Remote Access Policy

OVERVIEW

Remote access to our corporate network is essential to maintain our team's productivity, but in many cases this remote access originates from networks that may already be compromised or are at a significantly lower security posture than our corporate network. While these remote networks are beyond the control of 10ARK DIGITAL policy, we must mitigate these external risks to the best of our ability.

PURPOSE

The purpose of this policy is to define rules and requirements for connecting to 10ARK DIGITAL's network from any host. These rules and requirements are designed to minimise the potential exposure to 10ARK DIGITAL from damages which may result from unauthorised use of 10ARK DIGITAL resources. Damages include the loss of sensitive or company confidential data, intellectual property, damage to public image, damage to critical 10ARK DIGITAL internal systems, and fines or other financial liabilities incurred as a result of those losses.

SCOPE

This policy applies to all 10ARK DIGITAL employees, contractors, vendors and agents with a 10ARK DIGITAL owned or personally-owned computer or workstation used to connect to the 10ARK DIGITAL network. This policy applies to remote access connections used to do work on behalf of 10ARK DIGITAL, including reading or sending email and viewing intranet web resources. This policy covers any and all technical implementations of remote access used to connect to 10ARK DIGITAL networks.

POLICY

It is the responsibility of 10ARK DIGITAL employees, contractors, vendors and agents with remote access privileges to 10ARK DIGITAL's corporate network to ensure that their remote access connection is given the same consideration as the user's on-site connection to 10ARK DIGITAL.

General access to the Internet for recreational use through the 10ARK DIGITAL network is strictly limited to 10ARK DIGITAL employees, contractors, vendors and agents (hereafter referred to as "Authorised Users"). When accessing the 10ARK DIGITAL network from a personal computer, Authorised Users are responsible for preventing access to any computer resources or data by non-Authorised Users. Performance of illegal activities through the 10ARK DIGITAL network by any user (Authorised or otherwise) is prohibited. The Authorised User bears responsibility for and consequences of misuse of the Authorised User's access. For further information and definitions, see the Acceptable Use Policy.

Authorised Users will not use 10ARK DIGITAL networks to access the Internet for outside business interests.

Requirements

1. Secure remote access must be strictly controlled with encryption (i.e., Virtual Private Networks (VPNs)) and strong pass-phrases. For further information see the Acceptable Encryption Policy and the Password Construction Guidelines.

2. Authorised Users shall protect their login and password, even from family members.

3. While using a 10ARK DIGITAL owned computer to remotely connect to 10ARK DIGITAL's corporate network, Authorised Users shall ensure the remote host is not connected to any other network at the same time, with the exception of personal networks that are under their complete control or under the complete control of an Authorised User or Third Party

4. Use of external resources to conduct 10ARK DIGITAL business must be approved in advance by InfoSec and the appropriate business unit manager.

5. All hosts that are connected to 10ARK DIGITAL internal networks via remote access technologies must use the most up-to-date anti-virus software (place url to corporate software site here), this includes personal computers.

6. Personal equipment used to connect to 10ARK DIGITAL's networks must meet the requirements of 10ARK DIGITAL owned equipment for remote access as stated in the Remote Access Tools Policy.

POLICY COMPLIANCE

Compliance Measurement

The Infosec Team will verify compliance to this policy through various methods, including but not limited to, periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and inspection, and will provide feedback to the policy owner and appropriate business unit manager.

Exceptions

Any exception to the policy must be approved by the Infosec Team in advance.

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.