Faculty of Natural and Agricultural Sciences IT POLICIES & SERVICE CATALOGUE

Transcription

1 Faculty of Natural and Agricultural Sciences IT POLICIES & SERVICE CATALOGUE

2 Contents Section 1 Support Parameters... 3 Section 2 Supported Platforms... 4 Section 4 Computer Specific Services... 5 Section 4 Computer Specific Services... 6 Policies... 8 Minimum Standards... 8 Operating Systems... 8 Hardware... 9 Supported Applications... 9 Supported Office Software... 9 Supported Clients... 9 Supported Browsers... 9 Other Supported Software... 9 Supported PDA/Smartphone Devices... 9 Other defined standards - Network Transport... 9 Standard Operating Environment (SOE) SOE Platform SOE Policy FNAS Security Policy Roles and Responsibilities Security fundamentals Compliance with other Laws and Policies... 17

3 Section 1 Support Parameters Service Item Availability Supported Sites Tier 1 and 2 support (Helpdesk and desktop support) Tier 1 support only (Helpdesk assistance) Current FNAS staff, visitors and students on the UWA Crawley campus, QEII and Shenton Park Field Station Current FNAS staff, visitors and students at other research sites Information / Advice Supported times Service Levels - All FNAS provided services (unless covered by a negotiated SLA) Current FNAS staff, visitors and students in any location Available 8:30am to 5:00pm, Monday to Friday except on University Holidays Systems on which services are based are available 24hrs/day, 7 days/week, 365 day/year, 95% of the time (4% scheduled and 1% unscheduled downtime) Notification of extended outages for system for maintenance will be provided via to schools and centres for distribution internally. Standard response times and systems availability defined herein excludes support based on third party vendors Service Response Communication parameters Service responses are outlined in the Prioritisation and Categorisation page of the Policies document Job progress will be notified through the service desk only, with notifications sent only to the person's official UWA address

4 Section 2 Supported Platforms Service Item Availability Hardware Supported See Policies: Minimum Standards - Hardware Operating Systems Supported See Policies: Minimum Standards - Operating System Supported Office Software Supported Clients Supported Browsers See Policies: Supported Applications - Office Suites See Policies: Supported Applications - Clients See Policies: Supported Applications - Browsers Other software support Any software required for the undertaking of the business of the University will receive all reasonable support efforts. PDA devices supported See Policies: Supported Devices - PDA/Smartphone

5 Section 4 Computer Specific Services Service Item Informational Services Provide Work Related IT Advice Provide advice on peripherals / accessories (external devices - scanners, backup drives, etc) Provide advice/estimates on costs of IT Solutions for Business Units/Individuals Procurement Services Assist with choice of IT Equipment or Solutions Provide advice on selection of computer from available SOE models Provide quotations for SOE Computer equipment Provide recommendations for/against non SOE requests Authentication Services Provide authenticated access to FNAS network (user listed / active in Pheme) Provide authenticated access to FNAS network (user not listed / active in Pheme) Provide Generic/shared login to FNAS network Arrange temporary short-term access to internet services via SNAP (where no UWA record yet exists) Arrange temporary short-term access to FNAS Network (where no UWA record yet exists) Equipment Provision Services Provision of computer equipment, cables, peripherals Availability All staff and students All staff and students All staff and students All staff and students All staff and students All staff and students through School / Centre managers YES NO NO YES e.g. conferences, visitors < 2 weeks NO Business unit responsibility Where available Short term loan of equipment through service desk request Security Services Provide and configure boundary firewall to FNAS Network YES Subnets Firewall configuration for standard required services YES Firewall configuration for individual/unique requirements Reasonable Effort Provide secure domain based authentication YES Provide security groups for authenticated access to domain YES resources Install and maintain UWA Licensed Anti-Virus Application UWA Owned Machines Disable unused user and computer accounts (>90 days) YES Additional Service Provision Where any additional service is required beyond those on offer and funded by the Faculty, these must be discussed and negotiated with IT. All services will be scoped and costed, where appropriate Service Level Agreements implemented and any costs must be fully met by the project budget of the initiating area.

