network traffic) is expressly prohibited unless prior approval from the information security team is granted;
Executing any form of network monitoring which will intercept data not intended for the employee's host unless this activity is a part of the employee's normal job/duty;
Circumventing user authentication or security of any host, network, or account;
Introducing systems set up as a decoy to detect and monitor intrusion attempts (e.g., honeypots, honeynets) to the Vanderbilt network;
Interfering with or denying service to any user other than the employee's host (for example, denial of service attack);
Using any program/script/command, or sending messages of any kind, with the intent to interfere with, or disable, a user's terminal session, via any means, locally or via the Internet/Intranet/Extranet; and
Providing information about, or lists of, Vanderbilt Community Members to parties outside the university.

2. EMAIL AND COMMUNICATION ACTIVITIES

When using Vanderbilt information technology assets to access and use the Internet, Vanderbilt Community Members must realize they represent the university. Whenever faculty or staff state an affiliation to the university, they must also clearly indicate that "the opinions expressed are my own and not necessarily those of the university". Questions may be addressed to the Office of the General Counsel.

Sending email messages without university business justification, including the sending of “junk mail” to individuals who did not specifically request such material (e.g., email spam);
Any form of harassment via email, telephone, or paging, whether through language, frequency, or size of messages;
Unauthorized use, or forging, of email header information;
Solicitation of email for any other email address, other than that of the poster's account, with the intent to harass or to collect replies;
Creating or forwarding "chain letters", "Ponzi" or other "pyramid" schemes of any type;
Use of unsolicited email originating from within Vanderbilt's networks of other Internet/Intranet/Extranet service providers on behalf of, or to advertise, any service hosted by Vanderbilt or connected via Vanderbilt's network; and
Posting the same or similar non-business-related messages to large numbers of Usenet newsgroups (newsgroup spam).

3. BLOGGING AND SOCIAL MEDIA

Blogging by employees, whether using Vanderbilt’s property and systems or personal computer systems, is also subject to the terms and restrictions set forth in this Policy. Limited and occasional use of Vanderbilt’s systems to engage in blogging is acceptable, provided that it is done in a professional and responsible manner, does not otherwise violate Vanderbilt’s policy, is not detrimental to Vanderbilt’s best interests, and does not interfere with an employee's regular work duties. Blogging from Vanderbilt’s systems is also subject to monitoring.

Vanderbilt Community Members are prohibited from revealing any university confidential information or sensitive data as defined by the VU Data Classification Policy when engaged in blogging; and
Community Members shall not engage in any blogging that may harm or tarnish the image, reputation and/or goodwill of the university and/or any of its employees. Individuals are also prohibited from making any discriminatory, disparaging, defamatory or harassing.
Social media usage at Vanderbilt is governed by the same policies that govern all other electronic communications and appropriate use of technology assets. VU Community Members should refer to Vanderbilt’s Social Media Policy for detailed guidance.

EXCEPTIONS

On a rare occasion, a security policy exception may be considered depending on the impact to the university mission and security risk(s) introduced. Exception requests must be submitted to the VU Chief Information Security Officer for evaluation and risk assessment. The CISO, or a delegate, will grant or deny the request based on the level of risk.

ENFORCEMENT

Any VU community member that violates this policy may be subject to disciplinary action up to and including termination. The Chief Information Security Officer will refer violations to university units (e.g., Student Accountability Office, Human Resources, and Deans) as appropriate. Violations may also constitute a violation of state or federal law and individuals shall be accountable as applicable.

ADDITIONAL CONTACTS

Contact	Email
Office of Cybersecurity	cybersecurity@vanderbilt.edu

HISTORY

Review Date	Summary of Changes
April 2023	Updated boilerplate language and terms