CINXE.COM

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" version="XHTML+RDFa 1.0" dir="ltr"> <head profile="http://www.w3.org/1999/xhtml/vocab"><script type="text/javascript" src="/_static/js/bundle-playback.js?v=HxkREWBo" charset="utf-8"></script> <script type="text/javascript" src="/_static/js/wombat.js?v=txqj7nKC" charset="utf-8"></script> <script>window.RufflePlayer=window.RufflePlayer||{};window.RufflePlayer.config={"autoplay":"on","unmuteOverlay":"hidden"};</script> <script type="text/javascript" src="/_static/js/ruffle/ruffle.js"></script> <script type="text/javascript"> __wm.init("http://web.archive.org/web"); __wm.wombat("https://community.jisc.ac.uk/library/janet-policies/security-policy","20230602185410","http://web.archive.org/","web","/_static/", "1685732050"); </script> <link rel="stylesheet" type="text/css" href="/_static/css/banner-styles.css?v=S1zqJCYt" /> <link rel="stylesheet" type="text/css" href="/_static/css/iconochive.css?v=3PDvdIFv" />  <meta http-equiv="X-UA-Compatible" content="IE=edge"/> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <meta name="Generator" content="Drupal 7 (http://drupal.org)"/> <link rel="canonical" href="/web/20230602185410/https://community.jisc.ac.uk/library/janet-policies/security-policy"/> <link rel="shortlink" href="/web/20230602185410/https://community.jisc.ac.uk/node/230"/> <link rel="prev" href="/web/20230602185410/https://community.jisc.ac.uk/library/janet-policies/references"/> <link rel="up" href="/library/janet-policies"/> <link rel="next" href="/web/20230602185410/https://community.jisc.ac.uk/library/janet-policies/terms-provision-janet-service"/> <link rel="shortcut icon" href="http://web.archive.org/web/20230602185410im_/https://community.jisc.ac.uk/sites/all/themes/janetbootstrap/favicon.png" type="image/png"/> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=5, minimum-scale=1, user-scalable=yes"/> <title>Security Policy | Jisc community</title> <link type="text/css" rel="stylesheet" href="http://web.archive.org/web/20230602185410cs_/https://community.jisc.ac.uk/sites/default/files/css/css_kShW4RPmRstZ3SpIC-ZvVGNFVAi0WEMuCnI0ZkYIaFw.css" media="all"/> <link type="text/css" rel="stylesheet" href="http://web.archive.org/web/20230602185410cs_/https://community.jisc.ac.uk/sites/default/files/css/css_NXti8f1KG_3PtT4IIc0U3jDor0MbcpVCy5HvGkHBurk.css" media="screen"/> <link type="text/css" rel="stylesheet" href="http://web.archive.org/web/20230602185410cs_/https://community.jisc.ac.uk/sites/default/files/css/css_V1JVxYmDOCjsJtcRNlnyEwhlbj0gl6SOGg5jO5g-h7g.css" media="all"/> <link type="text/css" rel="stylesheet" href="http://web.archive.org/web/20230602185410cs_/https://community.jisc.ac.uk/sites/default/files/css/css_a0n-xOjQm_KaPFTJrnTcD1UeV45szQe_Bxv5GdYnH18.css" media="all"/> <link type="text/css" rel="stylesheet" href="http://web.archive.org/web/20230602185410cs_/https://community.jisc.ac.uk/sites/default/files/css/css_YcpNB45HbqoDqf-J5Tc2SbinVgoNZ5yaO2UQ-h5mLPc.css" media="all"/> <link type="text/css" rel="stylesheet" href="http://web.archive.org/web/20230602185410cs_/https://community.jisc.ac.uk/sites/default/files/css/css_dp8_qx5keCSic6hv5ET2XVZucaHP9yjr8d1nU9Fm1w0.css" media="all"/> <link type="text/css" rel="stylesheet" href="http://web.archive.org/web/20230602185410cs_/https://community.jisc.ac.uk/sites/default/files/css/css_6j_kM_lFBpjKiiMCcWiOeu7BL5nIp-9slDeauzjyeCM.css" media="all"/>   <link type="text/css" rel="stylesheet" href="http://web.archive.org/web/20230602185410cs_/https://community.jisc.ac.uk/sites/default/files/css/css_nsLL-rizn6QG5sOblCjxt1WpKPwAjgjM4B0a4XXtRH4.css" media="all"/>   <link rel="stylesheet" type="text/css" href="http://web.archive.org/web/20230602185410cs_/https://community.jisc.ac.uk/sites/all/themes/jisc_clean/css/content.css"> <link rel="stylesheet" type="text/css" href="http://web.archive.org/web/20230602185410cs_/https://community.jisc.ac.uk/sites/all/themes/jisc_clean/css/content-rd.css">   <link rel="stylesheet" type="text/css" href="http://web.archive.org/web/20230602185410cs_/https://community.jisc.ac.uk/sites/all/themes/janetbootstrap/css/jisc-v1-community.css"> <script type="text/javascript" src="http://web.archive.org/web/20230602185410js_/https://community.jisc.ac.uk/sites/default/files/js/js_M3LS0C5m0kyfm9PSmKkhDhMR-kIdj7Z1_BvJc467rVs.js"></script> <script type="text/javascript" src="http://web.archive.org/web/20230602185410js_/https://community.jisc.ac.uk/sites/default/files/js/js_dJANl9ilM3Hg8xy1Xe9LojOw2QxFulSVOw3MFTEw_zk.js"></script> <script type="text/javascript" src="http://web.archive.org/web/20230602185410js_/https://community.jisc.ac.uk/sites/default/files/js/js_UvsnT1BMv1Dgs0Ye4lup7kjgsdbqHowT309nwoMRLn0.js"></script> <script type="text/javascript" src="http://web.archive.org/web/20230602185410js_/https://community.jisc.ac.uk/sites/default/files/js/js_3SmoSUwNo--IsxZYcxcriGwNKMywZQElaULi8FV6t8k.js"></script> <script type="text/javascript"> <![CDATA[//><!]]> </script> <script type="text/javascript" src="http://web.archive.org/web/20230602185410js_/https://community.jisc.ac.uk/sites/default/files/js/js_rsGiM5M1ffe6EhN-RnhM5f3pDyJ8ZAPFJNKpfjtepLk.js"></script> <script type="text/javascript"> <![CDATA[//><!]]> </script> <script type="text/javascript" src="http://web.archive.org/web/20230602185410js_/https://community.jisc.ac.uk/sites/default/files/js/js_l-Map3vzGuwgWt6_2IW1rimJQlASzgKhQVfITA6tFxM.js"></script> <script type="text/javascript" src="http://web.archive.org/web/20230602185410js_/https://community.jisc.ac.uk/sites/default/files/js/js_Qxn2XGQkpPua9TV4068AikZ504eRd_TnLp0u5Tp2i2o.js"></script> <script type="text/javascript"> <![CDATA[//><!]]