6 Section 4 Computer Specific Services Service Item Where computers meet minimum standards Availability UWA owned Faculty standard / SOE Computer Permitted/Approved Non-SOE Computer Non-SOE computer purchased without approval Undergraduate Lab Computer Deployment Services SOE Development and Update YES NO NO YES NO SOE Image deployment YES NO NO YES NO Manual Operating system NO YES NO NO NO installation and configuration Upgrade or install newer SOE to NO NO NO NO NO previously deployed machine (OS upgrade) Configure machine to an operational YES YES NO YES NO standard for Faculty Network Maintain Operating Environment and YES assist/advise NO YES NO Security Patches Operating System Reimaging and/or YES YES NO YES NO Recovery Configure Preferred Network YES reasonable effort NO YES NO Printers Deliver / Deploy machine to users As required As required NO YES NO desk Data Services Migrate data from old to new YES reasonable effort NO N/A NO machine Data conversion (eg mail / documents) to supported format reasonable effort reasonable effort NO N/A NO Data Recovery from failed computer/drive Desktop Services Provide Tier 1 Contact and Service Desk Support reasonable effort reasonable effort NO reasonable effort YES YES NO YES YES Non-UWA owned Personal / External / Visitor Computers Provide Tier 2 Desktop Support YES YES NO YES YES General Troubleshooting and fault YES YES NO YES YES diagnosis / repair Minor upgrades, excluding required YES YES NO YES NO parts, where Warranty will not be affected. Hardware repairs NO NO NO NO NO Arrange Warranty repairs with assist/advise assist/advise NO YES NO vendor Virus/Malware/Threat removal (isolate/reimage/reinstall where YES YES isolate and advise YES isolate and advise necessary) Software Services (For UWA business and where licenses permit this use) Software Installation (valid UWA YES YES NO YES NO Software Licenses - ITS Software) Software Installation (Business Unit YES YES NO YES NO Purchased valid license) Software Installation (other valid YES YES NO YES NO licenses) Software Installation (personal or NO NO NO As license NO non UWA purchase) permits Software metering/reporting (FNAS YES where supported NO YES NO Domain Clients only) Software Asset Management NO NO NO YES NO Authentication and Access Services NO

7 Provide authenticated access to YES where supported NO YES NO faculty network Provide / configure access to FNAS YES reasonable effort NO YES instruct/assist services and resources (eg printers, shares, hosted services) Provide Access to University YES YES NO YES instruct/assist Network Provide Access to the wider Internet YES YES NO via UWA Proxy instruct/assist Provide authenticated access to YES reasonable effort NO YES YES permitted Faculty/School shares/resources Configuration Services Configure access to FNAS network YES reasonable effort NO YES NO Configure access to University YES YES NO via web YES Services (using supported mail client) Configure access to University YES NO NO NO NO Business Systems Configure access to University YES reasonable effort if NO YES NO Teaching Systems supported Configure access to wider internet YES YES NO YES Via SNAP Configure access to shared resources (printers/shares) YES reasonable effort if supported NO YES instruct/assist only Network Services (Where FNAS network is reticulated) Provide connection to faculty YES YES NO YES YES network infrastructure (does not imply network access) Provide network switching and YES YES NO YES YES infrastructure to the data socket (100Mb/s) Provide network switching and NO NO NO NO NO infrastructure to the data socket ( > 100Mb/s) Provide network cabling from the NO NO NO YES NO data socket to the computer Support connections made through NO NO NO NO NO network equipment not provided by FNAS Peripheral Equipment Services Configuration of necessary work related peripherals YES YES reasonable effort Troubleshoot connections/installation/function of necessary work related peripherals Configuration/support of Wireless Keyboards and Mice Configure Single-User and nonstandard Printers Provide access to supported network and workgroup printers Configure supported network and workgroup printers Assist with peripheral devices purchased against recommendation Assist with peripheral devices used against policy or advice reasonable effort reasonable effort NO NO NO NO NO reasonable effort reasonable reasonable effort NO NO NO effort YES reasonable effort NO YES Via IPS YES reasonable effort Via IPS NO NO NO NO NO NO NO NO NO NO Reasonable effort is determined by the FNAS IT team. It ensures a fair time allocation to an issue for the affected user and all other users of the IT Support Services, but does not necessarily ensure a resolution. If after an assessment of the issue the IT team is unable to resolve, they may refer the client to warranty or external services, or may determine that the issue cannot be resolved. In these circumstances, the client should seek alternatives to the service or device in question.

