<p><a href="/fi/tutustu-meihin/tietotekniikkarikkomuksen-seuraamuskaytanto">Policy on Consequences of Breaches of IT Security in Finnish</a></p>


<p>This document contains descriptions of the measures taken against a person in case of a breach of IT security being detected or if there is good reason to suspect it. The measures have been divided into restrictions on authorisation for the time of the investigation of the breach and the possible consequences laid down for the breach.</p>


1.1	Purpose

<p>The Policy on Consequences applies to and binds all members of the higher education community of Tampere that comprises the University of Tampere and Tampere University of Applied Sciences (hereinafter "University"), the users of the IT services and information systems of the universities and their various units.</p>


1.2	To whom does this Policy on Consequences apply?

<p>Policies, terms of use and guidelines are used to ensure that the University’s information property shall remain confidential, intact and available, in order to protect the legality of data processing and the legal obligations set forth by laws and decrees (such as the General Data Protection Regulation of the EU and statutes related to information and communication crimes).</p>

<p>The University processes materials that are classified for the use of authorities, which means that a certain level of information security requirements must be followed (such as Section 8031, Level II of the Katakri auditing tool).</p>


1.3	Why is a Policy on Consequences needed?

1	Scope

<p>Deeds in conflict with the terms of use and regulations concerning the University’s information systems or usage of information systems in ways that constitute a breach of Finnish legislation are considered breaches of information security.</p>


Breach of information security

<p>The duty to report any possible breaches and suspicions thereof to an information security specialist, to administration or in accordance with other types of guidelines provided binds everyone.</p>


2.1	Reporting duty

<p>When a breach has been detected or one is suspected, a decision of a restriction of user rights is made. Authorisation is always restricted when it is suspected, with good reason, that the user is guilty of wrongful actions or if it is possible that the authorisation may compromise the investigation of the breach or minimisation of resulting damages. If needed, the user will be called in to be heard.</p>

<p>The owner of the IT service, the head of the unit in question, the Chief Information Officer or other person appointed for the task will make the decision on the restriction of authorisation. The administrator of the service will implement the restrictions.</p>

<p>It is possible to revoke the restrictions once the investigation has been completed and the restoration of authorisation does not cause evident harm.</p>


2.2	Restriction of rights

<p>Cases in which there is reason to believe that the breach will have a substantial effect on the information security of the University or the data protection of an individual, the Chief Information Officer and/or administrator can make the decision to restrict a user’s authorisation for no longer than five (5) working days, of which the owner of the service and Director of IT Services must be informed immediately.</p>


2.3	Urgent cases

2	Breach of information security

<p>In less severe cases, the user will be reprimanded for inappropriate conduct.</p>

<p>A user may become liable for damages to the resources (servers, information network, etc.) he/she has used wrongfully, the direct damages and the expenses generated by the investigation.</p>


Consequences

<p>Consequences for a student may include the revocation or restriction of authorisation for a fixed term, administrative measures taken by the University (written warning, temporary suspension), and the offence being reported to the police (if the deed is punishable by law).</p>

<p>The Chief Information Officer will make decisions pertaining the measures on authorisation. The time of the investigation will not be counted in the period of time of the restrictions of authorisation. The decision on issuing a written warning to a student will be made by the rector of the University, whereas the University Board will decide on a temporary suspension. The individual’s authorisation will be revoked for the duration of the suspension.</p>

<p>The total time that a user’s authorisation is restricted must comply with the minimum time indicated in the table of breaches of IT security (Appendix A).</p>

<figure role="group"><div class="embedded-file"><svg height="25" width="25" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><polygon points="22 18 22 20 2 20 2 18 0 18 0 20 0 22 2 22 22 22 24 22 24 20 24 18 22 18"></polygon><polygon points="12 18 18.55 11.46 17.09 10 13 14.09 13 2 11 2 11 14.09 6.91 10 5.46 11.46 12 18"></polygon></svg><span class="visually-hidden">Download</span><a href="https://content-webapi.tuni.fi/proxy/public/2022-05/policy-on-consequences-of-breaches-of-it-security-appendixa.pdf"><span>Policy on Consequences of Breaches of IT Security - Appendix A (PDF, 147.94 KB) </span></a></div></figure>