> </script> </head> <body class="html not-front not-logged-in page-node page-node- page-node-230 node-type-book context-library"> <header class="c-structure__jisc-masthead"> <div class="c-jisc-banner"> <div class="container-12"> <div class="grid-12"> <div class="c-jisc-banner__inner"> <p class="c-jisc-banner__jisc-brand"> <a class="c-jisc-logo c-jisc-banner__jisc-logo" href="//web.archive.org/web/20230602185410/https://www.jisc.ac.uk/" title="Go to the Jisc homepage"> <img class="c-jisc-logo__img c-jisc-logo__img--jisc-banner" src="http://web.archive.org/web/20230602185410im_/https://community.jisc.ac.uk/sites/all/themes/janetbootstrap/img/jisc-logo.svg" alt="Jisc"> </a> </p> </div> </div> </div> </div> </header> <div id="skip-link"> <a href="#main-content" class="element-invisible element-focusable">Skip to main content</a> </div> <div class="page clearfix" id="page"> <header id="section-header" class="section section-header"> <div id="zone-topbar-wrapper" class="zone-wrapper zone-topbar-wrapper clearfix"> <div id="zone-topbar" class="zone zone-topbar clearfix container-12"> <div class="grid-12 region region-topbar" id="region-topbar"> <div class="region-inner region-topbar-inner"> <a href="/web/20230602185410/https://community.jisc.ac.uk/" id="site-name">Jisc community</a><div class="block block-janet-topbar block-janet-topbar-main-block block-janet-topbar-janet-topbar-main-block odd block-without-title" id="block-janet-topbar-janet-topbar-main-block"> <div class="block-inner clearfix"> <div class="content clearfix"> <div class="register-button fl"><a href="/web/20230602185410/https://community.jisc.ac.uk/register?destination=library/janet-policies/security-policy"><span></span>Register</a></div><div class="login-button-container fl leftmar20"><a href="/web/20230602185410/https://community.jisc.ac.uk/login?destination=library/janet-policies/security-policy" class="btn" id="login-button">Login<i class="janet-menu-down-arrow hide"></i></a><div id="janet-topbar-login-form"><form class="clearfix janet-topbar-login-form-master form-stacked" action="/web/20230602185410/https://community.jisc.ac.uk/library/janet-policies/security-policy" method="post" id="janet-topbar-login-form-master" accept-charset="UTF-8"><h3>Login to Community</h3><div class="il-login-button form-wrapper" id="edit-institutional-login"><input class="btn-info btn form-submit" type="submit" id="edit-il-button" name="op" value="Institutional Login"/></div><div class="federation-or form-wrapper" id="edit-federation-or"><div class="or-border-before form-wrapper" id="edit-or-border-before"></div><div class="or-content form-wrapper" id="edit-or-content">or</div><div class="or-border-after form-wrapper" id="edit-or-border-after"></div></div><div class="local-login form-wrapper" id="edit-local-login"><div class="form-item form-type-textfield form-item-name"> <div class="input"> <input placeholder="Email" type="text" id="edit-name" name="name" value="" size="60" maxlength="128" class="form-text required"/></div> </div> <div class="form-item form-type-password form-item-pass"> <div class="input"> <input placeholder="Password" type="password" id="edit-pass" name="pass" size="60" maxlength="128" class="form-text required"/></div> </div> <div class="form-actions form-wrapper actions" id="edit-actions"><input class="drupal-login-submit btn btn-success btn form-submit" type="submit" id="edit-login" name="op" value="Login"/><a href="/web/20230602185410/https://community.jisc.ac.uk/user/email-retrieval" id="forgot-email-link">Forgot email</a><a href="http://web.archive.org/web/20230602185410/https://community.jisc.ac.uk/user/password?destination=node/230" id="forgot-password-link">Forgot password</a></div></div><input type="hidden" name="form_build_id" value="form-zvtOeqfDmTQM1-v7LTOAnX-PeZyRlfh2BjMdu-sNYrM"/> <input type="hidden" name="form_id" value="janet_topbar_login_form_master"/> </form></div></div> </div> </div> </div> </div> </div> </div> </div><div id="top-right-bg"></div><div id="zone-menu-wrapper" class="zone-wrapper zone-menu-wrapper clearfix"> <div id="zone-menu" class="zone zone-menu clearfix container-12"> <div class="grid-12 region region-menu" id="region-menu"> <div class="region-inner region-menu-inner"> <nav class="communities-menu navigation primary-nav nav-collapse"> <ul id="nav" class="menu"><li class="first expanded"><a href="/web/20230602185410/https://community.jisc.ac.uk/library/network-and-technology-service-docs/library" class="level-1 library-menu">Library</a><ul class="menu"><li class="first leaf"><a href="/web/20230602185410/https://community.jisc.ac.uk/library/advisory-services" class="menu-link">Advisory services</a></li> <li class="leaf"><a href="/web/20230602185410/https://community.jisc.ac.uk/library/janet-tech-net-library/test-page" class="menu-link">Consultations</a></li> <li class="leaf"><a href="/web/20230602185410/https://community.jisc.ac.uk/library/janet-policies" class="menu-link">Network and technology policies</a></li> <li class="leaf"><a href="/web/20230602185410/https://community.jisc.ac.uk/library/janet-services-documentation" class="menu-link">Service documentation</a></li> <li class="last leaf"><a href="/web/20230602185410/https://community.jisc.ac.uk/library/janet-website-how" class="menu-link">Using Jisc community</a></li> </ul></li> <li class="last leaf"><a href="/web/20230602185410/https://community.jisc.ac.uk/apps" class="level-1 tools-menu">Tools</a><ul class="menu"><li class="first last leaf"><a href="/web/20230602185410/https://community.jisc.ac.uk/apps" class="level-1 tools-menu">View all</a></li> </ul></li> </ul> </nav> <div class="block block-search block-form block-search-form odd block-without-title" id="search"> <div class="block-inner clearfix"> <div class="content clearfix"> <form class="form-inline form-stacked" action="/web/20230602185410/https://community.jisc.ac.uk/library/janet-policies/security-policy" method="post" id="search-block-form" accept-charset="UTF-8"><div class="container-inline"> <h2 class="element-invisible">Search form</h2> <div class="form-item form-type-textfield form-item-search-block-form"> <label