8 Policies Minimum Standards The Minimum Standards policy was passed by the Faculty Resources Committee in August 2003, on the recommendation of the Faculty Information Services Committee. The policy was last reviewed at the Faculty Information Services Committee meeting, July The minimum standards policy determines at what level IT support are required to continue to support or otherwise engage with a computer resource, and at what level a computer system meets current network and security requirements. Operating Systems Under the current policy revision for the minimum standard for supported operating systems on the network, it was deterimed that: 1. Windows XP Professional be the minimum operating system version for PCs attached to the network as of August 1st Windows 2000 systems may remain connected but are unsupported. Windows NT, ME, 95 and 98 machines are expressly forbidden access to the network or any form of support. 2. OSX 10.4 be the minimum operating system for Macintosh computers as of August 1st OSX 10.3 systems may remain connected but are unsupported. OSX 10.2 and below, OS9, OS8 and earlier versions are expressly forbidden access to the network or any form of support. 3. Computer officers are to be closely consulted about the purchase and installation and maintenance of Linux computers to ensure that they are installed on the network in such a way that minimises security vulnerability for this operating system. 4. All computers to be subject to a log-in process (ie user authentication) against a domain controller from January 1, Support of computers below the specified standards is strictly limited to reasonable efforts to recover data. The computers will not be returned to the network. 6. Where computers are connected to research equipment, and that equipment requires a specific computer or operating system, IT support staff will provide their best efforts to maintain or repair those computers. Network access is not provided if these systems fall below required standards.

9 Hardware Under the current policy revision for the minimum standard for computer hardware, it was determined that: 1. It is no longer feasible for IT staff to provide repairs, upgrades or support to PC computer hardware earlier than the Socket LGA 775, Intel 915 Series Pentium 4 Chipset. 2. It is no longer feasible for IT staff to provide repairs, upgrades or support to any Macintosh computer using PowerPC (pre-intel) architecture. 3. Even at these levels, access to parts, replacements and other necessary resources is not always possible and repairs are rarely feasible. In these cases, support will be limited to reasonable efforts at data recovery and transfer to a supported system. Supported Applications Defined in accordance with the Minimum Standards Policy is a list of common applications supported by FNAS IT. Where defined, support is limited to only the versions listed. Use of other applications or versions is not advised and by doing so the user takes responsibility for all support, format conversion and problem resolution. In all cases, applications are supported only where used for conducting the business of the University. Supported Office Software Microsoft Office 2003, 2007 for PC and Office 2004 and 2008 for Mac Supported Clients Outlook 2003, Outlook 2007, Entourage 2004, Entourage 2008 and native client support on Windows Mobile and iphone devices for ECS mail only Supported Browsers Internet Explorer 7, Internet Explorer 8, Safari Other Supported Software Any software required for the undertaking of the business of the University will recieve all reasonable support efforts. Supported PDA/Smartphone Devices As described in the supported client section above, Windows Mobile 6.x and Apple iphone devices are supported, and assistance will be given for the purposes of connecting to ECS mail only. Other defined standards - Network Transport The single supported network transport for all platforms will be TCP/IP over an Ethernet network.

