Policies

Acceptable Use - click to open or close.

Overview

As part of its educational mission, York College of Pennsylvania acquires, develops, and maintains computers, computer systems and networks. These computing resources are intended for college-related purposes, including direct and indirect support of the college’s instruction, research and service missions; college administrative functions; student and campus life activities; and the free exchange of ideas within the college community and among the college community and the wider local, national, and world communities. Appropriate use of computers and information networks includes adherence to the normal requirements of ethical and legal behavior in a college community.

Purpose

This policy is designed to outline the various responsibilities that users have with regard to their use of network resources in order to protect the College, its faculty, staff and students from electronic and legal harm resulting from improper use of Library Technology Services.

Scope

This policy applies to all users of College computing resources, whether affiliated with the college or not, and to all uses of those resources, whether on campus or from remote locations. Additional policies may govern specific computers, computer systems or networks provided or operated by specific units of the college.

Policies

Users who connect to York College’s network must abide by the acceptable use policy described here, as well as any relevant campus computing policy and all relevant State and Federal laws, regulations, and contractual obligations. The use of York College’s technology resources is a privilege, which may be revoked if users fail to comply with these policies.

Rights and Responsibilities

The rights of academic freedom and freedom of expression apply to the use of College computing resources. So too, however, do the responsibilities and limitations associated with those rights. The College supports a campus and computing environment open to the free expression of ideas, including unpopular points of view. However, the use of College computing resources, like the use of other college-provided resources and activities, is subject to the requirements of legal and ethical behavior. Thus, legitimate use of a computer, computer system or network does not extend to whatever is technically possible.

User Responsibilities

As a user of Library Technology Services resources you have the following responsibilities:

You are responsible for registering your network devices with York College’s Network Access Control system in order to maintain access to the network
You are responsible for all traffic originating from the network devices that you register regardless of whether you generate the traffic or not
You are responsible for abiding by all applicable laws set forth by Federal, State and Local governments
You are responsible for protecting your privacy
You are responsible for not violating the privacy of others
You are responsible for keeping your network devices up to date with current security patches
You are responsible for using anti-virus software and ensuring that such software is not more than 10 days out of date
You are responsible for protecting any and all sensitive data that you have access to
You are responsible for following all applicable college policies relating to your use of Library Technology Services resources

Security and Privacy

The College employs various measures to protect the security of its computing resources and its user's accounts. Users should be aware, however, that the College cannot guarantee security and confidentiality. Users should therefore engage in "safe computing" practices by establishing appropriate access restrictions for their accounts, guarding their passwords and ensuring the websites they visit use Transport Layer Security (TLS) to secure their communications.

Users should also be aware that their uses of College computing resources are not completely private. While the College does not routinely monitor individual usage of its computing resources, the normal operation and maintenance of the College's computing resources require the backup and caching of data and communications, the logging of activity, the monitoring of general usage patterns and other such activities that are necessary for the provision of service. Therefore, users of College computing resources have no reasonable expectation of privacy in what they do over the College's computer systems. The College may also specifically monitor the activity and accounts of individual users of College computing resources, including individual login sessions and the content of individual communications, without notice, when:

The user has voluntarily made them accessible to the public, as by posting to social media, web pages or other public forums;
It reasonably appears necessary to do so to protect the integrity, security, or functionality of the College or other computing resources or to protect the College from liability;
There is reasonable cause to believe that the user has violated or is violating this policy, any other York College policy, or the law;
An account appears to be engaged in unusual or unusually excessive activity; or it is otherwise required or permitted by law.
As part of the College's investigation or for other business purposes.

The College, in its discretion, may disclose the results of any such general or individual monitoring, including the contents and records of individual communications, to appropriate College personnel or law enforcement agencies and may use those results in appropriate College disciplinary proceedings.

Commercial Use

Computing resources are not to be used for personal commercial purposes or for personal financial or other gain. Further limits may be imposed upon personal use in accordance with normal supervisory procedures concerning the use of College equipment.