class="element-invisible" for="edit-search-block-form--2">Search </label> <div class="input"> <input title="Enter the terms you wish to search for." placeholder="Search community" type="text" id="edit-search-block-form--2" name="search_block_form" value="" size="15" maxlength="128" class="form-text"/></div> </div> <div class="form-wrapper actions" id="edit-actions--2"><input class="no-btn search-btn ico ico-search-glass" type="submit" id="edit-submit" name="op" value="Search"/></div><input type="hidden" name="form_build_id" value="form-8J5-RIwg5pCB1adoSj84zC73WGw-0uWkbcjAEZatU6s"/> <input type="hidden" name="form_id" value="search_block_form"/> </div> </form> </div> </div> </div> </div> </div> </div> </div></header> <section id="section-content" class="section section-content"> <div id="zone-breadcrumb-wrapper" class="zone-wrapper zone-breadcrumb-wrapper clearfix"> <div id="zone-breadcrumb" class="zone zone-breadcrumb clearfix container-12"> </div> </div><div id="zone-content-wrapper" class="zone-wrapper zone-content-wrapper clearfix"> <div id="zone-content" class="zone zone-content clearfix container-12"> <div id="breadcrumb"><h2 class="element-invisible">You are here</h2><ul class="breadcrumb breadcrumb-menu clearfix"><li class="breadcrumb-item first"><a href="/web/20230602185410/https://community.jisc.ac.uk/">Home</a></li><li class="breadcrumb-item"><a href="/web/20230602185410/https://community.jisc.ac.uk/library/library">Library</a></li><li class="breadcrumb-item"><a href="/web/20230602185410/https://community.jisc.ac.uk/library/janet-policies">Network and technology policies</a></li><li class="breadcrumb-item last"><span><span class="active">Security Policy</span></span></li></ul></div> <div id="bottom-left-bg"></div><div id="bottom-left-bg-white-inset"></div><div class="grid-12 region region-content fl" id="region-content"> <div class="region-inner region-content-inner" id="region-inner-content"> <a id="main-content"></a> <div class="block block-janet-adaptive-library block-jl-finderwin block-janet-adaptive-library-jl-finderwin odd block-without-title" id="block-janet-adaptive-library-jl-finderwin"> <div class="block-inner clearfix"> <div class="content clearfix"> <div id="hColumnLibrary" class="librarynavholder"></div> </div> </div> </div> <div class="block block-system block-main block-system-main even block-without-title" id="block-system-main"> <div class="block-inner clearfix"> <div class="content clearfix"> <div class="ds-1col node node-book view-mode-full clearfix "> <div class="field field-name-title field-type-ds field-label-hidden"><div class="field-items"><div class="field-item even"><h2>Security Policy</h2></div></div></div><span class="print-link"><span class="print_pdf"><a href="http://web.archive.org/web/20230602185410/https://community.jisc.ac.uk/printpdf/230" title="Display a PDF version of this page." class="print-pdf" onclick="window.open(this.href); return false" rel="nofollow"><img class="print-icon print-icon-margin" src="http://web.archive.org/web/20230602185410im_/https://community.jisc.ac.uk/sites/all/modules/contrib/print/print_pdf/icons/pdf_icon.png" width="16px" height="16px" alt="Download as PDF" title="Download as PDF"/>Download as PDF</a></span></span><div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"><div class="t-guides-and-cribsheets"> <div class="book-menu"> <section class="l-gutter--right is-collapsible is-collapsible--blue user-created cx_collapsibles__container "> <h3 class="cx_collapsibles__trigger"> <a href="#"><span class="fa fa-bars"></span>Contents</a> </h3> <div class="cx_collapsibles__target"> <div class="book-root"><a href="/web/20230602185410/https://community.jisc.ac.uk/library/janet-policies">Network and technology policies</a></div><ul class="menu"><li class="leaf"><a href="/web/20230602185410/https://community.jisc.ac.uk/library/janet-policies/security-policy" class="active">Security Policy</a></li> </ul> </div> </section> </div> </div><h1>Janet Security Policy</h1> <table border="1" cellpadding="1" cellspacing="1" style="width:500px"><tbody><tr><td>Title: </td> <td>Janet Security Policy</td> </tr><tr><td>Reference: </td> <td>MF-POL-007</td> </tr><tr><td>Issue: </td> <td> 5.1</td> </tr><tr><td>Document owner: </td> <td> John Chapman, Director information security policy and governance</td> </tr><tr><td>Authorised by: </td> <td>Steve Masters, Group CTO</td> </tr><tr><td>Date: </td> <td>2 March 2023</td> </tr><tr><td>Last reviewed:</td> <td>2 March 2023</td> </tr></tbody></table><h2>Document control </h2> <p>1. Superseded documents: MF-POL-007 issue 5, dated March 2022<br/>2. Changes made: March 2023: minor edits for readability and confirming Geo-IP launch date.<br/>3. Changes forecast: None</p> <h2>Summary</h2> <p>The Janet Security Policy describes the responsibilities of organisations connected to the Janet network and Jisc’s responsibilities as owner and operator of the Janet network – the UK’s national research and education network – to mitigate the risks that security incidents and misuse will damage the effectiveness of the Janet network and organisations connected to the network.</p> <h2>Background</h2> <ol><li>The Janet Network (“<strong>Janet</strong>”) is the communications network operated by Jisc Services Ltd (Jisc) to serve UK education, research and other public sector purposes. Its primary purpose is to enable organisations in these communities to fulfil their missions of providing education, research, of supporting innovation, and of civic engagement more widely.</li> <li>This Janet “<strong>Security Policy</strong>” covers two broad categories of organisation: those connecting directly to Janet in their own right (“<strong>Connected Organisation</strong>”); and those connecting indirectly, as a partner to the directly-connected organisation and with the connection made through the latter organisation’s own connection(s) to Janet (“<strong>Partner Organisation</strong>”). This Security Policy does not define the conditions under which such organisations are eligible to connect to Janet, and to use Janet services. The Janet Network Connection Policy does this.