10 Standard Operating Environment (SOE) After a long consultative process with all sections of the faculty, a Standard Operating Environment was adopted as policy by the Faculty Resource Committee and Endorsed by the IT Policy Committee in November This SOE was designed to best reflect the diverse range of needs within the Faculty, and permits a solid and secure platform on which to progress IT in to the future. FNAS has chosen to base its SOE hardware specification around the Hewlett Packard Business Desktop and Notebook computers available to the University under the UWA Preferred Supplier Agreement. It is a requirement that all computers purchased for use on the FNAS network are selected only from the models available under this agreement. IT staff can advise which system will best meet the needs of staff and students, depending on their application requirements. The models available under the SOE are shown on the hardware specification page. The models listed below are currently available under the agreement. FNAS IT will develop, update and maintain a base software SOE for this hardware platform which will form a stable, secure and functional Faculty IT environment. SOE Platform Hardware Platform DESKTOP - Must be a Hewlett Packard DC8000 Series Business Workstation from the preferred supplier, Synergy. Optional: All other components - to suit performance and budget requirements. Includes Processor, RAM, Hard Disk Drives, wired (not wireless) keyboard and Mouse, Monitor, DVD Drive, Choice of Convertible Mini Tower/Desktop or Small Form Factor Desktop. LAPTOP - Must be one of the Hewlett Packard 6730B 15.4" notebook or 2930P 12" Ultra Portable notebook range, or a 8440P 14" Notebook for Performance and Portability. Note - Netbooks are available for field work and travel without approval, however these are not adequate to perform day-to-day work and will not be connected to the FNAS network / domain. They can be configured by the user for SNAP or UWA Wireless, and are not generally supported by FNAS IT. Operating System - Must be purchased with Microsoft Windows, typically Vista Business Edition. Computers can no longer be downgraded from Vista to XP Pro If a computer is purchased with XP or Vista Home Edition, it must be upgraded to at least Windows XP Professional or Vista Business before the system can be used on the Faculty network. For University owned computers this can be done under the MS Campus Agreement, otherwise this upgrade is at the buyer's expense.

11 Base Software Installation Faculty IT will assemble a common base platform on which a user can tailor a system. This platform will be configured to make the most of the new Faculty wide network, and will be applied to all new computers. The Base SOE will be as follows: Windows 7 Enterprise Edition with security updates Office 2007 Professional (Word, Excel, Outlook, Powerpoint, Access) with service packs Internet Explorer 8 configured to use UWA proxy server Adobe Acrobat Reader Sophos Antivirus (push install) CutePDF (open source pdf file creator) Endnote (link to installation source only) IrfanView (Freeware image viewing software) Services Automatic Windows Update via FNAS Windows Software Update Service Support Mechanisms Terminal Services Client Remote Assistance Client Documentation Links to setup instructions Links to downloadable forms Links to University Policy documentation Configuration Preset links to relevant resources - (printers, file shares) Current SOE System - Desktop Desktop Basic Configuration HP DC8000 Series Business Workstation (Any of six UWA Configurations) 1 x 4GbMb DDR3 Memory Modules (Additional 4Gb or greater is optional) Intel Core 2 Duo CPU 160 or 250Gb Hard Disk Drive DVD R/W Drive Wired Keyboard and Optical Mouse (wireless keyboards and mice are not supported or maintained by FNAS IT) Windows Vista (upgraded under the MS Campus agreement to Windows 7) Other Components 20" or above LCD Flat Panel Display, Widescreen 22" recommended.