Network Infrastructure/Routing

Users must not attempt to implement their own network infrastructure. This includes, but is not limited to, installing basic network devices such as hubs, switches, routers, network firewalls, and wireless access points. Users must not install or create alternate methods of access to York College LTS resources such as modems and virtual private networks (VPNs). Users must not offer network infrastructure services such as DHCP and DNS. Exceptions to this policy must be coordinated with the Library Technology Services Department.

Harassment

All users must adhere to the policies set forward in the Student, Faculty, Administrator and Staff Handbooks regarding sexual and other forms of harassment. These policies apply in any format or forum including electronic.

Security Breaches

Attempts to alter system software, to bypass security protocols, to introduce viruses, worms, or other malicious or destructive programs, or otherwise “to hack” are expressly forbidden. Users should never try to circumvent login procedures on any computer system or otherwise attempt to gain access where they are not authorized. Any member of the College community, including a student, who intentionally breaches or willfully attempts to breach security, will be subject to disciplinary action, including suspension and dismissal.

Copyright Compliance

It is a violation of College policy and federal law to participate in copyright infringement. The College complies with all legal requests for information and will not hesitate to provide information about users who are engaging in copyright infringement in response to a lawful request. Copyrighted materials include, but are not limited to, computer software, audio and video recordings, photographs, electronic books, and written material. If you share movies or music that you did not create, you may be infringing on another's copyright. Consequences of copyright infringement can include disciplinary actions by the College. In addition, copyright owners or their representatives may sue persons who infringe on another's copyright in federal courts.

Enforcement

Users who violate this policy may be denied access to College computing resources and may be subject to other penalties and disciplinary action, including possible expulsion or dismissal. Alleged violations will be handled through the college disciplinary procedures applicable to the user. The College may suspend, block or restrict access to an account, independent of such procedures, when it reasonably appears necessary to do so in order to protect the integrity, security, or functionality of the College or other computing resources or to protect the College from liability. The College may also refer suspected violations of applicable law to appropriate law enforcement agencies.

Revised 6/12/2019

Digital Millennium Copyright Act (DMCA) Compliance - click to open or close.

Overview

The Digital Millennium Copyright Act amends federal copyright law to provide certain liability protections for online service providers, including York College of Pennsylvania, when their computer systems or networks carry materials that violate (infringe) copyright law. To qualify for liability protection, the College is required to have a policy under which the computer accounts of users will be terminated if they repeatedly infringe the copyrighted works of others.

Scope

Compliance with federal copyright law is expected of all students, faculty, and staff at York College. "Copyright" is legal protection for creative intellectual works, which is broadly interpreted to cover just about any expression of an idea. Text (including email and Web information), graphics, art, photographs, music, and software are examples of types of works protected by copyright. The creator of the work, or sometimes the person who hired the creator, is the initial copyright owner.

Policy

You may "use" all or part of a copyrighted work only if (a) you have the copyright owner's permission, or (b) you qualify for a legal exception (the most common exception is called "fair use"). "Use" of a work is defined for copyright purposes as copying, distributing, making derivative works, publicly displaying, or publicly performing the work. Copying, distributing, downloading, and uploading information on the Internet may infringe the copyright for that information. Even an innocent, unintentional infringement violates the law. Violations of copyright law that occur on or over the College’s networks or other computer resources may create liability for the College as well as the computer user. Accordingly, repeat infringers will have their computer account and other access privileges terminated.

Procedures

When York College receives a copyright infringement claim involving music, video, software, or other digital materials, York College takes the following steps:

York College checks network usage logs and registration information to examine the system alleged to be involved in copyright infringement and we identify the person using it;
We suspend the system’s Internet and York College network access;
We DO NOT disclose the user's identity;
We inform the user that an infringement claim has been made and ask if the user has downloaded or shared the copyrighted material in question without permission.

First-Time Offenses

If the user acknowledges using or sharing the copyrighted material without permission, York College will:

- Require the user to review information about the DMCA statute and copyright regulations;
- Require the user to attest that he or she has removed the copyrighted work and the software used to download it;
- Deny the user's system access to the York College network and Internet until the matter has been resolved;
- Inform the Office of Student Conduct of the infringement incident if the user is a student;
- Inform the appropriate senior administrator and the Human Resources department if the user is an employee or contractor and determine the appropriate disciplinary action to be taken;
- Inform the claimant that the matter has been resolved, if necessary.