</li> <li>The Security Policy is regularly reviewed and when required it is updated to reflect changes to the security landscape and advances in technology. The increase in damaging cyber security attacks in 2020 and 2021 within the education and research sectors has necessitated a further review of the policy, and following a consultation, additional principles have been incorporated to help best protect organisations connected to Janet. It is the policy of Jisc that, as a network for education and research, Janet will be most effective if it places as few technical restrictions as possible on the development or use of new applications and services, and security controls will only be implemented where there is a clear benefit. Therefore, the Janet Security Policy aims to balance security and operability to enable the UK to continue to be a world leader in education and research.</li> <li>Jisc provides protective controls to defend the Janet network and the organisations connected to the network, and actively seeks to engage in threat intelligence sharing between all Connected Organisations, all government and law enforcement agencies involved in the protection of UK Education and Research, and in an international context, all equivalent National Research and Education Networks within appropriate legal frameworks.</li> </ol><h2>Documents referenced by the Security Policy</h2> <ol start="5"><li>The following Janet documents are referenced by this policy and they can be found at <a href="http://web.archive.org/web/20230602185410/http://ji.sc/policies" rel="nofollow"><strong>http://ji.sc/policies</strong></a>.</li> </ol><p><em>MF-POL-006 – Janet Acceptable Use Policy (Janet AUP) </em></p> <p><em>MF-POL-053 - Janet Network Connection Policy</em></p> <p><em>GEN-DOC-009 – Terms for Provision of the Janet Service (Janet Terms)</em></p> <p><span>Scope</span></p> <ol start="6"><li>This policy applies to any organisation with a connection to the Janet network, whatever type of agreement covers the connection. In particular it covers Connected Organisations – those organisations that have a direct relationship with Jisc; and Partner Organisations - any eligible organisation that connects to a Connected Organisation as their partner (see <strong>Note 1</strong>).</li> </ol><h2>Operational and legal requirements</h2> <ol start="7"><li>Being connected to any network – including the Janet network – brings associated risks that security incidents or misuse will seriously damage the effectiveness of the network itself (a summary of these risks can be found in Annex A), and that the impact of incidents may rapidly spread far beyond the individual organisation, machine or user where they originate. These risks must be managed if the network is to fulfil its purpose, therefore, Jisc has adopted this Security Policy to protect the network and the organisations that use it.</li> <li>The authority of Jisc as service provider, to protect the operation of the Janet network is established in the Janet Terms, under which, compliance with this Policy is a requirement for all organisations connected to the network. The Policy also places responsibilities on users of the network.</li> <li>The overall goals of the Janet Security Policy are:</li> </ol><ul><li>To ensure that Connected Organisations have appropriate policies and technical controls in place to protect the Janet network, the networks connected to the Janet network and the computer systems and platforms using the Janet network from abuse.</li> <li>To ensure that mechanisms exist to aid the prevention and identification of abuse of the Janet network.</li> <li>To ensure an effective response to complaints and queries about real or perceived abuses of the Janet network.</li> <li>To ensure that the reputation of Jisc is protected and that the network can meet its legal and ethical responsibilities regarding its connectivity to the worldwide internet.</li> </ul><h1>The Policy</h1> <p>In this policy the word "<strong>must</strong>", or the term "<strong>required</strong>" mean that the requirement has to be met. The word "<strong>should</strong>" means that there may exist valid reasons in particular circumstances to ignore a particular requirement, but the full implications must be understood and carefully weighed before choosing a different course.</p> <h2>Responsibilities</h2> <ol start="10"><li>The Janet Terms place responsibilities on every person and organisation involved in the use or operation of the Janet network to protect the network against security incidents and breaches. In particular:</li> </ol><p>10.1 It is the Connected Organisation's responsibility to ensure that they are compliant with all relevant UK and national legislation.<br/>10.2 Each Connected Organisation must ensure that all use of the Janet network by those individuals and Partner Organisations to whom it provides network access complies with this Security Policy and the Janet Acceptable Use Policy. The Connected Organisation must also ensure that information about security issues can be communicated rapidly within the organisation and to Jisc and that problems are resolved promptly.<br/>10.3 Each Connected Organisation and their Partner Organisations must ensure that its actions and those of the users for which it is responsible are safe for themselves and do not present a threat to others.<br/>10.4 Each user of the Janet network and the networks of Connected Organisations and their Partner Organisations must behave in accordance with this Security Policy and with any policies and procedures local to the Connected Organisation. The user must cooperate with their organisation and the network operators to reduce security risks.