3.1	Consequences for a student

<p>Consequences for a member of staff may include legal consequences in accordance with labour legislation by the University (written warning, dismissal or termination of employment) and the offence being reported to the police (if the deed is punishable by law).</p>

<p>Authorisation to use a certain system can be revoked temporarily or permanently, due to a lack of confidence resulting from the breach. The Chief Information Officer, the owner of the service or head of unit will make decisions pertaining to measures concerning authorisation.</p>


3.2	Consequences for members of staff

<p>Consequences for users who are not staff or degree students of the University may include the revocation or restriction of authorisation and reporting the offence to the police (if the deed is punishable by law).</p>

<p>Authorisation to use a certain system can be revoked temporarily or permanently, due to a lack of confidence resulting from the breach. The Chief Information Officer, the owner of the service or head of unit will make decisions pertaining to measures concerning authorisation.</p>


3.3	Consequences for other users

<p>The tables appended to this document include guidelines for the consequences of breaches of IT security to students of the University (Appendix A), University staff (Appendix B) and other users (Appendix C).</p>

<figure role="group"><div class="embedded-file"><svg height="25" width="25" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><polygon points="22 18 22 20 2 20 2 18 0 18 0 20 0 22 2 22 22 22 24 22 24 20 24 18 22 18"></polygon><polygon points="12 18 18.55 11.46 17.09 10 13 14.09 13 2 11 2 11 14.09 6.91 10 5.46 11.46 12 18"></polygon></svg><span class="visually-hidden">Download</span><a href="https://content-webapi.tuni.fi/proxy/public/2022-05/policy-on-consequences-of-breaches-of-it-security-appendixa.pdf"><span>Policy on Consequences of Breaches of IT Security - Appendix A (PDF, 147.94 KB) </span></a></div></figure>

<figure role="group"><div class="embedded-file"><svg height="25" width="25" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><polygon points="22 18 22 20 2 20 2 18 0 18 0 20 0 22 2 22 22 22 24 22 24 20 24 18 22 18"></polygon><polygon points="12 18 18.55 11.46 17.09 10 13 14.09 13 2 11 2 11 14.09 6.91 10 5.46 11.46 12 18"></polygon></svg><span class="visually-hidden">Download</span><a href="https://content-webapi.tuni.fi/proxy/public/2022-05/policy-on-consequences-of-breaches-of-it-security-appendixb.pdf"><span>Policy on Consequences of Breaches of IT Security - Appendix B (PDF, 148.95 KB) </span></a></div></figure>

<figure role="group"><div class="embedded-file"><svg height="25" width="25" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><polygon points="22 18 22 20 2 20 2 18 0 18 0 20 0 22 2 22 22 22 24 22 24 20 24 18 22 18"></polygon><polygon points="12 18 18.55 11.46 17.09 10 13 14.09 13 2 11 2 11 14.09 6.91 10 5.46 11.46 12 18"></polygon></svg><span class="visually-hidden">Download</span><a href="https://content-webapi.tuni.fi/proxy/public/2022-05/policy-on-consequences-of-breaches-of-it-security-appendixc.pdf"><span>Policy on Consequences of Breaches of IT Security - Appendix C (PDF, 157.91 KB) </span></a></div></figure>

<p>The tables include examples of typical breaches that take place when information systems are used, and these are classified according to the severity of the breach. In addition to the severity of the deed, its intent is a factor that impacts the severity of consequences. If the user is both a student and a member of staff, the table concerning staff will be applied.</p>


3.4	Tables of consequences

<p>Unlawful processing of material subject to the penal code and copyright laws.</p>

<ul>
	<li>Materials subject to the penal code include but are not limited to violence, racist materials and demagogic materials.</li>
	<li>Processing includes but is not limited to the distribution and possession of the materials.</li>
</ul>

<p>Materials subject to copyrights include music, videos, comics, films, games and software, etc.</p>

<p>Disclosure of a user ID includes, for example</p>

<ul>
	<li>sharing a password with another user</li>
	<li>leaving a computer logged in so that another person can access its contents with someone else’s user name.</li>
</ul>