If the user denies using the copyrighted material without permission, York College will:

- Require the user to submit a statement denying the copyright infringement claim;
- Inform the claimant that the claim has been denied;
- Under the DMCA, the claimant may pursue a subpoena to obtain the identity of the system user and may file a lawsuit against the user.

If the user does not meet with the LTS Help Desk to review the Acceptable Use Policy and the DMCA information within seven business days of notification, the issue will be deferred to the Office of Student Conduct.

Second Offense

If the user acknowledges a second instance of using copyrighted material without permission, York College will:

- Require the user to re-read the Acceptable Use Policy and to review information about the DMCA statute and copyright regulations;
- Require the user to attest that he or she has removed the copyrighted work and the software used to download it;
- Inform the Office of Student Conduct and discuss appropriate action to be taken if the user is a student;
- Inform the appropriate senior administrator and the Human Resources department if the user is an employee or contractor and determine the appropriate disciplinary action to be taken;
- Inform the claimant that the matter has been resolved, if necessary.

Third Offense

If the user is found to have a third instance of using copyrighted material without permission, York College will refer the matter to the Office of Student Conduct and/or the Human Resources department for additional sanctions that may include dismissal from the College.

Enforcement

Copyright violations are violations of the York College Acceptable Use Policy. Violators may be referred to the appropriate disciplinary procedure. Violations of law may also be referred for criminal or civil prosecution. York College of Pennsylvania reserves the right to terminate computing services of users who repeatedly infringe upon the rights of copyright owners. If you have questions about whether you may be infringing on another's copyright, please contact us. Willful disregard of York College’s DMCA Policy by members of the community may result in personal liability in the event that legal action is taken against them.

Revised 6/12/2019

Email Use & Retention - click to open or close.

Overview

This policy provides the rules and requirements for the secure use and management of electronic mail (email). Email is a critical communication tool used by York College of Pennsylvania. Because of its power and ease of use, misuse of college information and resources through email poses a significant risk.

Purpose

This policy is designed to outline the various responsibilities that users have with regards to their use of email in order to protect the College, its faculty, staff and students from electronic and legal harm resulting from improper use of Library Technology Services.

Scope

All email users are expected to comply with this policy. This policy applies whether email is accessed from York College networks or via any remote location. This policy covers appropriate use of any email sent from a York College email address and applies to all employees, students, vendors, and agents operating on behalf of York College of Pennsylvania.

Policy

The following lists the acceptable use and security measures that one must exercise when using York College’s email system:

- No email may be sent or forwarded through a College system or network for purposes that violate state or federal statutes or regulations or for an illegal or criminal purpose.
- When conducting College business, only a York College email account is acceptable for official College and/or business related correspondences. The use of personal email accounts to conduct College business or to represent oneself or one’s enterprises on behalf of the College is prohibited.
- Nuisance email or other online messages such as chain letters or obscene, harassing, offensive or other unwelcome messages are prohibited. Such email should be reported to the LTS Help Desk.
- Unsolicited email messages to multiple users are prohibited unless explicitly approved by the LTS Department.
- Confidential and/or sensitive information (e.g., SSN, credit card, medical records) must not be sent by email. The only acceptable ways to transmit such information electronically are to attach the information as an encrypted file or via York College’s encrypted email system. Never type confidential or sensitive information in the body of an email and never send a password or decryption key in the same email. Unless the file is encrypted, it can be read by others and therefore should not be considered private communication.
- All messages must show the genuine sender information (i.e., from where and from whom the message originated). Users are not allowed to impersonate other users or user groups, real or fabricated, by modifying email header information in an effort to deceive the recipient(s).
- Potentially damaging emails (e.g., unsolicited, mass or commercial messages; messages that appear to contain viruses) will disrupt College operations. To prevent the spread of this type of email, the College reserves the right to terminate its connection to outside host servers, as well as filter, refuse and/or discard these messages.
- Existing Retention, Disposition and Destruction Schedules apply to records created as emails. York College's email system offers no guaranteed retention of email records and York College does not archive or backup email records. Email messages that require long-term or archival retention should be retained by students and employees using currently available technology, such as the College H: drive or CD/DVD. The LTS Help Desk will assist individuals who wish to retain essential information from emails.
- In situations where litigation is reasonably anticipated, College officials should immediately inform the York College Human Resources Director, who in turn will formally notify the Library Technology Services Department to use any available administrative means to preserve relevant existing documents, data, or email.

