UIC NetID Activation

Are you a new UIC employee? You will create your NetID and password in UI New Hire.

Welcome to UIC! Once you activate your UIC NetID and password, you will use these credentials to access most University of Illinois resources (e.g., university email, Blackboard, UIC-WiFi, Student Registration & Records, Financial Aid, and many other university services).

Your new NetID is a unique identifier assigned to you and serves as your username when logging in to university services. It also becomes part of your UIC email address (NetID@uic.edu).

A secure and well-managed password is key to protecting your access to University of Illinois resources. The activation process includes setting up password recovery options for self-service management so that you will be prepared, in advance, if you need to recover your password.

STOP! - You must register for 2FA!

Enrollment in Multi-Factor Authentication is required to access many university systems, including your university email. Visit How do I enroll in MFA / 2FA and follow the instructions to complete your setup.

Identity Verification

University ID Number (UIN)

The 9-digit number found on your i-card or in communications from UIC's Admissions Office or sponsoring department.

Activation Token

The 8-digit number received from UIC's Admissions Office or sponsoring department.

Policy Compliance

Please review the UIC Acceptable Use of Computational Resources Policy and then indicate your acceptance in the checkbox below.

Acceptable Use of Computational Resources
   Policy Number:  IT-9100-002
   Policy Title:  Acceptable Use of Computational Resources
   Vice Chancellor/Associate Chancellor: Vice Chancellor for Innovation  
   Unit Responsible for Policy:  Technology Solutions
   Effective Date: March 4, 2022
   Contacts:  Chief Information Security and Privacy Officer

Policy Statement:

The University of Illinois Chicago ("university") is committed to a 
   respectful, safe, and ethical environment for all members of the 
   university community ("members").

This policy applies to all academic, research, and administrative 
   departments and offices at the University of Illinois Chicago; all 
   university faculty, staff, students, alumni, applicants, visitors, 
   contractors and affiliates (university "members"); and all resources 
   in the university computing portfolio including: systems, network 
   infrastructure, devices, facilities and applications (collectively 
   referred to as "computational resources"), whether located on 
   university property or accessed remotely.

Throughout this document, the physical network used to provide 
   internal networking and Internet services at UIC will be referred to 
   as the "UIC network." The term "LAN" will be used to refer to a subset 
   of the UIC network, commonly known as a "subnet," or as a departmental 
   local area network."

All users have a responsibility to use university computational 
   resources in an efficient, ethical, and legal manner. Users of these 
   resources are expected to abide by this policy, which is intended to 
   preserve the utility and flexibility of computational resources, 
   safeguard university data, protect the work of students, staff, and 
   faculty, and preserve the ability to access network resources to 
   which the university is connected.

Policy may exist at the system and university level that place 
   additional restrictions on the permissible use of computational 
   resources. Such policies take precedence when they are more restrictive.

Units may create policy that imposes additional restrictions on 
   computational resources within their areas, but in instances where 
   a unit policy is less restrictive, this policy applies.

Underlying Principles

The following general statements provide the basis for making the 
   specific recommendations that appear here and for deriving answers 
   to future policy questions.

1. Access to computational resources is a privilege and 
          not a right.
       2. The principles of academic freedom apply in full to 
          electronic communications within the limits set within 
          this and other university policies.
       3. The use of computational resources provided by the 
          university are subject to all applicable State and 
          Federal laws and university policies.
       4. Technology Solutions is responsible for the design, 
          operation, and management of the computational 
          resources provided to the university. This responsibility 
          includes the choice of protocols supported by the network 
          and the definition of campus standards necessary for 
          efficient operation of the network or for the security 
          of transmitted data and networked computers and is 
          subject to change.
       5. The standards of behavior expected of community members 
          extend to the virtual environment as well.

Ownership

Computational resources are the property of the university and shall 
   be used for legitimate university instructional, research, 
   administrative, public service, and approved contract purposes.

University identifiers (NetIDs) and computer sign-ons are the 
   property of the university. The university may revoke these 
   identifiers or sign-ons at any time with due cause.

Individual Responsibility

All UIC members are assigned a university identifier (NetID) and are 
   required to create a password associated with that NetID to access 
   computational resources. Members may also be required to use a second 
   form of authentication referred to as two factor authentication (2FA) 
   through a device such as a phone app, SMS, or hardware token to access 
   specific resources.  Sharing of computational resources and passwords 
   is prohibited and it is your responsibility to protect these access 
   mechanisms by safeguarding your password and 2FA device.

Members may not attempt to disguise their identity, the identity of 
   their account, or the device that they are using while accessing 
   university resources. Use of software that masks the origin of network 
   traffic when accessing non-university resources for privacy reasons 
   is permissible. Members may not attempt to impersonate another person 
   or organization. Members may likewise not misuse or appropriate the 
   university's name, network names, or network address spaces.

