Network Policies

An acceptable use policy (AUP) is a document that explains how employees must act when they use an organisation's IT systems. Staff read and sign it before they are given an account, so everyone knows what is allowed and what happens if they break the rules.

What an AUP covers

• Password policy — the rules for how strong a password must be and how often it must change.
• Logging off or locking computers — for example locking the screen when you leave your desk, so a passer-by cannot use your account.
• Internet use — which websites and downloads are allowed, so malware is less likely to get onto the network.
• Email use — what may be sent from a work account, which helps prevent confidential files leaving the organisation.
• Personal devices — whether phones and tablets may connect; a device the IT team has not checked and updated could carry malware.

How it is enforced

An AUP cannot physically stop anything happening — technical controls such as a firewall do that. It works by defining permitted activities and the consequences of breaking the rules: a first breach usually brings a formal warning, and a serious one, such as deliberately leaking customer records, can lead to dismissal or legal action. Because staff know the result in advance, most avoid risky behaviour, so the policy deters unsafe practice.

Password policies in detail

A password policy sets the rules for a strong password: a minimum length, at least one lowercase letter, one uppercase letter and one symbol, and a regular change, for example every 90 days. Passwords must not be based on personal information such as a name or birthday, on a dictionary word, or on anything easily guessed, because attackers know these patterns. A brute-force attack keeps trying combinations, and each extra character and symbol makes the number of guesses needed far larger. Bluebird2011 fails twice over: “bluebird” is a dictionary word and the year could be found on social media. Something like vQ7#mLp2 has no meaning to guess from.