IT rules and guidelines

• You log in to HAMK’s systems with a personal username and password. Please treat your username and password with the same care as you would your bank card and password.
• Once you receive a new password from the support, change it immediately to a password that only you know. Change your password often enough and immediately if you suspect someone else has it.
• You are responsible for the use of your account. Do not share your password with anyone else. Not even the system administrators should know it. If someone asks for your password, they are invariably on the wrong side of the law.
• Choose your password carefully. A good password is one that you can remember easily, but which cannot be cracked by outsiders. Don’t use everyday words or words related to you as passwords. Avoid writing your password down as it is.
• Do not use the same password for any service outside HAMK as you use for HAMK services, so that breaking the password of the external service does not allow access to HAMK systems.

• The email address provided by HAMK should be used as the primary email address for HAMK’s internal communications and services, including the student register and learning environments. By using HAMK’s email services, you can improve the security of your communications.
• If you receive an email that belongs to someone else, inform the sender of the wrong address. Remember that you have a duty of confidentiality with regard to the message you receive.
• Email messages may contain malware or may direct you to a malware-containing page. Do not open a message if you are unsure of its origin or if it has not been agreed to be sent.
  If necessary, you can request further instructions from the HAMK IT Service Desk.
• Email messages usually circulate online in unencrypted form without any protection, so data requiring protection must be encrypted before transmission.
• Think about who you give your email address to or where you publish it. Avoid using your HAMK email address on online forums and social networking sites (e.g. Facebook) and get a separate email address for your private use.
• When using an email service provided by a third-party provider, choose a service that encrypts your communications (in a browser-based service, the address starts with https://).

• Be healthily suspicious of the reliability of your email. An e-mail message can also come from a source other than the one shown in the sender field. Malware can also send emails without any action on the part of the user.
• Watch out for phishing messages asking you to give up your ID and password or to type them into a website. Administrators will never ask for your password.
• Always check the actual destination address of the link before clicking on it. Be especially careful if you have received the link in a message.
• Learn to distinguish legitimate web addresses from those used by scammers. Check your university’s guidelines.
• Ads and chain letters sent without the recipient’s permission are spam. Do not reply to them, but destroy them immediately. If an offer seems too good to be true, don’t take it.
• Universities use a variety of methods to filter spam and malware, which can affect how email is received. Find out about your institution’s practices.
• In addition to email, you may also be deceived by other means, such as by phone or social media. Watch out for unexpected bills and fake messages in the name of the administrator.

• When using different online services (Facebook, TikTok, Instagram or photo-sharing services, etc.), consider what information you or others share with them. Once you put personal information online, such as a photo or home address, it may be impossible to remove it completely later.
• Watch out for pop-ups and advertisements on the website. Malware spreads effectively through social media and online services – don’t click carelessly.
• Don’t use online services that don’t seem trustworthy.
• Many online services are cloud-based, which means that the information users enter into the service is only stored on the service provider’s servers, often outside Finland. There are a number of security risks associated with cloud computing that you should be aware of. It is worth checking the terms of use of the services before you start using them, at least to ensure that you retain ownership of your data and that your data is not passed on to third parties.
• Check the privacy settings in your user profile (who can view your data) and adjust them if necessary.
• Use discretion when processing personal data: consider what information you can disclose and to whom. You have discretion over the disclosure of your own data. You must have the consent of the other person to disclose their data.
• In online communities, it’s easy to pretend to be someone else or someone else’s person. Don’t be too naive and believe about everything you read.
• When communicating by email and online, you should follow the so-called ‘net etiquette’. Writing too strongly, for example in a discussion group, can affect your reputation, for example when looking for a job.
• Do not store location information in the images you upload to the online service. Turn off the GPS feature of your camera or remove location information from your photos before publishing them.

You are the administrator of your own computer. Follow these steps to monitor your computer and ensure its security:

• A computer on the network should always be protected by a firewall and anti-malware.
• Don’t install any software you don’t really need. Install software security updates.
• Create personal accounts (without administrative rights) for each user on the home computer. The administrator IDs should not be used for anything other than maintenance tasks (software installation, creation of other IDs).
• Back up your home computer files regularly. Store backups separately from the computer and, if possible, in a locked location.
• Discarded computers, smartphones and memory sticks should not be thrown away. Data is destroyed by overwriting or shredding the medium, paper shredding.

