"A chain is only as strong as its weakest link."
It's an old saying but still true in our efforts at UNH to protect information and IT resources. Each of us has a role in information protection and your use of IT Good Practices helps you to ensure that you are armed with the knowledge to avoid basic and common risky behaviors in the use of IT resources... to avoid being the weakest link.
This ISS Good Practices page provides information, recommendations, checklists, templates and procedures for both IT Service Consumers and Service Providers.
University policy requires you to change your passwords at least every six months, use strong passwords and separate passwords for each account. You should not use the same or similar passwords on your personal accounts, for example an online banking account. While the minimum length for university passwords is seven characters, longer, strong passwords are significantly more difficult for attackers to break.
To change your passwords, go to accounts.unh.edu and follow all the instructions. For additional guidance, IT Signals has published the helpful How To Painlessly Change Your AD Password If you require assistance when changing your password, contact the UNH IT Service Desk.
A wide variety of lists of recommended practices to protect information and your computer are available and it is often confusing to know which to follow. Reduce the risk of an information breach by following the UNH IT Protected Computing Good Practices
Use these practices when browsing the Internet to protect your information and computer: Reducing Your Risk
ISS recommends that all UNH computer users access the Internet only when using a non-administrative account. This provides additional protection against downloading of malicious software such as viruses and trojans, but does not replace an up-to-date antivirus program. For assistance with creating your non-administrative user account, contact your departmental IT support or the IT Service Desk, or use following documents which provide guidance for a non-administrative account on your PC:
- How to remove your users account from the administrator's account
- How to logon to the adminsitrators's account
- How to provide administrator's credentails when downloading software
- How to change the administrator's password
If you use social media, such as Facebook or Twitter, representing the university or your department, read the UNH Social Media Guidelines provided by University Communications and Marketing and Information Security Services.
Both IT Service Consumers and Service Providers can reduce the risk from malicious emails or other communications by using these Email Good Practices. When sending personally identifiable information (PII) in emails, protection should be provided as recommended in PII in Email.
Good practices for computers servers can vary depending on the type of server and services in question, as well as the type of information the server stores or processes. Some basic concepts apply to all servers and this list describes some of these commonly used basic tenets.
Good practices for printers and copiers can vary depending on the type and manufacturer of the device, as well as the type of information the device stores or processes. This list describes good practices that apply to the installation and operation of most of these devices.
If you use a mobile device, such as a smartphone or tablet computer, to access UNH services or information, it is critical that you protect the device and the information accessed by, or stored on, the device. For guidance, you may use the following information sources and services:
- Go to the UNH IT Mobile Devices and Applications page for the latest configuration and security information.
- Use our Security Basics For Mobile Devices as a guide to purchasing devices with, and activating, security features.
- Read IT Signals: Using a Stronger Password on Your iPad, iPhone or iPod touch.
- NIST: The National Institute for Standards and Technology provides these Guidelines for Cell Phone and PDA Security.
Persons who handle restricted or sensitive information, or who operate IT systems that store, transfer or process such information, should sign a confidentiality agreement. Doing so helps educate those persons about protecting the systems and information, and helps to establish expectations. In some situations, the signing of a confidentiality agreement is required by policy or contract.
The confidentiality agreement template provided here is available for your use or adaptation as appropriate. Where the use of such agreement has legal implications, it is recommended that you seek legal advice to verify that your intended use is appropriate for your situation. Download a copy of the Confidentiality Agreement Template (PDF)
Page last updated 11/8/2013