Defining Your Acceptable
Use Policy
Before using Internet Content Security
tools, such as MailMarshal or
WebMarshal, you should establish an
Acceptable Use Policy (AUP) and inform employees of their responsibilities
and rights regarding company network resources. Education should include
addressing issues with email and Internet use. Establishing a policy can
also help to clarify your goals in using gateway content security.
Components of an Acceptable Use Policy
Consider addressing the following issues
when developing an Acceptable Use Policy. The list below is not intended
be exhaustive but represents suggestions that might help you when
addressing areas relevant to Internet use, including email and Internet
browsing.
Acceptable Use
Email and web access are organizational
tools provided for business, research or educational use. Employees are
responsible for using this tool to facilitate company business. They
should not have an expectation of privacy in anything they create,
store, send or receive on their computer. The adoption of an Acceptable
Use Policy will be much smoother if users are educated on acceptable
use.
Personal use
Many organizations find that when they
allow limited personal use of the Internet and email, employees are more
productive than if personal use is completely prohibited. If you do
allow some personal use, your Acceptable Use Policy should specifically
address which types of content are acceptable (such as joke of the day
online shopping, stock trading, and so on).
Another critical factor with personal
use is consistency with enforcement and setting precedents. It can be
very detrimental to suddenly ban users from certain types of personal
Internet use when that use has been acceptable in the past.
Unacceptable Use
Common examples of prohibited use
include transmitting, storing or receiving communications that are
discriminatory, harassing, obscene or X-rated, abusive, profane or
otherwise illegal. There should be clear repercussions for unacceptable
use, such as disciplinary action. There should also be clear procedures
for how unacceptable use will be handled when it is detected.
Confidential information
Proprietary information should not be
divulged improperly. Highly confidential information, such as company
trade secrets, new product plans and sensitive customer or employee
information should not be sent out via email or the Internet without
encryption. This is typically more a concern for corporate email but
accidental confidentiality breaches have occurred via web-based email.
Responsibility
You should inform employees that they
could be held responsible for the content of all communications they
store or send using email or the Internet. All email should be
identified with a name or email address; employees should not attempt to
hide their identity or place someone else's identity on company
communications (spoofing).
Copyright
Employees should also be informed about
copyright issues relating to electronic copies of documents obtained via
email or the Internet.
Monitoring and
enforcement
If a company plans to monitor or
otherwise enforce the Acceptable Use Policy, this should be clearly
stated in the policy. It should also state that all communications sent
or received via email and/or the Internet are the property of the
company, which reserves the right to monitor all messages/files on the
company's network.
Benefits of Education
Informing and educating users about the
Acceptable Use Policy provides a number of benefits, including:
- an enforceable Acceptable Use Policy
- voluntary compliance (to complement
filtering technology; no technology is 100% effective)
- limited liability if you face
litigation over staff misuse
- heightened awareness to prevent
accidental virus intrusions or confidentiality breaches
How Marshal Solutions Can Help With
Acceptable Use Policy
Marshal's content security solutions can
play an important part in monitoring and enforcing compliance with your
Acceptable Use Policy.
MailMarshal
SMTP and WebMarshal provide protection
by acting as a gateway between an enterprise and the Internet. They allow
an organization to restrict, block, copy, archive and automatically manage
the sending and receiving of content.
MailMarshal Exchange provides similar protective functions for
internal email in Microsoft Exchange Server environments.
MailMarshal can manage email based
on:
- specified attachment types (block,
restrict or strip attachments)
- user-defined keywords, using
TextCensor lexical analysis to identify confidential content
- messages larger than a specified size
- messages with a specified number of
recipients or attachments
- the message source or destination
- unacceptable image content
WebMarshal can control browsing
activity based on:
Both MailMarshal and
WebMarshal
provide comprehensive reporting on the content that has been
transmitted (file, names, sizes, senders or users).