Monitoring

York College may monitor messages without prior notice and staff members have no reasonable expectation of privacy in email received or transmitted over York College’s computer systems. The College and its email system administrators will not read email unless necessary in the course of their duties, conducting an investigation for suspected inappropriate use, or if directed by legal counsel. The College will comply with the release of emails to law enforcement if presented with an executed subpoena or court order valid in the Commonwealth of Pennsylvania.

Enforcement

Users who violate this policy may be denied access to College computing resources and may be subject to other penalties and disciplinary action, including possible expulsion or dismissal. Alleged violations will be handled through the college disciplinary procedures applicable to the user. The College may suspend, block, or restrict access to an account, independent of such procedures, when it reasonably appears necessary to do so in order to protect the integrity, security, or functionality of the College or other computing resources or to protect the College from liability. The College may also refer suspected violations of applicable law to appropriate law enforcement agencies.

Revised 6/12/2019

Employee Specific Policies - click to open or close.

Employee Policies

Includes

Account Management
Announcements
Apple Mobile Device & Request
Cell Phone Use
Email Use & Retention
LTS Acquisition
Mac Request
PCI
- YCP Payment Card
- Payment Card Security Incident Response Plan
- Application for New Payment Card Merchants
- Application for Single Use Payment Card Processing
Social Media Use
Virtual Private Network (VPN)
Voicemail

Higher Education Opportunity Act (HEOA) Compliance - click to open or close.

Overview

H.R 4137, the Higher Education Opportunity Act (HEOA), is a reauthorization of the Higher Education Act. It includes provisions that are designed to reduce the illegal uploading and downloading of copyrighted works through peer-to-peer (P2P) file sharing. These provisions include requirements that:

Institutions make an annual disclosure that informs students that the illegal distribution of copyrighted materials may subject them to criminal and civil penalties and describes the steps that institutions will take to detect and punish illegal distribution of copyrighted materials.
Institutions certify to the Secretary of Education that they have developed plans to “effectively combat” the unauthorized distribution of copyrighted material.
Institutions, “to the extent practicable,” offer alternatives to illegal file sharing.
Institutions identify procedures for periodically reviewing the effectiveness of the plans to combat the unauthorized distribution of copyrighted materials.

Purpose

This policy outlines York College’s plan to comply with these requirements.

Annual Disclosure

Consistent with our educational principles, we view education as the most important element in combating illegal sharing of copyrighted materials at York College. We use a wide variety of methods to inform our community about the law and York College’s response to copyright infringement claims:

- In order to use college computing resources, all members of the York College Community endorse an Acceptable Use Policy that includes a section on copyright compliance.
- Posters are being mounted in student computer labs and elsewhere to discourage illegal file sharing.
- Computing support staff members, including student Help Desk workers, are regularly trained on the College position with respect to copyright issues. Student workers provide an important channel for communicating with the student community.
- Language has been added to the Student Handbook outlining the Digital Millennium Copyright Act.
- The computing staff periodically briefs members of the Student Senate about copyright, illegal file sharing, and related issues.
- York College’s policies and procedures concerning the Digital Millennium Copyright Act and our response to infringement claims are published on the LTS Help site.

Plans to “Effectively Combat” the Unauthorized Distribution of Copyrighted Material

We currently employ bandwidth-shaping technology to prioritize-network traffic. We limit the amount of bandwidth available to P2P applications but we do not filter such applications since much of the traffic is legal.

