Wheaton Practice for Blocking Network Access
Introduction
Network operations personnel some times must take immediate action to mitigate any threats that have the potential to pose a serious risk to campus information system resources or the Internet. If the threat is deemed serious enough, the computer(s) posing the threat will be blocked from network access. These guidelines specify how the decision to block is made and the procedures involved.
Practice
Network operations personnel have the authority to evaluate the seriousness and immediacy of any threat to campus information system resources or the Internet and to take action to mitigate that threat. Action that is taken will be responsible and prudent based on the risk associated with that threat and the potential negative impact to the campus mission caused by making the offending computer(s) inaccessible. Examples of threats that are serious enough to invoke these procedures are:
- The level of network activity is sufficiently large as to cause serious degradation in the performance of the network;
- System administrative privilege has been acquired by someone who is not supposed to have it;
- An attack on another computer or network has been launched;
- Confidential, private or proprietary electronic information or communications are being collected;
- A complaint has been received regarding inappropriate activity and no response has been received from the individual regarding the complaint.
Procedures
If the threat is immediate, the offending computer(s) will be blocked immediately and notification will be sent to the individual via email that the block has occurred. In addition the Support Center will be notified of the block so that if the individual calls the Support Center reporting a network outage, they will be informed of it.
If the threat is not immediate, notification of the threat will be sent via email to the individual. If a response is not received within 4 hours indicating that the individual is taking action to mitigate the threat, the offending computer(s) will then be blocked. In either case, Support Center personnel will work with the individual to help them eliminate the problem or refer them to a qualified repair and service vendor to assist them in eliminating the problem. If a block has been put in place it will be removed when both the Support Center and network operations personnel agree that the problem causing the incident has been sufficiently addressed.
Recourse
If an individual feels that a computer has been inappropriately blocked it may request a review of the decision by the College Librarian and Associate Vice President for Information Technology and Services. If, after the review, there is still a disagreement with the decision, it may be further reviewed by the Dean of Student Life (in the case of students), the Provost (in the case of academic departmental machines) and the Vice President for Finance and Operations (in the case of staff machines).