12 Current SOE Systems - Laptop A Hewlett Packard 6730B 15.4" notebook, 2930P 12" Ultra Portable notebook, or a 8440P 14" for balanced Performance/Portability. Other Components Kensington Security Cable Laptop bag Docking Station External Monitor (20" or above Widescreen matching laptop native resolution) Network Cable Additional wired Keyboard / Mouse (wireless keyboards and mice are not supported or maintained by FNAS IT) External USB HDD backup system (used regularly and stored away from the laptop) Other Configurations / Models The models listed above are very well suited to the core needs of most UWA staff and students and are generally the only models which will be configured, connected and supported by the facutly IT team. In cases where there is a specific research requirement for a different configuration, and it can be demonstrated that the SOE model is not able to perform the required task, an application for a non-soe machine may be made through your school manager to Faculty IT for a non SOE purchase. See the SOE Policy page for more information. For more information or to address specific requirements, contact a Faculty IT staff member in your area.

13 SOE Policy Summary of the FNAS SOE Faculty I.T. will develop and maintain a common base SOE around a single standard hardware platform. All new computers and laptops are purchased with one of the configurations detailed on a computer purchasing web page maintained by computer support Other software requirements installed as required, with remote push deployment being the preferred delivery method. All machines purchased through a University preferred supplier In the case of requirements outside of the allowed specification, a case for justifying such a purchase be made by the School Manager to the IT Manager for consideration. Schools and centres remain responsible for purchasing and for software licensing. Benefits Extremely stable, robust and reliable hardware platform Unified architecture Excellent integration and compatibility with university projects and application delivery Economies of scale derived through use of University approved vendors Selection of configurations available to suit budget and performance requirements Aligned with best practice deployment techniques Systems chosen from a single Tier 1 vendor and from their stable platform range Confluence with a known vendor hardware roadmap, giving guaranteed platform stability and therefore absolute image compatibility for the life of the product allowing planned transition to new models. Aim of automating setup out of the box from the vendor to allow user to become productive sooner Achieves a vastly more manageable, secure and upgradeable platform Achieves a single vendor SOE solution in a price competitive multi vendor preferred supplier environment Provides much improved document and compatibility Provides known hardware support and ensures delivery and warranty under SLA Efficient delivery of IT support to the user through: Excellent specific hardware and installation knowledge Known stable base SOE software image Improved fault finding ability Improved delivery under SLA from vendor Reduced time from delivery to end-user's desk Improved service and warranty under SLA from vendor

14 Purchases outside the SOE In order to purchase a computer outside of the SOE, an end user must present a case to their School or Centre Manager and to the Faculty IT Manager. As there is a recognised significant additional cost to individually configure and support these non-soe systems, the case presented must explain the reasons that the non-soe system is a requirement explain why the SOE model is not capable of the required tasks It must be stressed that approval for non-soe equipment is not given without an absolute requirement, or where a significant existing hardware or software investment exists, and licenses are not transferrable to the SOE platform. Personal preference for a brand or platform is not sufficient justification to purchase outside the SOE. For approval to be granted, the end-user must acknowledge that they are choosing to purchase an unsupported platform, and that services as simple as printing and file-sharing, local services and access to corporate applications are not guaranteed and that there is no requirement on FNAS IT to work to provide these services. FNAS IT are not responsible for document compatibility or conversion on the non-soe platform. The end-user also takes on the responsibility of securing and updating their system, and agrees to perform software installations and make any configuration changes required at the request of FNAS IT. If agreed, and approval is granted, the system will be recorded as a supported, non-soe machine. Should a purchase be made which does not comply with the SOE specification and which has not been approved for purchase and support, it will not be supported or given access to the faculty network. It may be used as a stand-alone, non-networked machine or may be provided access only through SNAP. SNAP access is authenticated and charged against a cyllene or student account, and gives no access to printers, services or servers on the FNAS network. It would allow user access to the web and mail, but effectively isolates the system and maintains the security of the local network.

