A.9 ABC Inc. InfoSec Remote Access Policy


A.9 ABC Inc. InfoSec Remote Access Policy

Policy No. 8

Effective date Month / Day / Year

Implement by Month / Day / Year

1.0 Purpose

The purpose of this policy is to define standards for connecting to ABC Inc.'s network from any host. These standards are designed to minimize the potential exposure to ABC Inc. from damages which may result from unauthorized use of ABC Inc. resources. Damages include the loss of sensitive or company confidential data, intellectual property, damage to public image, damage to critical ABC Inc. internal systems, etc.

2.0 Scope

This policy applies to all ABC Inc. employees , contractors, vendors , and agents with an ABC Inc.-owned or personally -owned computer or workstation used to connect to the ABC Inc. network. This policy applies to remote access connections used to do work on behalf of ABC Inc., including reading or sending email and viewing intranet web resources. Remote access implementations that are covered by this policy include, but are not limited to, dial-in modems, frame relay, ISDN, DSL, VPN, SSH, and cable modems, etc.

3.0 Policy

3.1 General
  1. It is the responsibility of ABC Inc. employees, contractors, vendors, and agents with remote access privileges to ABC Inc.'s corporate network to ensure that their remote access connection is given the same consideration as the user 's on-site connection to ABC Inc.

  2. General access to the Internet for recreational use by immediate household members through the ABC Inc. Network on personal computers is permitted for employees that have flat-rate services. The ABC Inc. employee is responsible to ensure the family member does not violate any ABC Inc. policies, does not perform illegal activities, and does not use the access for outside business interests. The ABC Inc. employee bears responsibility for the consequences should the access be misused.

  3. Please review the following policies for details of protecting information when accessing the corporate network via remote access methods , and acceptable use of ABC Inc.'s network:

    1. Acceptable Use Policy

    2. Virtual Private Network (VPN) Policy

    3. Wireless Communications Policy

  4. For additional information regarding ABC Inc.'s remote access connection options, including how to order or disconnect service, cost comparisons, troubleshooting, etc., go to the Remote Access Services website.

3.2 Requirements
  1. Secure remote access must be strictly controlled. Control will be enforced via one-time password authentication or public/private keys with strong passphrases. For information on creating a strong passphrase, see the Password Policy.

  2. At no time should any ABC Inc. employee provide their login or email password to anyone , not even family members.

  3. ABC Inc. employees and contractors with remote access privileges must ensure that their ABC Inc.-owned or personal computer or workstation, which is remotely connected to ABC Inc.'s corporate network, is not connected to any other network at the same time, with the exception of personal networks that are under the complete control of the user.

  4. ABC Inc. employees and contractors with remote access privileges to ABC Inc.'s corporate network must not use non-ABC Inc. email accounts (i.e., Hotmail, Yahoo, AOL), or other external resources to conduct ABC Inc. business, thereby ensuring that official business is never confused with personal business.

  5. Routers for dedicated ISDN lines configured for access to the ABC Inc. network must meet minimum authentication requirements of CHAP.

  6. Reconfiguration of a home user's equipment for the purpose of split-tunneling or dual homing is not permitted at any time.

  7. Frame Relay must meet minimum authentication requirements of Data Link Connection Identifier (DLCI) standards.

  8. 8. Non-standard hardware configurations must be approved by Remote Access Services, and InfoSec must approve security configurations for access to hardware.

  9. 9. All hosts that are connected to ABC Inc. internal networks via remote access technologies must use the most up-to-date antivirus software (place URL to corporate software site here), this includes personal computers. Third party connections must comply with requirements as stated in the Third Party Agreement.

  10. 10. Personal equipment that is used to connect to ABC Inc.'s networks must meet the requirements of ABC Inc.-owned equipment for remote access.

  11. 11. Organizations or individuals who wish to implement nonstandard Remote Access solutions to the ABC Inc. production network must obtain prior approval from Remote Access Services and InfoSec.

4.0 Enforcement

Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

5.0 Definitions

Cable Modem: Cable companies such as AT&T Broadband provide Internet access over Cable TV coaxial cable. A cable modem accepts this coaxial cable and can receive data from the Internet at over 1.5 Mbps. Cable is currently available only in certain communities.

CHAP: Challenge Handshake Authentication Protocol (CHAP) is an authentication method that uses a one-way hashing function. The Data Link Connection Identifier (DLCI) is a unique number assigned to a Permanent Virtual Circuit (PVC) endpoint in a frame relay network. DLCI identifies a particular PVC endpoint within a user's access channel in a frame relay network, and has local significance only to that channel.

Dial-in Modem: A peripheral device that connects computers to each other for sending communications via the telephone lines. The modem modulates the digital data of computers into analog signals to send over the telephone lines, then demodulates back into digital signals to be read by the computer on the other end; thus the name "modem" for modulator / demodulator.

Dual Homing: Having concurrent connectivity to more than one network from a computer or network device. Examples include: Being logged into the corporate network via a local Ethernet connection, and dialing into AOL or other Internet service provider (ISP). Being on an ABC Inc.-provided Remote Access home network, and connecting to another network, such as a spouse's remote access. Configuring an ISDN router to dial into ABC Inc. and an ISP, depending on packet destination.

DSL: Digital Subscriber Line (DSL) is a form of high-speed Internet access competing with cable modems. DSL works over standard phone lines and supports data speeds of over 2 Mbps downstream (to the user) and slower speeds upstream (to the Internet).

Frame Relay: A method of communication that incrementally can go from the speed of an ISDN to the speed of a T1 line. Frame Relay has a flat-rate billing charge instead of a per time usage. Frame Relay connects via the telephone company's network.

ISDN: There are two flavors of Integrated Services Digital Network or ISDN: BRI and PRI. BRI is used for home office/remote access. BRI has two "Bearer" channels at 64kbit (aggregate 128kb) and 1 D channel for signaling info . PRI is short for Primary-Rate Interface, a type of ISDN service designed for larger organizations. PRI includes 23 B-channels (30 in Europe) and one D-Channel.

One-time password (OTP): A security system that requires a new password every time a user authenticates themselves . OTP generates these passwords using either the MD4 or MD5 hashing algorithms.

Remote Access: Any access to ABC Inc.'s corporate network through a non-ABC Inc.-controlled network, device, or medium.

Split-tunneling: Simultaneous direct access to a non-ABC Inc. network (such as the Internet, or a home network) from a remote device (PC, PDA, WAP phone, etc.) while connected into ABC Inc.'s corporate network via a VPN tunnel. Virtual Private Network (VPN) is a method for accessing a remote network via "tunneling" through the Internet.

6.0 Exceptions

Exceptions to information system security policies exist in rare instances where a risk assessment examining the implications of being out of compliance has been performed, where a Systems Security Policy Exception Form has been prepared by the data owner or management, and where this form has been approved by both the CSO or Director of InfoSec and the Chief Information Officer (CIO).

7.0 Revision History

Date ___/____/_____

Version:_______________________

Author:____________________________________

Summary:__________________________________




Wireless Operational Security
Wireless Operational Security
ISBN: 1555583172
EAN: 2147483647
Year: 2004
Pages: 153

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net