<br/>10.5 Jisc must ensure that the operation of the network is appropriately monitored, that the response to security problems is coordinated, and that temporary or permanent measures are implemented, up to and including disconnection, where necessary to protect the network or to comply with the law.<br/>10.6 Connected Organisations are required to undertake an annual self-assessment security posture review to ensure awareness of strengths and weaknesses regarding security controls and culture. Completing this self-assessment will help Connected Organisations ensure their local security provision is best placed to benefit from the central services provided by Jisc as well as helping to secure the Janet network (see <strong>Note 2</strong>). Jisc reserves the right to request confirmation that a self-assessment has been undertaken.<br/>10.7 Connected Organisations are strongly encouraged to ensure that any Partner Organisations to whom they provide network access complete a self-assessment security posture review as a condition of their connectivity.</p> <h2>Points of Contact at the Connected Organisation</h2> <ol start="11"><li>The successful prevention of security incidents and prompt resolution of those that do occur both depend critically on the rapid and accurate transfer of information between Connected Organisations and Jisc as operator of the network. Each Connected Organisation must provide Jisc with up-to-date details of one or more persons who will act as Security Contact(s) for the Connected Organisation. The Connected Organisation must ensure that its designated Security Contact(s) have appropriate knowledge, skills, resources and authority to fulfil their role. As a minimum, each Connected Organisation must provide the following information (see <strong>Note 3</strong>):</li> </ol><p class="p">11.1 Name, role; email address<br/>11.2 Distribution group, fan out or team email address<br/>11.3 Emergency phone number</p> <ol start="12"><li>Security Contact data must be reviewed and confirmed to Jisc on a quarterly basis (see <strong>Note 3</strong>).</li> <li>The Security Contact(s) have roles in both the prevention and resolution of security incidents. Security Contacts must disseminate Jisc's warnings of general risks and precautions to appropriate people within the organisation(s) for which they are responsible, and to ensure that appropriate preventive measures are taken promptly. Security Contacts must ensure that any particular security breach or risk that has been reported to the Security Contact(s) by Jisc as affecting an organisation for which they are responsible is investigated and resolved promptly, and to inform Jisc that this has been done (see <strong>Note 3</strong>).</li> <li>Security Contacts should notify Jisc of serious cyber security incidents even where no assistance is required as an incident may be part of a wider campaign and any information that can be provided may help other Connected Organisations (see <strong>Note 3</strong>).</li> </ol><h2>Responsible Action by the Connected Organisation and their Partner Organisations</h2> <ol start="15"><li>Each Connected Organisation and their Partner Organisations must act responsibly to protect the network. This includes:</li> </ol><p>15.1 Taking effective measures to ensure that there is no security threat to the Janet network or other Connected Organisations or their Partner Organisations from insecure devices connected to the Organisation’s network (see <strong>Note 4</strong>).<br/>15.2 Taking effective measures to protect against security breaches, in particular ensuring that recommended security measures are implemented.<br/>15.3 Taking effective measures to ensure that security breaches can be investigated and that other users of the network are protected from the consequences of breaches.<br/>15.4 Assisting in the investigation and repair of any breach of security.<br/>15.5 Promoting local policies in support of this Janet Security Policy and pay due regard to the Prevent Guidance for England, Scotland and Wales, backed by adequate disciplinary and other procedures for enforcement.<br/>15.6 Implementing appropriate measures for giving, controlling and accounting for access to Janet, backed by regular assessments of the risks associated with the measures chosen.<br/>15.7 Taking reasonable measures to encourage its users to act responsibly in compliance with this Policy and the Janet AUP, and ensuring that they are enabled to do so through systems, procedures and training that support good security practice.<br/>15.8 Security Contacts must notify Jisc if undertaking penetration testing or scanning on the Janet Network from outside of the Janet Network at least 1 working day in advance (see <strong>Note 3</strong>).</p> <ol start="16"><li>Each Connected Organisation must<strong>**</strong> notify Jisc of any significant incidents or attacks which:</li> </ol><p>16.1 have the potential to disrupt the continued operation of the Connected Organisation; and/or<br/>16.2 carry a likelihood that other Connected Organisations may experience a similar attack, or that the incident could spread to those organisations; and/or<br/>16.3 could have a negative impact on the reputation of Jisc or the education and research sector; and/or<br/>16.4 carry the likelihood of Government or national media interest.</p> <p><strong>**</strong> Unless Connected Organisations are instructed by their insurer or law enforcement to not notify Jisc, in which case they are strongly encouraged to explain to them the assistance Jisc CSIRT can provide, which could help to minimise impact and provide valuable information. The Connected Organisation should notify Jisc CSIRT as soon as they are able.