15 FNAS Security Policy Introduction FNAS is committed to providing a secure yet accessible network which provides for the needs of our teaching, research, management and outreach objectives. It is our aim to protect and maintain the confidentiality and integrity of all information required to pursue the ongoing interests of the faculty and its partners. Policy It is the responsibility of each staff member, student and visitor to the faculty to ensure the data sources in their care are not compromised, and that their level of protection is not diminished. These data sources include but are not limited to the computers, laptops, networks, software, mobile and data storage devices that each individual may use in pursuing the day to day business of the faculty, independent of their location or ownership. Protection of these devices includes physical protection against loss, theft, damage or abuse data security practises against malicious or unintentional access system maintenance and updates, for protection from known threats and compromises Roles and Responsibilities Responsibilities are not diminished through role. In situations where more than one individual or area may have access to or control of a data source or device, no individual is absolved of any level of responsibility for the security of that device or data source as a result. The range of responsibility for any one individual will vary based on their role, from simple password and physical protection to more complete oversight of overall security. Below is a typical outline of responsibilities based on role. Business Unit and Project Managers identify all data sources relating to their role identify and maintain functional access and security to these data sources for role participants in considering functional access, assess the risk of data loss or malicious or inadvertent alteration of data against the following criteria o policy or law governing the use or distribution of the data o the significance of the data to the continuing operation of the business unit or project o the value of reputation and perception, and to attracting ongoing and future projects o the value of the data to any project contributor or sponsor

16 o the likelihood that the data could benefit; or be used against; other entities o the costs involved in recreating or recovering data loss ensure that in all cases where information from these sources is use or communicated outside the business unit or project, that this communication is legitimate, and does not compromise the security or property of the faculty develop principals and practices governing required changes to security access Users identify all data sources relating to their role request only required levels of access to this data protect data resources in their control from theft and any unauthorised access ensure passwords and other access technologies are never shared maintain systems and system security through routine managed system updates maintain system sanctity and security by only installing software and accessing systems and sites approved for and relevant to the role Information Technology Staff provide the highest possible level of security which does not hinder the functional requirements of the faculty provide users with the systems and practices necessary to implement security maintain system and security updates for critical network infrastructure monitor security practises on data sources throughout the faculty assist users with security issues and advise on practises wherever possible, alleviate the burden on users by providing systems which automate their security processes analyse any potential threat to systems security and implement security measures that mitigate threats ensure that privileged accounts are held by a minimum number of staff and are governed by principals of acceptable use establish appropriate use for the resources under their control Security fundamentals Data Security All systems must be subject to authentication, and access must be commensurate with the value of the systems and data sources and the level of risk identified against a breach of authorised access to these sources. Authentication methods to faculty resources, including passwords and keys, must never be shared or used by more than one individual System and software patches must be maintained to minimise the risk of unauthorised access

17 Every system when compromised puts at risk or increases the risk of access to all other systems. Physical Security Adequate control of physical access to data resources and providers must be maintained, and must be commensurate with the value of the systems and data sources and the level of risk identified against a breach of authorised access to these sources. Suitable measures must be employed to protect against unauthorised physical access to resources, ranging in scope from rooms with restricted access, to cable locking of easily moved equipment. Where an item is used in more than one location, no single location should have less than an adequate level of physical protection. Compliance with other Laws and Policies Where a business unit or individual engages with another area external to the faculty, there must be no dissolution of this policy in favour of other practises, except where other practises, policies or laws enhance the requirements set out in this policy, in which case they must be additionally adopted. All Faculty employees, visitors and students are bound by this policy, and by relevant policies adopted by the University with regard to data resources and systems, the laws of Western Australia and Australia, and relevant international laws governing the use of data obtained and / or stored. The following activities are specifically prohibited under this Policy: interfering with, destroying or disrupting data, data sources or data systems intentionally transmitting any computer viruses, worms, or other malicious software intentionally installing and using software which may put data security at risk attempting to access, accessing, or exploiting resources you are not authorized to access knowingly enabling or exploiting inappropriate levels of access storing sensitive or confidential data on systems that are not adequately protected against unauthorized access disclosing or distributing any data you do not have a right to issue In addition to possible legal action, any violation of this Policy may be pursued and disciplinary action initiated through relevant University Statutes.