Basic rules
Basic rules
Basic rules of IT security
The following basic IT security guidelines are intended to assist all users (staff, students and external users) of the UOL campus network.
The term ‘IT device’ is used here to refer to laptops, desktops, tablets, smartphones and smartwatches. This applies to both work and personal devices. The term ‘campus network’ encompasses not only LAN connections but also Wi-Fi and mobile access via VPN.
Please reportany faults to:
The following people are available as points of contact: Matthias Schröder & Marco Scharringhausen
Network access and the internet
Connecting IT devices to the campus network is generally permitted.
Work laptops must be connected to the campus network at least once a month. This ensures that the software on the devices is updated in good time.
All IT devices connected to the campus network must run an operating system that is still supported by the manufacturer (Windows 11, Ubuntu 22.04/24.04, macOS 13, iOS 18/26 or similar).
Every device must have up-to-date malware protection (a.k.a.‘virus scanner’) installed; on university devices, SentinelOne is mandatory. See the university websites for download and installation instructions (Linux, Windows, Mac): https://software.uni-oldenburg.de/software/SentinelOne/
Devices running older operating systems (e.g. laboratory PCs used for data acquisition) may only be connected to network sockets that are explicitly marked ‘Lab network’. No other devices may be connected to this network.
Workstation and office
When away from your workstation, you must ensure, by locking your screen or PC, that unauthorised persons cannot access the IT device, the campus or laboratory network, or any confidential data.
This can be ensured, for example, by activating a screen lock. The screen lock can usually be activated using the ‘Windows key + L’.
Email attachments from unknown senders must not be opened.
Hyperlinks should only be opened after carefully checking the email (sender, destination of the link – this can be checked, for example, by hovering the mouse pointer over it).
Software and virus protection
If a virus or other malware is detected – for example, by a virus scanner or similar tool – the affected member of staff must contact the ICBM IT department immediately. The IT device must be disconnected straight away from the campus network (including the VPN) or the laboratory network.
Hardware
Mobile devices (e.g. laptops, smartphones, data storage devices) must always be kept secure
and must never be handed over to anyone outside the university.If IT devices are serviced or repaired off-site, all confidential data must be backed up and then permanently deleted from the device so that it cannot be recovered. If this is not possible for technical reasons, the storage medium must be removed.
All IT devices containing data requiring protection that are no longer needed or are faulty must be disposed of properly; for university-owned devices, this can be arranged via the university’s electronics workshops.
This means that the data requiring protection must be removed, or the devices disposed of (by professional waste management companies), in such a way that the data cannot be recovered. The ICBM IT department provides support with this.
The use of personal peripheral devices (e.g. USB sticks or hard drives) on university IT equipment is discouraged.
Data storage media
Staff members are responsible for the secure and proper use and storage of the data storage media they use.
Before passing on a data storage medium, it must be ensured (e.g. by first deleting the data in a way that cannot be recovered) that it contains only the data intended for transfer.
All staff members are responsible for ensuring that the information they pass on is only shared with authorised recipients.
Data storage media must always be checked for viruses before dispatch. The sender of the data storage medium is responsible for ensuring that it is free of viruses.
All electronic documents for which no further processing is desired or intended may only be released externally in PDF format with protection against modification and, where applicable, copying
.
Passwords
A password should be at least 12 characters long and not easy to guess; it should consist of upper- and lower-case letters and contain at least one number or special character. It should not contain any words or parts of words that can be found in a German dictionary. The same applies to names or parts of names.
Passwords used to log in to UOL services must not be used for other services (e.g. private email accounts or similar).
Passwords should not be written down on paper or similar media. It is advisable to use password management software (‘password vault’; the University recommends KeepassXC).