</p> <h2><span>Monitoring, Enforcement and Reporting by Jisc</span></h2> <ol start="17"><li>The Janet Terms authorise Jisc, as the service provider responsible for the Janet network, to require Connected Organisations and their Partner Organisations to comply with this Policy, to monitor the network where it has reason to believe there has been a breach of the Policy or other threat, and to take such actions as are necessary to protect the operation of the network and the security of services provided to Connected Organisations and their Partner Organisations. In particular, Jisc is authorised to:</li> </ol><p>17.1 monitor use of the network, while respecting privacy and complying with national law, either in response to information about a specific threat or generally because of the perceived situation.<br/>17.2 undertake proactive scans in response to critical vulnerability alerts or actionable threat intelligence to identify vulnerabilities in customer equipment that may present a serious threat to the security of the Janet network or services provided over it, and report these vulnerabilities to the relevant Security Contact(s) (see <strong>Note 5</strong>).<br/>17.3 implement such technical measures as are required to protect the network or its customers against breaches of security or other incidents that may damage the network’s service or reputation. These may be temporary or longer-term controls. Each control will undergo significant testing and monitoring to ensure they provide an appropriate balance of security and usability to best protect users (see <strong>Note 6</strong>).<br/>17.4 require a Connected Organisation, through its nominated contact, to fulfil its responsibilities under any of the Jisc Policies.<br/>17.5 where a Connected Organisation is unable or unwilling to co-operate, initiate the process for achieving an emergency disconnection.<br/>17.6 where permitted or required by law, or to protect the Janet network, Connected Organisations or their Partner Organisations, assist relevant authorities in their investigations concerning the Janet network, including notifying authorities of relevant incidents and sharing threat intelligence and guidance with Connected Organisations, Users, NCSC and, where applicable, government departments, funders and agencies to support data protection (see <strong>Note 7</strong>).</p> <div id="ftn1"></div> <h1>Explanatory notes</h1> <p><strong>Note 1:</strong> A Connected Organisation is responsible both for their own users and devices, and also for ensuring that any Partner Organisation that they provide a connection to exercises their responsibilities.</p> <p><strong>Note 2</strong>: To improve cyber security, Connected Organisations are required to complete an annual internal self-assessment review of security posture. Connected Organisations can use whatever model or framework works best for that organisation e.g. CIS controls, Cyber Assessment Framework, Cyber Essentials, ISO27001, or using internal risk assessments. Organisations are invited to share information on which frameworks or tools they find helpful on the Jisc Cyber Security Community Group: <a href="http://web.archive.org/web/20230602185410/https://www.jisc.ac.uk/get-involved/cyber-security-community-group" rel="nofollow"><strong>https://www.jisc.ac.uk/get-involved/cyber-security-community-group</strong></a></p> <p><strong>Note 3</strong>: Security Contacts should contact Jisc CSIRT via the details at <a href="http://web.archive.org/web/20230602185410/https://www.jisc.ac.uk/csirt" rel="nofollow"><strong>https://www.jisc.ac.uk/csirt</strong></a>. Connected Organisations are also encouraged to share information about cyber security incidents with peers via the Cyber community group (<a href="http://web.archive.org/web/20230602185410/https://www.jisc.ac.uk/get-involved/cyber-security-community-group" rel="nofollow"><strong>https://www.jisc.ac.uk/get-involved/cyber-security-community-group</strong></a>).</p> <p><strong>Note 4</strong>: The security of networked devices may, for example, be managed by a combination of direct configuration and maintenance, technical controls such as firewalls or router access control lists, system monitoring or probing, and delegation to appropriately skilled others. Where an organisation allows a device it does not own or control to connect to the network it is strongly recommended that consent to these normal operational measures be obtained as a condition of connection.</p> <p><strong>Note 5</strong>: To provide the best protection for Connected Organisations, Jisc will undertake active scans in response to critical vulnerability alerts or actionable threat intelligence. Jisc will identify what looks to be the least intrusive way of looking for vulnerabilities, and where possible, will look to establish a test system to verify that it just detects the vulnerability and should not cause an issue. Jisc will only run scans that have a high level of confidence of not causing serious impact to Connected Organisations or their Partner Organisations. Jisc will also be cognisant of the timing of scans, particularly avoiding the period of confirmation and clearing unless operationally essential. Jisc will always inform Connected Organisations of any detected vulnerabilities. The IP address ranges from which scanning activity will be undertaken can be found in the Jisc Cyber community Group: <a href="http://web.archive.org/web/20230602185410/https://www.jisc.ac.uk/get-involved/cyber-security-community-group" rel="nofollow"><strong>https://www.jisc.ac.uk/get-involved/cyber-security-community-group</strong></a>.