Remote Access Security Policy

Wireless Access

The network should never be accessed remotely via a Wireless Network without the express permission of the IT Department
Where the network is accessed remotely via wireless appropriate wireless security standards will be used.
Wired Equivalency Protocol (WEP) will be used as standard on Wi-Fi connections
A WEP encryption key will be used
The network will be configured not to advertise its presence
The power of access points will be turned down to a minimum that still allows the access point to function
Due to the possibility of cracking Wireless Encryption Protocol using sniffing software such as AirSnort, no wireless access points will be provided inside the trusted network
Wi-Fi Protected Access (WPA) will be used where it is available

Secure Access via VPN

Access from remote users to the corporate network will be via secure Dail up or IPSEC VPN or MPLS or SSL VPN connections only that are provided, supported and maintained by the company. This is necessary to secure the connection from the remote device to the corporate network.

Prevention of Data Loss

All laptops and PDAs that are used away from the network should have all data transferred to the company files servers provided as soon as they are returned to the company network. This is necessary because data stored on remote devices cannot be backed up.

Only data stored on company file, database and application servers can be backed up.

Remote Device Protection

To prevent remote PC's, laptops, PDA's etc from compromising the corporate network, security software will be installed on the devices.

Anti-virus software configured to automatically download the latest virus signatures will be installed and utilised
Anti - SpyWare will also be installed Laptops and PDA's should never be connected to any other private or public network. This includes personal internet connections.

Blue Tooth

To prevent Bluetooth enabled devices from being attacked and compromised the Bluetooth connections on mobile phones, PDA's and laptops will be disabled where appropriate.This is to prevent bluejacking, SNARF and backdoor attacks.

Standard Devices and Configurations

Devices that are used to access the network remotely, must meet the minimum standard for supported web browsers and operating systems, that is current at the time of access. Where access is provided directly to the corporate network, users will only be allowed access on standard devices supplied and configured by the IT Department.

Authentication

Authentication for remote access will use authentication. As a minimum this will comprise username and password verification.