THE LYNDE AND HARRY BRADLEY FOUNDATION, INC.

COMPUTER POLICY

September 8, 2006

System file structure

A: is the external floppy drive at your workstation

C: is the hard drive at your workstation

D: is the CD-ROM drive at your workstation

Network drives:

H:\ is the shared directory, anyone can access

J:\ contains the shared Gifts Database directory

L:\ contains StyleAdvisor software

P:\ contains Great Plains database software

S:\ contains ACT database software

T:\ contains the GreatPlains Reports

U:\NAME\ is your personal directory, only you have access to it

You may create subdirectories for your own use in either the H or U directories. Other directories not accessible.

Be careful not to change the structure of someone else's files as the path will be important in locating their file.

Virus checking and reporting procedures

The McAfee Virus Software installed at the server automatically updates the virus definitions both at the server and the workstations at 8 p.m. daily and at each startup. The virus scan runs each night. It also scans the files at each workstation. It automatically scans all disks/CDs prior to use at your workstation.

Suspected unauthorized access reporting procedures

Report to network administrator any unusual changes in the location, appearance or behavior of your files, as well as any attempts of unauthorized access.

Internet usage and file download guidelines

Netscape Navigator and Internet Explorer are available as web browsers. Enter the address (URL) at the http:\www entry line on the screen for the site you want to visit. Use search engines to locate sites and information. All files downloaded from the Internet should be saved to a disk and virus scanned first.

System usage guidelines

Restricted hours to log on (usually 7a-6p; can be adjusted).

Sensitive data transfer and storage procedures

Will be undertaken by system administrators only.

Non-standard application installation and usage procedures

All software must be installed by network administrator. Do not bring disks or CDs from home to use without prior permission. If you need a special software to perform your work-related duties, please consult network administrator.

Non-standard equipment usage procedures

Workstations consist of Compaq, HP or Dell computers with at least 400 mhz, 128mg RAM, 6 gig memory. All have surge protection, keyboard, mouse, speakers, CD-ROM drive, and access to a printer. If additional equipment is required, please contact network administrator.

Physical security requirements

When leaving the building overnight, the workstation should be shut down. Use ctrl/alt/del to lock your workstation if you leave your desk for any length of time during the day. Electric appliances, such as heaters, and anything magnetic, should be kept away from the CPU.

Network and workstation password requirements

Network/Windows password, minimum 5 characters, 8 preferred.

Prefer non-dictionary words combining upper and lower case characters and even symbols. (An ideal password might be something like 2B3#N3$.) Passwords are changed at least three times per year (every 4 months) when administrator requests. Three attempts with wrong password will lock user out until network administrator unlocks.

Application upgrade procedures

Network administrator will monitor the need for upgraded software and install accordingly.

System back up and restore procedures

Log off by 10:30pm; system will shut your station down when back-up runs 10:30pm-2am, Mon-Fri. E-mail files are also backed up once a month, although retrieval of select mail is not an option. It is only to restore the entire system as it existed at time of backup. If a file becomes corrupt, is inadvertently deleted, or changed causing you to need a file restored to the way it was within the last two weeks, it can be restored from a previous backup, see network administrator. Quarterly, a full back-up tape is saved off- premise for two years, and a year end tape is saved indefinitely.

Printers

--	The Foundation uses mostly HP laser jet printers.

--	All workstations are connected to all network printers.

--	Color printers are located on the 3rd floor of the Hawley House and Lower Level of the Lion House.

--	Some workstations may have a local printer.

--	Problems or questions regarding the printer and printer capabilities should be brought to network administrator. attention.

VPN Policy

The Foundation is implementing a Virtual Private Network (VPN) for access to Foundation computer files while away from the office. Permission to use the VPN must be obtained from the President; the network administrator will install the software.

E-mail

You are assigned a mailbox name by network administrator. It is used to send and receive E-mail. It is usually your "first name initial and last name" @bradleyfdn.org" and is referred to as your Internet address. Do not forward chain letters!

E-mail files will be virus scanned as they arrive at the server and therefore should be safe to open. If an e-mail attachment does not open, it is probably because we do not have the software the mail was created in, in order to open it. There probably is a work around solution in order for you to view/print the file. See network administrator. for assistance.

Remember, all e-mails received are the property of the Bradley Foundation. All e-mails sent represent the Bradley Foundation. Please empty your deleted mail box to free space on the network drive at least once a week. Anti-spam software is in place. If you are not receiving mail as you should, or if spam items continue to appear, please contact network administrator.

Termination

When an employee leaves the Foundation, network access is immediately terminated.

Any questions or problems should be reported to network administrator.

U:\YVONNE\SYSADM\c-policy.wpd

/clements

1CISCO SYSTEMS' "10 BASIC CYBER

SECURITY TIPS FOR SMALL

BUSINESSES"

1.Encourage or require employees to

choose strong passwords. Hacker

programs available on the Internet

contain tens of thousands of common

passwords, which can be used to break

into unsecured computer systems. A

password should have a minimum of 8

characters. They should be

non-dictionary words. They should

combine upper and lower case

characters. You can even mix in a

symbol, like a $. An ideal password

might be something like 2B3#N3$.

2.Require new passwords every 90 days.

By the time a hacker gets your password,

it will already be outdated.