</p> <p><strong>Note 6:</strong> One such control is restriction of certain high-risk protocols for traffic inbound to Janet. In March 2023 Jisc moved from an opt-in Foundation GeoIP service to being on by default unless Connected Organisations request to opt-out, as described at <a href="http://web.archive.org/web/20230602185410/https://www.jisc.ac.uk/ddos-mitigation" rel="nofollow">https://www.jisc.ac.uk/ddos-mitigation</a>. Connected Organisations will be given reasonable notice in advance of implementing such restrictions and will be able to see the current list of restricted ports and protocols on the Jisc Cyber Security Portal at <a href="http://web.archive.org/web/20230602185410/https://cybersecurity.jisc.ac.uk/" rel="nofollow"><strong>https://cybersecurity.jisc.ac.uk/</strong></a> or by emailing <a href="http://web.archive.org/web/20230602185410/mailto:irt@jisc.ac.uk">irt@jisc.ac.uk</a>. Security Contacts will be able to request an opt-out of restrictions for specific IP addresses.</p> <p><strong>Note 7:</strong> See <a href="http://web.archive.org/web/20230602185410/https://www.jisc.ac.uk/guides/networking-computers-and-the-law/disclosure-of-information-to-law-enforcement" rel="nofollow">https://www.jisc.ac.uk/guides/networking-computers-and-the-law/disclosure-of-information-to-law-enforcement</a> for more information.</p> <h1>Annex A: Risks to Networks and Networked Systems</h1> <p>All computer networks are exposed to threats, both internally and from the other networks to which they connect. Hostile traffic, both random and directed, is now a constant feature of the Internet. The risks to the network, the computers and organisations connected to it, include:</p> <ul><li><strong>Breaches of confidentiality.</strong> Organisations hold and have access to large amounts of intellectual property, both their own and licensed from others: the value of such property may be greatly reduced if it is disclosed to others. Organisations also handle a great deal of personal information about individuals who may suffer if it is not kept confidential: consequences range from a loss of privacy to partial or complete theft of identity.</li> <li><strong>Loss of integrity.</strong> Information held on computers can be destroyed or modified, and unauthorised changes may be undetectable. The integrity of computers themselves may be compromised if intruders are able to take control of them, thus casting doubt on the accuracy of any results. Repeated failures can result in users losing confidence in computer systems at their own or other organisations.</li> <li><strong>Failures of availability.</strong> Networks and the computers connected to them may be temporarily disabled either deliberately or accidentally by large flows of network traffic or through the deployment of malware such as ransomware, making them unusable. Network and computer staff may be unavailable for support or development activities if they have to spend their time dealing with security incidents.</li> <li><strong>Damage to reputation.</strong> The reputations of Jisc and the organisations and individuals connected to it may be seriously harmed by security incidents or inappropriate use of the network. Many intruders like to advertise their successes, others may attack third parties using computers connected to Janet and to which they have gained control. Organisations whose systems are used in these ways are likely to be held responsible. The use of Janet to disseminate unwanted, offensive or illegal material is also likely to be seen as misuse of a publicly-funded resource.</li> <li><strong>Legal action.</strong> National and international law is increasingly concerned with data networks and is placing a growing list of obligations on those who provide them. Individuals, organisations and network operators who, by action or inaction, fail to meet their legal obligations may be punished by the criminal law, have substantial financial damages awarded against them or be required to modify or cease their networking operations.</li> </ul><p>The openness of Janet and other connected networks may allow the impact of a security breach to spread far beyond an original insecure system or action. The same openness means that it will rarely be possible to protect organisations and users against the immediate consequences of their insecure actions: more often it will be necessary to respond promptly to security breaches by isolating the systems and organisations affected until the problem has been resolved. However, the more secure individual organisations are, the more secure the Janet network will be.</p> <div> <br/><div id="ftn1"></div> </div> </div></div></div> <div id="book-navigation-641" class="book-navigation"> <ul class="clearfix book-pager"> <li><a href="/web/20230602185410/https://community.jisc.ac.uk/library/janet-policies/references" class="page-previous" title="Go to previous page">‹ References</a></li> <li><a href="/web/20230602185410/https://community.jisc.ac.uk/library/janet-policies" class="page-up" title="Go to parent page">up</a></li> <li><a href="/web/20230602185410/https://community.jisc.ac.uk/library/janet-policies/terms-provision-janet-service" class="page-next" title="Go to next page">Terms for the Provision of the Janet Service ›</a></li> </ul> </div> <div class="field field-name-field-libtags field-type-taxonomy-term-reference field-label-hidden clearfix"><div class="field-items"><div class="field-item even"><a href="/web/20230602185410/https://community.jisc.ac.uk/library/tags/security-policy">security policy</a></div></div></div><ul class="links inline"><li class="service-links-twitter first"><a href="http://web.archive.org/web/20230602185410/https://twitter.com/share?url=https%3A//community.jisc.ac.uk/library/janet-policies/security-policy&text=Security%20Policy" title="Share this on Twitter" class="service-links-twitter" rel="nofollow" target="_blank"><img src="http://web.archive.org/web/20230602185410im_/https://community.jisc.ac.uk/sites/all/modules/contrib/service_links/images/twitter.png" alt="Twitter logo"/></a></li><li class="service-links-linkedin"><a