APPENDIX B

Select Set of Statements from the Information Security Policy Document of IIML

Natural Language Constructs:

Electronic Mail Policies

1. Both primary and secondary mail servers will be inside the firewall. All messages will be scanned for viruses and other maligned content by gateway-based anti-virus software.

2. Users will be able retrieve email through Internet Message Access Protocol (IMAP) or Post Office Protocol (POP3) services, from inside the network. From outside the network, users will be allowed to access their mail only using "Web mail" service available through IIML Web page. Authentication is enforced for retrieving the messages.

3. Email servers will be configured to refuse to relay any email addressed to non-IIML domains.

World Wide Web Policies

1. The Institute Web server (http://www.iiml.ac.in) will be placed inside the firewall in the De-Militarized Zone (DMZ). All the other Web servers will be hosted in the internal network. All HyperText Transfer Protocol (HTTP) requests from outside to internal Web servers will be processed through the firewall and appropriate reverse proxy servers.

2. All files downloaded over WWW will be scanned for viruses or other malign content using gateway-based anti-virus software and content analyser.

Formal Nonmathematical Constructs

Service	Policy				Policy Statement
	Inside to Outside		Outside to Inside
	Status	Authentication	Status	Authentication
HTTP	Y	N	N	-	All WWW servers intended for access will be hosted inside IIML firewall. Restricted inbound HTTP requests will be allowed through the firewall.
Web Mail	Y	Y	Y	Y	Web Mail available through the Institute Web page will be accessible even from outside. It will be only through the Web Mail interface that users can access their email boxes from outside.