Members are responsible for maintaining security controls that comply 
   with university policy and standards on their personal equipment 
   (laptops, mobile devices, etc.) that utilize university 
   computational resources.

Acceptable Use

University computational resources are the property of the university 
   and shall be used for legitimate university instructional, research, 
   administrative, public service, and approved purposes.

Minimal personal use of computational resources may be permitted if it 
   does not interfere with the university's or the employee's ability to 
   carry out university business and does not violate the terms of this 
   policy or university ethics rules, policies or guidelines. Members 
   should keep in mind that sensitive personal information, other than that 
   required for employment by the university, should never be transmitted 
   or stored using computational resources.

Users of computational resources shall not violate any applicable law 
   or ethics rules, policies or guidelines as a result of their use of 
   such resources.

All users of computational resources must:

- Comply with copyright and trademark laws; this includes a 
         prohibition on using the UIC network to illegally download or 
         share copyrighted material such as software, movies, music, books, etc.

- Use only those computational resources they are authorized to 
         use and use them only in the manner and to the extent authorized.

- Not share accounts and credentials with anyone. Account 
         credentials are for use only by the individual to whom 
         they are assigned.

- Refrain from unauthorized access, modification, or destruction 
         of another person's computer files, communications, accounts, 
         or other data.

- Refrain from installing or using unauthorized software, 
         particularly software that may create security risks.

- Refrain from intentional access to or dissemination of 
         pornographic material unless (1) such use is specific to 
         work-related functions and has been approved a user's 
         supervisor/unit manager or (2) such use is for scholarly 
         or medical purposes.

- Refrain from unauthorized attempts to circumvent the 
         security controls of any computational resource.

- Refrain from attempts to degrade system performance or 
         capability, or attempts to damage systems, software, or 
         intellectual property of others.

- Refrain from using computational resources for commercial 
         purposes unrelated to the university, except as 
         specifically authorized.

- Comply with all federal, state and other applicable laws, 
         all applicable university rules and policies, and all 
         applicable contracts and licenses. Users are responsible 
         for ascertaining, understanding, and complying with the 
         laws, rules, policies, contracts, and licenses applicable 
         to their particular uses.

- Request supervisory direction regarding permitted personal 
         use of computational resources.

Proper and Authorized Use of the UIC Network

Members may not extend or share the UIC network with the public or others 
   beyond what has been configured by the Technology Solutions Network 
   Infrastructure Team. Members are not permitted to connect any network 
   devices or systems (e.g., switches, routers, wireless access points, 
   VPNs, and firewalls) to the UIC Network without advance consultation 
   and written permission from the Technology Solutions Network 
   Infrastructure Team.

Devices connected to the UIC network may not route network traffic 
   between a UIC network and an external network without written approval 
   from the Technology Solutions Network Infrastructure group.

Only Technology Solutions-approved domains may be operated within 
   UIC Network address space. Publicly accessible Domain Name Servers 
   must be approved by Technology Solutions before they are placed in service.

If Technology Solutions determines that a LAN, or any portion thereof, 
   presents an immediate security risk to other UIC computational resources, 
   Technology Solutions may terminate or restrict the LAN's network connection 
   without notice until the issue has been remediated. If there is no 
   immediate risk, Technology Solutions will bring the matter to the attention 
   of the LAN's network administrator and/or network security liaison.

Technology Solutions will occasionally perform network scans of computational 
   resources connected to the UIC network for security vulnerabilities. If the 
   Technology Solutions Information Security and Privacy Office becomes aware 
   of high-severity security vulnerabilities either through the results of 
   these scans or other means, the administrator is responsible for securing 
   the system to the satisfaction of the Technology Solutions Information 
   Security and Privacy Office in a timely manner. Failure to do so will result 
   in the restriction of network access for the affected resource.

The system administrator of a computational resource is responsible for the 
   security of that resource. UIC Network connected servers must require user 
   authentication over an encrypted session before allowing access to non-public 
   information. At minimum, this will require the connecting user to supply a 
   NetID and associated password. The administrator must monitor and log access 
   and keep other system logs useful for establishing the identities of individuals 
   used in the event of a breach of security.

All devices connected to the UIC network must be registered with a Technology 
   Solutions operated or approved domain name server. Devices found connected 
   that are not properly registered will be considered security threats and 
   will have their network access blocked.

Network vulnerability scanning of computational resources is restricted to 
   authorized personnel using the university provided solution.

Software and hardware which permit the capture and examination of network 
   packets (commonly known as sniffing), may only be used on the UIC network 
   by authorized personnel.

1. These tools may only be used after consultation with and receiving 
          written permission from the Technology Solutions Information 
          Security and Privacy Office.

