������Ƶ

I. Purpose

The purpose of this guideline document is to define requirements and responsibilities when connecting to ������Ƶ's networks and/or IT infrastructure from untrusted computer information systems and networks. These guidelines and requirements are designed to minimize the potential exposure to ������Ƶ from damages which may result from unauthorized use of ������Ƶ resources. Damages include, but are not limited to, the loss of sensitive or company confidential data, intellectual property, damage to public image, damage to critical ������Ƶ internal systems, and fines or other financial liabilities incurred as a result of those losses.

II. Scope

These guidelines are applicable to all ������Ƶ staff, faculty, contractors, vendors and agents with a ������Ƶ-owned or personally-owned computer or workstation that will be used to connect to ������Ƶ networks. These guidelines apply to any remote connections used to do work on behalf of ������Ƶ, including but not limited to, accessing file shares, connecting to web/application servers, or any other access to internal technology resources.  These guidelines cover any and all technical implementations of remote access used to connect to ������Ƶ networks.

III. Guidelines

It is the responsibility of ������Ƶ employees, contractors, vendors and agents with remote access privileges to ������Ƶ's corporate network to ensure that their remote access connection is given the same consideration as the user's on-site connection to ������Ƶ.

General access to the Internet for recreational use through the ������Ƶ network is strictly limited to ������Ƶ employees, contractors, vendors and agents (hereafter referred to as “Authorized Users”).  When accessing the ������Ƶ network from a personal computer, Authorized Users are responsible for preventing access to any ������Ƶ computer resources or data by non-Authorized Users.  Performance of illegal activities through the ������Ƶ network by any user (Authorized or otherwise) is prohibited.  The Authorized User bears responsibility for and consequences of misuse of the Authorized User’s access.  For further information and definitions, see the Acceptable Use Policy and Information Security Policy.

A. Requirements

1. Remote Access connectivity must be established according to ������Ƶ guidelines. Accepted methods include use of the GlobalProtect VPN agent, or in limited (and subject to approval) situations, manual IPSec connections. For further information, see the Policy on Responsible Use of Technology.
2. While using a ������Ƶ-owned computer to remotely connect to ������Ƶ's corporate network, Authorized Users shall ensure the remote host is not connected to any other network at the same time, with the exception of personal networks that are under their complete control or under the complete control of an Authorized User or Third Party.
3. Use of non-������Ƶ owned and/or managed resources to conduct ������Ƶ business may be subject to additional security checks.
4. All hosts that are connected to ������Ƶ internal networks via remote access technologies must use the most up-to-date anti-virus software and patched with the latest operating system and software patches, this includes personal computers.

B. Guideline Compliance

• Compliance Measurement - ������Ƶ CIT will verify adherence to these guidelines (as applicable within the ������Ƶ Information Security Policy) through various methods, including but not limited to, periodic walk-thrus, firewall reports, internal and external audits, and inspection via various security tools. CIT will provide feedback to the appropriate employee supervisor.
• Exceptions - Any exception to the ������Ƶ Information Security Policy must be approved by ������Ƶ’s Information Security Officer in advance and must be documented accordingly.
• Non-Compliance - An employee found to have violated the ������Ƶ Information Security Policy may be subject to disciplinary action, up to and including termination of employment.

IV. Related Standards, Policies, and Processes

Please review the following policies for details of protecting information when accessing the corporate network via remote access methods, and acceptable use of ������Ƶ's network:

• Acceptable Use Policy
• Information Security Policy