<p>Risking the confidentiality of information includes, for example,</p>

<ul>
	<li>disclosing confidential or otherwise legally protected information to a person who is not entitled to receive it (for example disclosing information about users of the servers)</li>
	<li>neglecting to abide by the information security requirements of confidential information (passive failure to operate)</li>
	<li>intentional breaches of confidentiality (active operation)</li>
	<li>breaches of the Data Protection Act&nbsp;</li>
</ul>

<p>Negligence of personal data protection include, for example,</p>

<ul>
	<li>leaving a password unprotected</li>
	<li>negligence of University data back-up practice</li>
</ul>

<p>A service refers to a function that can be used in a location other than a certain computer. For example</p>

<ul>
	<li>e-mail services</li>
	<li>data transfer services</li>
	<li>peer-to-peer network for data transfer</li>
</ul>


3.5	Examples of abuse of IT Services

3	Consequences

<p>These Terms of Use will be valid as of 1 January 2019.</p>


4.1	Coming into force

<p>This document will be revised if and when needed, so that it will correspond to the valid services and legislation.</p>

<p>The most important changes will be processed in a cooperation procedure.</p>

<p>The IT Administration will make decisions on the need for changes.</p>

<p>Information on the amendments will be provided via the normal channels of communication, and not personally.</p>


4.2	Managing changes

<p>Permission for exceptions to the Policy can be granted for compelling reasons upon written application.</p>

<p>Permits for exceptions are granted by the IT Administration.</p>

<p>The permit may include additional terms and conditions, restrictions and responsibilities.</p>


4.3	Exceptions to the Policy

<p>The responsibility for the supervision of this Policy is determined in the Information Security and Data Protection Policies of the University.</p>


4.4	Supervision

4	Other provisions

<p>Consequences for a student:</p>

<figure role="group"><div class="embedded-file"><svg height="25" width="25" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><polygon points="22 18 22 20 2 20 2 18 0 18 0 20 0 22 2 22 22 22 24 22 24 20 24 18 22 18"></polygon><polygon points="12 18 18.55 11.46 17.09 10 13 14.09 13 2 11 2 11 14.09 6.91 10 5.46 11.46 12 18"></polygon></svg><span class="visually-hidden">Download</span><a href="https://content-webapi.tuni.fi/proxy/public/2022-05/policy-on-consequences-of-breaches-of-it-security-appendixa.pdf"><span>Policy on Consequences of Breaches of IT Security - Appendix A (PDF, 147.94 KB) </span></a></div></figure>

<p>Consequences for staff:</p>

<figure role="group"><div class="embedded-file"><svg height="25" width="25" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><polygon points="22 18 22 20 2 20 2 18 0 18 0 20 0 22 2 22 22 22 24 22 24 20 24 18 22 18"></polygon><polygon points="12 18 18.55 11.46 17.09 10 13 14.09 13 2 11 2 11 14.09 6.91 10 5.46 11.46 12 18"></polygon></svg><span class="visually-hidden">Download</span><a href="https://content-webapi.tuni.fi/proxy/public/2022-05/policy-on-consequences-of-breaches-of-it-security-appendixb.pdf"><span>Policy on Consequences of Breaches of IT Security - Appendix B (PDF, 148.95 KB) </span></a></div></figure>

<p>Consequences for other users:</p>

<figure role="group"><div class="embedded-file"><svg height="25" width="25" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><polygon points="22 18 22 20 2 20 2 18 0 18 0 20 0 22 2 22 22 22 24 22 24 20 24 18 22 18"></polygon><polygon points="12 18 18.55 11.46 17.09 10 13 14.09 13 2 11 2 11 14.09 6.91 10 5.46 11.46 12 18"></polygon></svg><span class="visually-hidden">Download</span><a href="https://content-webapi.tuni.fi/proxy/public/2022-05/policy-on-consequences-of-breaches-of-it-security-appendixc.pdf"><span>Policy on Consequences of Breaches of IT Security - Appendix C (PDF, 157.91 KB) </span></a></div></figure>