2. When using these tools, they must be configured to capture the 
          minimum information needed to diagnose the problem (i.e. member 
          data should not be captured unless needed to solve a problem).

3. All data collected must be securely deleted as soon as it has 
          served its purpose.

4. All information collected by these tools must be considered 
          high-risk as defined by the UIC IT Security Program.

Administrators of computational resources are required to log access to 
   their devices. The log information may include the source and destination 
   addresses, session start and end times as well as the NetID used to 
   establish the session.

Computational resources on the UIC Network must not be used to provide email 
   or email routing services for persons or organizations that are not 
   UIC community members.

The following devices may not be installed on the UIC network unless written 
   consent has been given by the Technology Solutions Network Infrastructure group. 
   Unapproved devices are subject to network filtering and/or physical disconnection.
  
       1. Hardware firewalls and/or NAT devices
       2. Wireless access points
       3. DHCP servers

Security and Monitoring

The university regularly monitors and records the activity on computational 
   resources to evaluate system efficiency and to detect signs of intrusion 
   and/or abuse.  It is the practice of the university not to selectively 
   monitor the usage of computational resources by individuals unless there is 
   a legitimate business or security reason to do so. The university may 
   further monitor and record the usage of individuals, including the 
   disclosure of individual files when:

1. in accordance with generally accepted security, network, and 
          system administration practices;
       2. to prevent or investigate any actual or potential information 
          security incident and/or misuse of computational resources;
       3. it has reason to believe that activities are taking place 
          contrary to this policy, or state or federal law;
       4. necessary to respond to a court order, subpoena, to assist 
          law enforcement, or in response to a request from a federal 
          or state oversight agency;
       5. necessary to respond to a request for discovery in the 
          course of litigation;
       6. necessary to retrieve information in emergency circumstances 
          where there is a threat to health, safety, or university 
          property involved.

The university, in consultation with its legal counsel, may contact 
   local or federal law enforcement authorities to investigate any matter 
   in its sole discretion.

Employees do not have an expectation of privacy in their use of 
   university computational resources and should limit personal use 
   of these resources to minimize any potential exposure of personal data.

To ensure business continuity units may, with proper authorization, 
   request access to employee email and files upon termination of 
   employment or an unanticipated leave of absence

Discipline

Failure to comply with this policy may put university information 
   assets at risk and may have disciplinary consequences for employees, 
   up to and including termination of employment. Students who violate 
   this policy may be referred to the Office of the Dean of Students. 
   Contractors, vendors, and others who fail to adhere to this policy 
   may face termination of their business relationships with the university.

Violation of this policy may also carry the risk of civil or 
   criminal penalties.

Reason for Policy:  Failure to comply with this policy may put 
   university information assets at risk.

Minority Impact Statement:  The policy does not have any disproportionate 
   or unique impact on UIC’s minority students, staff, or faculty.

Who Should Read the Policy:  All students, faculty, staff, and administrators at UIC.

Definitions:

- Covered Individuals: The policy applies to all members of the university 
         community, our partners and guests, which includes any entity using 
         university computing devices or the university data network, including 
         the UIC-Guest network and eduroam.

- Ownership of Resources: All technology resources owned by the university 
         may be accessed only by authorized personnel. Digital identifiers 
         assigned by the university (e.g. Netid) are the property of the university.

- Identity: Members of the university community must use their assigned 
         identifiers and may not share credentials. Individuals may not disguise 
         their identity or that of any technology equipment.

- Acceptable Use: Personal use of resources should be limited but may 
         be permitted when it does not violate other policy or ethics guidelines. 
         Resources may not be used for prohibited political activity or commercial 
         activity unrelated to the business of the university. Individuals may not 
         use resources to violate any applicable law or to transmit harassing 
         or malicious content.

- Data Network: The campus data network is run solely by Technology Solutions 
         in support of university functions. No individual may connect network 
         devices or systems to the network, including wireless access points, 
         firewalls, and routers, without the consent of Technology Solutions. 
         Technology Solutions monitors network traffic and may shut down network 
         access to investigate issues or mitigate threats.

- Discipline: Failure to comply with this policy may put university 
         information assets at risk and may have disciplinary consequences for 
         employees, up to and including termination of employment. Students who 
         fail to adhere to this policy may be referred to the Office of the 
         Dean of Students. Contractors, vendors, and others who fail to adhere 
         to this policy may face termination of their business relationships 
         with the university. Violation of this policy may also carry the risk 
         of civil or criminal penalties.

Procedures: None

Forms: None

Related Laws, Regulations, Statutes, and Policies:  
 
       IT Security Program

Document History:

Approval date: February 17, 2022
   Approved as: New policy

I agree to abide by the UIC Acceptable Use of Computational Resources Policy