5.1 Remote Access Standard
5.1.1. Overview
Remote access to our corporate network is essential to maintain our Team’s productivity, but in many cases this remote access originates from networks that may already be compromised or are at a significantly lower security posture than our corporate network. While these remote networks are beyond the control of Highline College standard and standards, we must mitigate these external risks the best of our ability.
5.1.2. Purpose
The purpose of this standard is to define rules and requirements for connecting to Highline College’s network from any host. These rules and requirements are designed to minimize the potential exposure to Highline College from damages which may result from unauthorized use of Highline College resources. Damages include the loss of sensitive or company confidential data, intellectual property, damage to public image, damage to critical Highline College internal systems, and fines or other financial liabilities incurred as a result of those losses.
5.1.3. Scope
This standard applies to all Highline College employees, contractors, vendors and agents with a Highline College-owned or personally-owned computer or workstation used to connect to the Highline College network. This standard applies to remote access connections used to do work on behalf of Highline College, including reading or sending email and viewing intranet web resources. This standard covers any and all technical implementations of remote access used to connect to Highline College networks.
5.1.4. Standard
It is the responsibility of Highline College employees, contractors, vendors and agents with remote access privileges to Highline College’s corporate network to ensure that their remote access connection is given the same consideration as the user’s on-site connection to Highline College.
General access to the Internet for recreational use through the Highline College network is strictly limited to Highline College employees, contractors, vendors and agents (hereafter referred to as “Authorized Users”). When accessing the Highline College network from a personal computer, Authorized Users are responsible for preventing access to any Highline College computer resources or data by non-Authorized Users. Performance of illegal activities through the Highline College network by any user (Authorized or otherwise) is prohibited. The Authorized User bears responsibility for and consequences of misuse of the Authorized User’s access. For further information and definitions, see the Acceptable Use Policy.
Authorized Users will not use Highline College networks to access the Internet for outside business interests.
For additional information regarding Highline College’s remote access connection options, including how to obtain a remote access login, free anti-virus software, troubleshooting, etc., go to the Remote Access Services website (company url).
5.1.4.1 Requirements
5.1.4.1.1 Secure remote access must be strictly controlled with encryption (i.e., Virtual Private Networks (VPNs)) and strong pass-phrases. For further information, see 4.1 Encryption Standard and 1.5 Password Standard.
5.1.4.1.2 While using a Highline College-owned computer to remotely connect to Highline College’s corporate network, Authorized Users shall ensure the remote host is not connected to any other network at the same time, with the exception of personal networks that are under their complete control or under the complete control of an Authorized User or Third Party.
5.1.4.1.3 Use of external resources to conduct Highline College business must be approved in advance by ITS.
5.1.4.1.4 All hosts that are connected to Highline College internal networks via remote access technologies should conform to 2.5 Operating System Guideline and 2.6 Antivirus Software Guideline.
5.1.5. Compliance
5.1.5.1 Compliance Measurement
ITS will verify compliance to this standard through various methods, including but not limited to, periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and feedback to the standard owner.
5.1.5.2 Exceptions
Any exception to the standard must be approved by ITS in advance.
5.1.5.3 Non-Compliance
An employee found to have violated this standard may be subject to disciplinary action, up to and including termination of employment.
5.1.6. Related Standards, Policies, and Processes
2.5 Operating System Guideline
5.1.7. Revision History
| Date | By | Summary |