Because a compromise of the security of an individual machine within our network can have serious repercussions to other machines, it is vital to maintain a certain degree of good security practices everywhere on our networks. Therefore in this policy, we define a set of requirements to which all systems must conform in order for our community to remain safe from hostile attacks.

• Systems found to be continually in violation of important policy requirements may be unceremoniously removed from the network .
• All EECS/ERL computing systems are required to have a general point of contact (POC). This POC is responsible for the system's administrative management. All EECS/ERL systems are also required to have a technical point of contact (technical POC). The EECS/ERL security team will coordinate with the technical POC of a system for any security related incidents. It is the technical POC's responsibility to perform all required and necessary system administration in a timely manner. We strongly recommend that the technical POC be a professional system administrator.

• All EECS/ERL computer systems are required to be properly registered in EECS/ERL databases (a hardware Ethernet address is required to obtain services). A system can only use its authorized IP address and DNS name.
• All EECS/ERL computer systems are required to be configured with the appropriate permissions and access controls.
• All EECS/ERL non-UNIX/Linux systems are required to have up-to-date virus protection, preferably auto-updated if possible. Routine checks, audit trails, and logging are highly encouraged.
• All technical POCs are required to be on the EECS/ERL system administrator mailing list.