Text · page 5 of 16
How Does an Acceptable Use Policy Protect IT Assets? The AUP and corresponding regulations state that computers are issued for school-related purposes and that personal use should be incidental and not interfere with employees’ job duties and performance, must not violate any rules established by the AUP and must not damage hardware, software or communications systems. The regulations prohibit the use of Internet games, web chats, unauthorized software and instant messaging. They define unacceptable use to include illegal or malicious use, use that disrupts the work of others, use for private business purposes and downloading music, games and other material. Incidental personal email use is allowed, but must not interfere with job performance. Excessive personal use could result in disciplinary action. The AUP establishes the District’s right to monitor, review and audit each employee’s computer and Internet use. Therefore, employees should not expect privacy when using the system. Upon employment, employees are given a copy of the AUP and are required to sign a computer use agreement. Some District Computers Were Used for Personal Activities We found evidence that some employees did not comply with the AUP. We reviewed the web history on 15 computers3 and found significant personal Internet use on four computers.4 This included personal shopping and banking, web searches for non-District related subjects, social media use and personal email use. All four employees’ job duties included routinely accessing PPSI. As a result, their personal Internet use unnecessarily exposed this information to possibly being compromised. District officials were unaware of this personal computer use because they did not routinely monitor employee Internet use for AUP compliance. In addition, the Director told us he was not concerned with employees accessing personal email on District computers or its network because he thought the District’s email filtering system and firewalls would catch any phishing schemes. However, the email filtering system would only prevent phishing emails from being sent through the District’s email system. It would not prevent phishing emails from being sent to employees’ personal email accounts and being opened while using 3 Refer to Appendix C for further information on our sample selection. We were unable to examine Internet use on one of the 15 computers (the Director’s) because he had cleared his web browsing history to access a webinar that was held the day that we scanned the computer. 4 The four computers were assigned to the Assistant Superintendent for Administration and Finance, Human Resources Manager, payroll clerk and Athletic Director. Of f ic e of t he New York State Comptroller 3