SCE Acceptable Usage Policy

1.0 Purpose This advisory is provided to all prospective users of the University of Illinois Chicago (UIC) Secure Compute Environment (SCE). Its purpose is to clearly communicate the security risks associated with remote access and to define the user's personal responsibility in maintaining a secure connection.

2.0 The Secure Environment vs. The Endpoint SCE is a highly controlled environment with multiple layers of security, including network isolation, encryption, and strict access controls, managed by the ACER team. However, the overall security of a remote session is a shared responsibility. While ACER secures the central environment, you are responsible for securing the device (e.g., laptop, desktop) you use to connect.

3.0 Endpoint Security Risks Connecting from a compromised, misconfigured, or insecure device poses a significant risk to the data within the SCE. Malicious software (e.g., keyloggers, spyware) on your device could capture your credentials or the sensitive data you are working with, leading to an unauthorized disclosure of Controlled Unclassified Information (CUI).

4.0 User Responsibilities As a user of the SCE, you are responsible for taking reasonable measures to secure the device you use for remote access. These measures include:

· Ensuring your device's operating system is a supported version and is kept up-to-date with security patches.

· Ensuring your device's primary hard drive is encrypted (e.g., BitLocker for Windows, FileVault for macOS).

· Ensuring your device has an active, up-to-date anti-malware solution.

· Ensuring your device's built-in firewall is enabled.

· Ensuring your device is configured to automatically lock the screen after a reasonable period of inactivity.

5.0 Attestation As part of the access request process for the SCE, all users are required to formally comply and confirm that they have read, understood, and accept the responsibilities outlined in this advisory.

Minimum Security Requirements for Devices Checklist

As a user of the SCE, you are responsible for taking reasonable measures to secure the device you use for remote access. The following checklist outlines the minimum security requirements for any device connecting to the SCE.
Requirement Description
Supported Operating System Your device's operating system (e.g., Windows, macOS) must be a version that is actively supported by the vendor and must be kept up-to-date with security patches.
Full Disk Encryption The primary hard drive on your device must be encrypted to protect data at rest. (e.g., BitLocker for Windows, FileVault for macOS).
Anti-Malware Software Your device must have an active, up-to-date anti-malware solution from a reputable vendor.
Firewall Enabled Your device's built-in host-based firewall must be enabled to help block unsolicited network connections.
Automatic Screen Lock Your device must be configured to automatically lock the screen after a reasonable period of inactivity (e.g., 15 minutes) to prevent unauthorized access.