Information Technology (IT) is one of the most important requisites of any organization. Information technology provides support and new directions to the institute’s operations. Nowadays, Internet is a complex environment consisting of interactions between people, software and services, supported by worldwide distribution of information and communication technology (ICT) devices and networks.

IACS Computing Facilities constitute all facilities related to numerical and symbolic computations and communications and network access and not limited to, e-mail and Internet access. The Centre for Computer Research, Education and Services (CCRES) provides support in networking and information resources for its computing community. The Computer Centre undertakes security and monitoring measures to preserve the integrity and performance of its networking and computing resources.

Use of any IACS technology resource can be made by authorized persons as long as this usage is in compliance with Institute policies and all local, state and central Government laws governing telecommunication. Failure to comply may result in the closure of an account, with further discretionary action taken by the Director of the Institute, if necessary.

In order to protect the integrity of the IACS computer and communications network and its systems, any proof of unauthorized or illegal use of any IACS network device and/or computer and/or its accounts can warrant an investigation. Users may voluntarily cooperate with the Computer Centre staff in such investigations. If necessary, User's files, accounts and/or systems will be investigated only by a person, persons or a committee designated for each case separately as directed by the competent authority.

The following IT security policy lays out the rules regarding how IACS IT resources can be used. The policy will define acceptable and unacceptable behaviors, guidelines, access controls, and potential consequences for breaking rules.

The following items describe general policies for usage and administration of IACS's computing facilities.

Users : Users of IACS computing facilities are to be limited primarily to IACS's academic and other staff, students and visitors for purposes that conform to the requirements of the item above.

1.  Policy and Guidelines on the Use of IT Resources ( as per MeitY-F. No. 2(22)/2013-EG-IIandamendments/modificationthereofffromtimetotime)-This policy governs the usage of IT Resources from an end user’s perspective.

2.  E-mail Policy (as per MeitY-F.No.2(22)/2013-EG-II and amendments/ modification thereofffromtimetotime)-https://www.meity.gov.in/content/email-policy –This governs the usage of email services provided to IACS users. When a new user creates a new E-mail ID of IACS, then they are advised via the Email creation form to “please change your password periodically and never reveal your login details to anyone.”

3.  PasswordPolicy-https://www.meity.gov.in/writereaddata/files/Password_Policy_1.pdf –The purpose of this policy is to establish a standard for creation of strong passwords, the protection of those passwords, and the frequency of change of passwords.

4.  Policy on Adoption of Open Source Software (as per MeitY- F. No. 1(3)/2014 – EG II and amendments/modificationthereofffromtimetotime)

This will encourage the formal adoption and use of Open Source Software (OSS) in IACS.

5.  Backup Policy for Servers – Periodic Backups are taken for network equipment’s like Core Switches, Firewalls, Routers, Email Gateway Servers, Wireless Controller, Active Directory Server (automatic daily update), Mail Server (automatic daily update), Web Server (automatic daily update), EDUROAM Server, DNS Server, Proxy Servers and all the network switches installed in different locations throughout the IACS Campus.

6.  DC (Data Center) Requirements-IACS Computer Centre has its own dedicated Data Center and all network equipment’s are hosted as on-premises infrastructure.

7.  Document Digitization

At IACS, we digitize all the official documents like-Accounts, Medical, Personal Files, Office Memorandum, Annual Reports, and Fixed Assets along with all old documents up to last 15 years. All the digitized files are accessed through the Document management system IACS.

8.   Biometric attendance is recorded using two ways-Fingerprint recognition and Face recognition and recording of biometric attendance is mandatory for all IACS users. The biometric devices are installed in Main Raman Gate, Entrance of Main building, Entrance of Centenary Building, Entrance of CRAFT building.

9.   Centralized Inventory for IT Assets: Centralized inventory of IT assets is maintained.

10. Online Tracking of all kinds of documents is done using Dispatch Docketing System.

11. CCTV Surveillance- CCTV camera is installed in different locations throughout the campus like in Main Raman Gate which is used for both Entry and Exit of employees, Canteen, Corridors, Data Centers and all other open places of IACS. CCTV Footage is stored in the CCTV Storage Server for 90 days. Footage may be accessed with prior approval of the Competent Authority only.

12. Access to Internet and Intranet- IACS network can be accessed only through Proxy authentication. Users should not undertake any activity through any website or applications to bypass filtering / Policy / Firewall of the network or perform any other unlawful acts which may affect the network’s performance or security. Users are not allowed to change the NIC configuration, IP address or any other parameters set for accessing organization LAN without permission of implementing authority.

It is the responsibility of the user to ensure that the client system is free from any Virus/Malware/Potential threat software’s/pirated copy of software’s before connecting to organization’s network.

Misuse

Any usage which contravenes local, state and central government laws or violates norms of IACS usage will be treated as misuse. Two specific categories of misuse are listed below. All listed actions and others which effectively amount to the same are considered as misuse of IACS computing, communications and network facility.

Misuse involving or amounting to attack on any devices, systems and/or networks

• Using the network to gain unauthorized access to any computer system.
  Tapping phone or network transmissions (e.g. running network sniffers without authorization).
• Knowingly performing an act which will interfere with the normal operation of computers, terminals, peripherals or networks.
• Knowingly running, installing and/or giving to another user a program intended to damage or place excessive load on a computer system, network device or network. This includes, but is not limited to, programs known as computer viruses, Trojan horses and worms.
• Attempting to circumvent data protection schemes or uncover security loopholes.
  Masking the identity of an account or machine.
• Releasing a virus, worm or other program that damages or otherwise harms a device, system or network Using IACS resources for unauthorized purposes (e.g. using personal computers connected to the campus network to set up web servers for commercial or illegal purposes).
• Unauthorized access to data or files even if they are not securely protected (e.g. breaking into a system by taking advantage of security holes, or defacing someone else's web page)

Other categories of misuse

1. Using an account that the user is not authorized to use, or obtaining a password for a computer account without the consent of the account owner.
2. Providing any assistance to any person to facilitate unauthorized access to one or more files, accounts, computers, network devices or network segments.
3. Deliberately wasting computing resources.
4. Attempting to monitor or tamper with another user's electronic communications, or reading, copying, changing or deleting another user's files or software without explicit agreement of the owner.
5. Preventing others from accessing services.
6. Use of services and facilities other than academic and official purposes. Sending forged messages under someone else's name.
7. Employing a false identity for e-mail or other purposes.
8. Using email to harass others.
9. Charging the services availed of by a person.

Infractions

The following actions will be taken in case of infractions of the IACS policies:

• All cases of infractions of this policy and misuse of IACS computing, communications and network resources will be logged and a written record will be kept with the Computer Centre. Such reports can be used to take further action if necessary.
• Minor infractions of this policy or those that appear accidental in nature will be typically handled by email or in-person discussions. If an infraction has been judged to be accidental, a note to this effect must be made in the log with the Computer Centre.
• More serious infractions will be handled via formal procedures.
• In case of misuse involving or amounting to attack on any devices, systems and/or networks, if there is any need for immediate response, then offending accounts, computers, network devices or network segments will be isolated or shut down according to reasonable technical criteria. Such decisions must be taken by the Chairman of the Centre for Computer Research, Education and Services (CCRES) Core Committee in consultation with the head of the Computer Centre. Justification for these steps must be recorded after the fact in the log kept by the Centre for Computer Research, Education and Services (CCRES).