Objective: The policy aims to establish controls and guidelines for the proper use and protection of email within the organization.
Scope: This policy applies to all email systems and users within the organization.
Policy Details:
A. General Rules:
- All email correspondence is the property of the organization, which reserves the right to audit and monitor email content for its protection. Auditing requires approval from senior management, coordinated with the information security manager.
B. Duties of the System Manager:
- Protect the email system using modern technologies and anti-malware programs.
- Determine allowable file types and sizes for uploads based on work requirements.
- Provide email encryption for employees.
- Manage email accounts and permissions based on job descriptions.
- Ensure backups of files and messages.
- Educate users about secure email use.
C. Duties of Employees:
- Adhere to the Acceptable Use Policy.
- Do not share email account access without necessary approval.
- Handle emails and files according to their confidentiality classification.
- Encrypt confidential or top-secret information before sending.
- Avoid responding to suspicious messages and report them to the system administrator.
- Verify message sources before interacting.
Simulation of Email Policy:
- Acceptable Example: The University of Fallujah implemented monitoring and protection measures, conducted user awareness workshops, and established a protocol for reporting suspicious messages.
- Unacceptable Example: An employee used a private email for sensitive information, lacked awareness about monitoring, and failed to take necessary security precautions, leading to data breaches.
Outcomes:
- Positive Outcome: Proper email usage protects information and fosters trust among users.
- Negative Outcome: Compromised data due to non-adherence to procedures.
Conclusions: Adhering to the email policy is critical for safe and effective email use at Fallujah University.
Recommendations:
A. Regularly review and update email policies to address evolving needs and threats.
B. Implement ongoing awareness programs about email security.
C. Conduct periodic evaluations of the email system for efficiency and security.