The College responds to all Digital Millennium Copyright Act (DMCA) notices according to the York College DMCA Compliance Policy.

Alternative to Illegal File Sharing

Educause maintains a comprehensive list of Legal Downloading Resources – http://www.educause.edu/legalcontent. The York College community is encouraged to take advantage of these legitimate sources of digital content.

Reviewing Effectiveness

York College will survey the campus annually to assess the extent to which our anti-piracy messages are reaching individuals in the campus community, the extent to which the campus is taking advantage of legal alternatives, the impact of our technical efforts to combat illegal file sharing, and other aspects of our plans to combat the unauthorized distribution of copyrighted materials.

Reviewing the Plan

The York College Library Technology Services policies team will meet annually to review the effectiveness of the copyright plan. Overall campus awareness, technology changes and frequency of take down notices will all be taken into account in a comprehensive assessment. If the metrics suggest that modification to the plan is needed a recommendation is made for review by the policy team and other affected parties.

Revised 6/12/2019

Password - click to open or close.

Overview

Passwords are an important aspect of computer security. They are the front line of protection for user accounts. A poorly chosen password may result in the compromise of York College’s entire network. As such, all York College employees (including contractors and vendors with access to York College systems) and students are responsible for taking the appropriate steps, as outlined below, to select and secure their passwords. All use of York College accounts is assumed to be performed by the person assigned to that account. Account owners are held responsible and liable for all activities with their accounts.

Purpose

The purpose of this policy is to establish a standard for creation of strong passwords, the protection of those passwords, frequency of change, and resetting of passwords on York College systems.

Scope

The scope of this policy includes all personnel who have or are responsible for an account (or any form of access that supports or requires a password) on any system that resides at any York College facility, has access to the York College network, or stores any non-public York College information.

Policies

- All user-level passwords (e.g., email, web, desktop computer, etc.) must be changed at least every 180 days. The recommended change interval is every 90 days.
- Passwords must not be inserted into email messages or other forms of electronic communication.
- Initial passwords are to be set to a unique value per user. Initial password shall only be valid until the first successful user authentication and must be changed by the user after first use.
- Initial, pre-designated passwords are valid only until the first successful user authentication into an account. The user must choose their own passwords based upon the following standards and guidelines.
- All passwords are to be at least eight (8) characters in length.
- Group and shared passwords are explicitly prohibited at York College
- Password complexity will be set to require at least three out of the four types of characters:
  - Uppercase letters
  - Lowercase letters
  - Numbers
  - Special characters (i.e. !, @, #, $, %, ^, &, *, etc.)
- All system-level passwords (e.g., root, enable, admin, application administration accounts, etc.) must be a minimum of 10 characters and conform to the complexity requirements above.
- Password parameters will be set to require that new passwords cannot be the same as the four previously used passwords.
- Passwords must NOT contain your username in any form
- Accounts will be locked out after 10 failed login attempts and will remain locked for up to 15 minutes

Password Reset

System and session idle timeout feature will be set on all systems to time out after being idle for 15 minutes. If you have forgotten your password and you are a faculty member or student, you can use the "Forgot password" link available on the front page of the MyYCP portal. You will be required to enter your YCP username and ID number and already have registered a cell phone number and/or personal email address to receive your temporary password. If you are unable to receive the temporary password or you are an administrator or staff member, you will need to contact us and we will further assist you in resetting your password.

General Password Construction Guidelines

York College uses Single Sign-On (SSO) technology to enable students and employees to use one username and password combination to access multiple systems and applications, such as MyYCP, YCPWeb, G Suite, and Moodle. Although SSO makes accessing York College systems more convenient, it also places greater importance on selecting a strong password that is difficult to guess. Students and employees are strictly prohibited from sharing their YCP password with anyone for any reason.