3.Make sure your virus protection

subscription is current. Most businesses

purchase virus protection programs from

companies like Norton or McAfee. These

companies regularly offer patches and

updates to their programs to respond to

new threats. Companies should regularly

check for defense improvements and be

sure their subscription to virus protection

updates remains current.

4.Educate employees about attachments.

Just because it's in the "in-box" doesn't

mean it's been cleared through any

security mechanism. Attachments,

particularly executables (with .exe at the

end) can be dangerous, dropping off a

little software code called a "Trojan

Horse" that corrupts your system or

allows it to be infiltrated at a later time.

Employees should be educated about

security basics, including the need to

avoid opening attachments from unknown

sources.

5.Install a total solution. If you're

securing your own system (instead of

relying upon an ISP or web host), don't

just throw a firewall at a network and

call it secure. Firewalls do a great job of

securing a perimeter, but no one device

will do the trick. Complete solutions

should include firewalling, intrusion

detection and policy management.

6.Assess your security posture regularly.

Don't secure and run. Hackers are

constantly updating their technology.

Small and medium businesses need to

know how they stack up against the most

current types of attack. If you're relying

on a Web host or ISP, be sure to choose a

vendor who is security savvy. Compare

their offerings to those of other

companies.

7.When an employee leaves a company,

remove the employee's network access

immediately. When asked to evaluate the

internal security posture of networks, the

Cisco Security Consulting team finds

vulnerabilities in almost every network

tested. Just as you ask departing

employees to turn in their keys to the

front door, you should take away their

key to the network when they leave.

Disgruntled employees are the greatest

threat to any systems' security.

8.If you allow people to work at home,

provide a secure, centrally managed

server for remote traffic.

Telecommuting increases worker

satisfaction and productivity. But it also

presents a security challenge. It makes

little sense to spend $10,000 on a

security system for your Web site while

you allow people to dial-in to your

network unabated.

9.Update your Web server software

regularly. Stay on top of security updates

and patches. These are often available

for free over the Web. Make sure you're

always running the latest versions of

software to stay ahead of hackers, who

are certainly working to stay ahead of

you.

10.Don't run any unnecessary network

services. If your employees don't need

Web access, don't provide it. If you don't

need services such as NFS, Finger, Echo

or some of the other programs that are

routinely provided with software suites,

make sure they're turned off. Often, a

variety of services are provided by

default in a program. Exploitation of

these services is one of the most common

hacks seen by Cisco's customers.

Passwords—These basic security codes typically

reside in unique form with each user. They "unlock"

electronic gates that protect individual computer files,

servers, or entire networks. To make passwords

difficult to crack, they should be a combination of

letters and numbers in upper and lower case.

Virus detection—This software scans computer files

every time a PC is turned off or on in order to detect

viruses that may have penetrated a network. The

software is able to identify, and in many cases

eliminate, hostile viruses before they do any damage to

an individual PC or an entire network. It is essential for

an organization to keep its virus protection measures

up-to-date, because new viruses are discovered every

day.

Firewalls—A firewall acts as a gateway between your

network and the outside world, preventing access to

any entity that uses inappropriate or unauthorized login

information. The most sophisticated firewall solutions

provide multiple layers of protection, from looking at

the IP address of anyone trying to enter your network

to creating usage reports and notifications of potential

violations. Proper installation of these systems is

crucial. The recent security report by eMarketer

indicated that many firms improperly install firewall

software, leaving their systems vulnerable to attack.

Encryption—This solution provides for security at the

network level and for Web servers by coding all data

that is sent between two or more parties that have

access to or use the network. Encryption is used in

many Internet business technologies. E-commerce

transactions are commonly encrypted using Secure

Sockets Layer (SSL) or other commerce standards.

VPNs utilize "tunneling" protocols to encrypt data so

that it cannot be understood as it travels over the

public network.

Digital Certificates—Essentially functioning as virtual

passports, these security tools identify parties seeking

access to a proprietary network through a technology

known as Public Key Infrastructure (PKI). PKI

creates electronic "signatures" that are unique to each

person attempting to access various sectors of a

network.

PC and network monitoring—Perhaps the least

"high tech" of all these approaches, but possibly the

simplest and one of the most effective, is the regular

monitoring of a company network by a staff member

for vulnerabilities or intrusions. Carnegie Mellon

University's Computer Emergency Response Team

estimates that about 75 percent of the successful

attacks on networks by hackers occur because of

well-known software bugs that have not been

discovered and eliminated by network managers.

3>Web Browsers are a threat in themselves.

Java, ActiveX and similar programming languages allow people to download code and execute programs locally. Besides allowing you to surf the internet for information and run real-time services, browsers downloading malicious code to your computer can

a) modify your local Hard Drive Information

b) Access other computers as if it were you

3) Send Email signed by you

4) Execute a Virus or download a Trojan Horse

5) Purchase goods or transfer funds as if it were you

6) Change Security settings

Programs that Browsers Execute

-Interpreters for HTML, DHTML, and XML

-JavaScript, Java Applets, ...

Programs installed to extend Browser capabilities

-Navigator plug-ins such as the RealAudio plug-in

-Internet Explorer ActiveX controls

Working with digital signatures

>Encourage or

require Employees to Choose Strong Passwords