href="http://web.archive.org/web/20230602185410/https://www.linkedin.com/shareArticle?mini=true&url=https%3A//community.jisc.ac.uk/library/janet-policies/security-policy&title=Security%20Policy&summary=Janet%20Security%26nbsp%3BPolicyTitle%3A%26nbsp%3B%26nbsp%3BJanet%20Security%20PolicyReference%3A%26nbsp%3BMF-POL-007Issue%3A%26nbsp%3B%26nbsp%3B5.1Document%20owner%3A%26nbsp%3B%26nbsp%3B%26nbsp%3BJohn%20Chapman%2C%20Director%20information%20security%20policy%20and%20governanceAuthorised%20by%3A%26nbsp%3B%26nbsp%3B%26nbsp%3BSteve%20Masters%2C%20Group%20CTODate%3A%26nbsp%3B2%20March%202023Last%20reviewed%3A2%20March%202023&source=Jisc%20community" title="Publish this post to LinkedIn" class="service-links-linkedin" rel="nofollow" target="_blank"><img src="http://web.archive.org/web/20230602185410im_/https://community.jisc.ac.uk/sites/all/modules/contrib/service_links/images/linkedin.png" alt="LinkedIn logo"/></a></li><li class="service-links-google-plus"><a href="http://web.archive.org/web/20230602185410/https://plus.google.com/share?url=https%3A//community.jisc.ac.uk/library/janet-policies/security-policy" title="Share this on Google+" class="service-links-google-plus" rel="nofollow" target="_blank"><img src="http://web.archive.org/web/20230602185410im_/https://community.jisc.ac.uk/sites/all/modules/contrib/service_links/images/google_plus.png" alt="Google+ logo"/></a></li><li class="service-links-reddit"><a href="http://web.archive.org/web/20230602185410/https://reddit.com/submit?url=https%3A//community.jisc.ac.uk/library/janet-policies/security-policy&title=Security%20Policy" title="Submit this post on reddit.com" class="service-links-reddit" rel="nofollow" target="_blank"><img src="http://web.archive.org/web/20230602185410im_/https://community.jisc.ac.uk/sites/all/modules/contrib/service_links/images/reddit.png" alt="Reddit logo"/></a></li><li class="service-links-stumbleupon"><a href="http://web.archive.org/web/20230602185410/http://www.stumbleupon.com/submit?url=https%3A//community.jisc.ac.uk/library/janet-policies/security-policy&title=Security%20Policy" title="Thumb this up at StumbleUpon" class="service-links-stumbleupon" rel="nofollow" target="_blank"><img src="http://web.archive.org/web/20230602185410im_/https://community.jisc.ac.uk/sites/all/modules/contrib/service_links/images/stumbleit.png" alt="StumbleUpon logo"/></a></li><li class="statistics_counter last"></li></ul></div> </div> </div> </div> </div> </div> </div> </div></section> <footer id="section-footer" class="section section-footer"> <div id="zone-footer-wrapper" class="zone-wrapper zone-footer-wrapper clearfix"> <div id="zone-footer" class="zone zone-footer clearfix container-12"> <div class="grid-12 region region-footer" id="region-footer"> <div class="region-inner region-footer-inner"> <div class="block block-jisc-footer block-jisc-footer-top block-jisc-footer-jisc-footer-top odd block-without-title" id="block-jisc-footer-jisc-footer-top"> <div class="block-inner clearfix"> <div class="content clearfix"> <div id="footertop"> <div class="footer-row"> <h2 class="h2">Contact our support teams</h2><div id="selenium-highlight"> </div> </div> <div class="footer-row"> <p><b>Janet service desk</b><br/>0300 300 2212<br/><a href="http://web.archive.org/web/20230602185410/mailto:service@ja.net">service@ja.net</a><br/>07:00 - 00:00 (Monday to Friday)</p><div id="selenium-highlight"> </div> </div> <div class="footer-row"> <p><strong>General enquiries</strong><br/>0203 006 6077<br/><a href="http://web.archive.org/web/20230602185410/mailto:help@jisc.ac.uk">help@jisc.ac.uk</a><br/>09:00 - 17:00 (Monday to Friday)<br/> </p><div id="selenium-highlight"> </div> </div> <div class="footer-row"> <p><a href="http://web.archive.org/web/20230602185410/https://community.jisc.ac.uk/library/janet-policies/janet-websites-terms-and-conditions">Community T&Cs</a><br/><a href="http://web.archive.org/web/20230602185410/https://community.jisc.ac.uk/library/janet-policies/janet-cookies">Cookies</a><br/><a href="http://web.archive.org/web/20230602185410/https://www.jisc.ac.uk/website/privacy-notice">Privacy</a><br/><a href="http://web.archive.org/web/20230602185410/https://community.jisc.ac.uk/accessibility-statement" title="View our accessibility statement">Accessibility Statement</a></p><div id="selenium-highlight"> </div><div id="selenium-highlight"> </div> </div> <div style="clear"></div> </div> </div> </div> </div> </div> </div> </div> </div><div id="zone-privacy-wrapper" class="zone-wrapper zone-privacy-wrapper clearfix"> <div id="zone-privacy" class="zone zone-privacy clearfix container-12"> <div class="grid-12 region region-privacy" id="region-privacy"> <div class="region-inner region-privacy-inner"> <div class="block block-jisc-footer block-jisc-footer-bottom block-jisc-footer-jisc-footer-bottom odd block-without-title" id="block-jisc-footer-jisc-footer-bottom"> <div class="block-inner clearfix"> <div class="content clearfix"> <div id="footerbottom"> <div id="footerlogo"> <img alt="Jisc logo" src="http://web.archive.org/web/20230602185410im_/https://community.jisc.ac.uk/sites/all/modules/custom/jisc_footer/logo.png"/> </div> <div id="footerbottombody"> <p>We listen to you to ensure we offer the very best in specialist <a href="http://web.archive.org/web/20230602185410/http://www.jisc.ac.uk/advice/">advice, guidance and tools</a>.</p><p> </p><p>Find out more at <a href="http://web.archive.org/web/20230602185410/http://jisc.ac.uk/">Jisc.ac.uk</a></p><div id="selenium-highlight"> </div> </div> <div id="footerbottomlinks"> <h3 class="h3">Advice</h3><p><a href="http://web.archive.org/web/20230602185410/http://jisc.ac.uk/guides">Guides</a><br/><a href="http://web.archive.org/web/20230602185410/http://jisc.ac.uk/advice/training">Training</a></p><div id="selenium-highlight"> </div> </div> <div style="clear:both;"></div> </div> </div> </div> </div> </div> </div> </div> </div> <div id="page_bottom"><div class="container-12"></div></div> </footer> </div> <div id="user_relationships_popup_form" class="user_relationships_ui_popup_form"></div> </body> </html>