• Phones, tablets and other mobile devices should be protected in the same way as computers.
• Do not open text messages from an unknown sender or that are otherwise suspicious. They may contain malware that will send messages in your name or otherwise incur additional costs.
• Protect your mobile device from theft. Protect your device with a lock code (in addition to your PIN) to prevent others from accessing your data. Find out if you can remotely unlock your device if necessary.
• Turn off wireless connections (Bluetooth and WLAN) whenever you don’t need them.
• Make sure you also back up your data on your mobile devices. Clear the data from devices when you disable them.
• Don’t install any software you don’t really need. Only download and install software from official marketplaces.
• Data traffic costs are high abroad, so use with discretion.
• Consider publishing your location information on online services.

If you suspect that one of the machines you are using has or has had malware, do the following:

1. On the second computer or phone, immediately change any passwords that you have used on the machine infected by the malware, or that are the same as the ones you used on that machine. In order to investigate the misuse, report the suspected malware and the possible hijacking of your password to the customer service of the main services you use.
2. If you own the machine, don’t use it until you know how to remove the malware. If the machine is owned by someone else, contact the person or organisation responsible and let them know.
   For limited help in cleaning your own machine, you can contact the HAMK IT Service Desk or visit the website of your anti-virus software manufacturer.

If you suspect a security breach or abuse of the system, please contact the person responsible for the service. If the service is provided by HAMK or you accessed the service with a HAMK ID, contact the HAMK IT Service Desk.
For other services, send a report to the abuse address of the organisation concerned (e.g. abuse@webname) or call the organisation’s switchboard and ask to be directed to the person in charge of security. Clearly explain what you have discovered and when the discovery occurred. Also leave your name and contact details so that you can be contacted for further information if necessary.

• Always log in with your own credentials. When you are finished, delete any temporary files you may have saved on your computer before logging out.
• Always lock the machine when you leave it, even if you only leave for a short time (on Windows machines: Win+L). This prevents unauthorized access to your password and files. Please note, however, that locking the machine for longer periods of time may not be allowed, as the machine will remain unoccupied.
• When you save your data in your home directory (P: drive), HAMK will take care of backing up your data. When you store your data in the OneDrive cloud service, Microsoft will take care of backing up your data.
• If you are printing to a shared printer, pick up the printout immediately after printing.
• Save your changes at regular intervals (Ctrl-S in many Windows applications) if you edit text or other material over a longer period of time. This way, you won’t lose all the work you’ve done in case of a technical failure.
• The installation of software on HAMK machines is generally prohibited and often technically blocked.
  If you need specific software, please contact the IT Service Desk.

• You should not rely on the security of internet cafés, libraries and public computers, which may contain software that collects user data. Consider whether it is necessary to log into your email from such machines, for example.
• There will always be information about you and your activities that remains about your computer and the programs you use. Learn in advance how to clear your browser cache and other typical traces of your use.
• When using wireless networks, only use email and web services that encrypt your traffic (beginning with https://).

• Don’t use a memory stick as the primary or only place to store files, although it is a handy tool for data transfer and backup. A memory stick can be easily lost.
• If you store sensitive material on sticks, get a memory stick to encrypt the data.
• Be careful with other users’ memory sticks. The stick may have malware that automatically starts and infects your computer.
• If you find another user’s memory stick at HAMK, please bring it to HAMK’s IT service point without examining its contents.

• Make sure you have access to the software you install on your computer. Do not install illegal copies.
• Through HAMK you can get access to software that you need in your studies.
• Find out the terms and conditions for using electronic resources in libraries by consulting the guidelines issued by libraries.
• Copyright protects films and musical works. Do not copy them online or share them online without the express permission of the copyright holder.

• The right to use HAMK’s IT services is linked to your study rights.
• When you graduate or your study rights expire, HAMK will close your user account, and after a certain period of time will permanently delete your email folders and other files.
  
  Before closing your account, please take care of the following:
  • Notify your contacts if you change your email address.
  • Copy the files you want to keep from HAMK’s servers and delete the others.
  • From HAMK’s O365 service, copy the files and materials you want to keep and delete the others.
  • Copy your own emails or forward them to another email address.
  • Remove from your own devices any software you have received from HAMK that you no longer have access to.