Strong passwords have the following characteristics:

- Contain both upper and lower case characters (e.g., a-z, A-Z) as well as numbers
- Are at least seven alphanumeric characters long and is a passphrase (Ohmy1stubbedmyt0e).
- Do not contain words found in a dictionary or other commonly used slang words in any form including backwards
- Do not contain trivial letter or number patterns such as aaabbb, qwerty, 12345678, 123321, etc.
- Are not based on personal information such as birth dates, addresses, phone numbers, or names of family members, pets, friends, or co-workers
- Passwords should be hard to guess but easily remembered. One way to do this is create a password based on a song title, affirmation, or other phrase. For example, the phrase might be: "This May Be One Way To Remember" and the password could be: "TmB1w2R!" or "Tmb1W>r~" or some other variation.

NOTE: Do not use any of these examples as passwords!

Password Protection Standards

Do not use the same password for York College accounts as for other non-York College access (e.g., personal bank account, option trading, benefits, etc.). Do not share York College passwords with ANYONE, including family members, co-workers, administrative assistants or supervisors. Passwords must never be sent in an email or instant message. Do not use the "Remember Password" feature of applications (e.g., Firefox, Chrome, Instant Messenger). Passwords must never be written down or stored in a file on any computing device (including laptops, smart phones, tablets or similar devices) without using encryption. All passwords are to be treated as sensitive, confidential York College information.

The York College LTS Department will NEVER ask you to reveal your password at any time. If you are asked to reveal your password via telephone, email, or in person by anyone claiming to be a York College official or LTS Department staff member, do not respond. Report the incident immediately to us.

If an account or password is suspected to have been compromised, report the incident to the LTS Help Desk and change all passwords.

Enforcement

Revised 6/12/2019

Personal Computer Connectivity - click to open or close.

Overview

The Personal Computer Connectivity (PCC) policy describes the services LTS Help Desk technicians can provide for students, faculty, and staff belonging to the York College of Pennsylvania community.

Purpose

The LTS Help Desk technicians are a limited resource that should stay focused on the assets of York College. The primary purpose of the PCC team is to safely connect personal computing devices to the York College network.

Scope

This policy applies to non-college owned personal computing devices such as computers, laptops, peripherals, tablets, PDA devices, and smart phones belonging to the York College of Pennsylvania faculty, staff, and students. Personal device problems capable of being troubleshooted include: connectivity issues; eradication of spyware, adware, and virus infections; critical system file and software updates; any other issues approved by an LTS Help Desk Administrator.

Enforcement

No LTS Help Desk technician will accept or work on any non-college owned personal computing device prior to receiving the signed Personal Computer Connectivity Liability Waiver.

Policy

Faculty, staff, and students belonging to the York College community may contact us for first-tier troubleshooting and diagnosis.
All personal device owners must grant the LTS Help desk permission to work on their personal computing devices by submitting a form stating their acknowledgement and understanding of the PCC Policy.
LTS Help Desk technicians will not accept or agree to work on any personal device prior to having the device owner acknowledge and sign the Personal Computer Connectivity Liability Waiver.
LTS Help Desk technicians will not agree to work on any personal computing device prior to completing PCC Training and Orientation.
LTS Help Desk technicians will attempt to safely connect personal computing devices to the York College network. While attempting to connect the device, the following issues may also be troubleshooted:
- Eradicate spyware, adware, and virus infections
- Update critical system files and other software
The LTS Help Desk cannot order, provide, or accept replacement parts for personal devices.
The LTS Help Desk cannot backup or recover data with the exception of extreme cases relating to academic work as deemed necessary by an LTS Help Desk Administrator.
Personal devices must stay within the presence of the device owner at all times unless otherwise approved by a LTS Help Desk administrator.
Any device approved for Long-term PCC support by an LTS Help Desk Administrator, must accompany the Long-term PCC form.
Issues beyond the scope of the personal device support services may only worked on by a LTS Help Desk member following the approval of a IT Help Desk Administrator.
The LTS Help Desk does not support personal printers or scanners.
LTS Help Desk technicians will not be sent to faculty, staff, or student homes. Dorm room visits may be scheduled for students experiencing connectivity issues with their desktop devices.
Issues beyond the scope of personal device support services may result in referring the device owner to an outside source or vendor.