Remote Access Policy

1. Overview

Remote access to our corporate network is essential to maintain our Team’s productivity. Still, in many cases, this remote access originates from networks that may already be compromised or are at a significantly lower security posture than our corporate network.  While these remote networks are beyond the control of Hypergolic Reactions, LLC policy, we must mitigate these external risks to the best of our ability.

2. Purpose

The purpose of this policy is to define rules and requirements for connecting to eCuras’s network from any host. These rules and conditions are designed to minimize the potential exposure to eCuras from damages which may result from unauthorized use of eCuras resources. Damages include the loss of sensitive or company confidential data, intellectual property, damage to public image, damage to critical eCuras internal systems, and fines or other financial liabilities incurred due to those losses.

3. Scope

This policy applies to all eCuras employees, contractors, vendors, and agents with a eCuras-owned or personally-owned computer or workstation used to connect to the eCuras network. This policy applies to remote access connections used to do work on behalf of eCuras, including reading or sending email and viewing intranet web resources.  This policy covers any, and all technical implementations of remote access used to connect to eCuras networks.

4. Policy

It is the responsibility of eCuras employees, contractors, vendors, and agents with remote access privileges to eCuras’s corporate network to ensure that their remote access connection is given the same consideration as the user’s on-site connection to eCuras.

Public access to the Internet for recreational use through the eCuras network is strictly limited to eCuras employees, contractors, vendors, and agents (hereafter referred to as “Authorized Users”).  When accessing the eCuras network from a personal computer, Authorized Users are responsible for preventing access to any eCuras computer resources or data by non-Authorized Users.  The performance of illegal activities through the eCuras network by any user (Authorized or otherwise) is prohibited.  The Authorized User bears responsibility for and consequences of misuse of the Authorized User’s access.  For further information and definitions, see the Acceptable Use Policy.

Authorized Users will not use eCuras networks to access the Internet for outside business interests.

For additional information regarding eCuras’s remote access connection options, including how to obtain a remote access login, free antivirus software, troubleshooting, etc., go to the Remote Access Services website (company URL).

4.1  Requirements

4.1.1        Secure remote access must be strictly controlled with encryption (i.e., Virtual Private Networks (VPNs)) and strong pass-phrases. For further information, see the Acceptable Encryption Policy and the Password Policy.

4.1.2        Authorized Users shall protect their login and password, even from family members.

4.1.3        While using a eCuras-owned computer to remotely connect to eCuras’s corporate network, Authorized Users shall ensure the remote host is not connected to any other network at the same time, with the exception of personal networks that are under their complete control or under the complete control of an Authorized User or Third Party.

4.1.4        Use of external resources to conduct eCuras business must be approved in advance by InfoSec and the appropriate business unit manager.

4.1.5        All hosts connected to eCuras internal networks via remote access technologies must use the most up-to-date anti-virus software (place URL to corporate software site here), including personal computers. Third-party connections must comply with requirements, as stated in the Third Party Agreement.

4.1.6        Personal equipment used to connect to eCuras’s networks must meet the requirements of eCuras-owned equipment for remote access.

5. Policy Compliance

5.1  Compliance Measurement

The Infosec Team will verify compliance with this policy through various methods, including but not limited to periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and inspection. It will provide feedback to the policy owner and appropriate business unit manager.

5.2  Exceptions

Any exception to the policy must be approved by Remote Access Services and the Infosec Team in advance.

5.3  Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

6. Related Standards, Policies, and Processes

Please review the following policies for details of protecting information when accessing the corporate network via remote access methods and acceptable use of eCuras’s network:

Revised: March 14th, 2018

Table of Content

  1. Acceptable Encryption Policy
  2. Acceptable Use Policy
  3. Clean Desc Policy
  4. Data Breach Response Policy
  5. Disaster Recovery Plan Policy
  6. Digital Signature Acceptance Policy
  7. Email Policy
  8. Ethics Policy
  9. Pandemic Response Planning Policy
  10. Password Construction Guidelines
  11. Password Protection Policy
  12. Security Response Plan Policy
  13. End User Encryption Key Protection Policy
  14. Acquisition Assessment Policy
  15. Bluetooth Baseline Requirements Policy
  16. Remote Access Policy
  17. Remote Access Tools Policy
  18. Router and Switch Security Policy
  19. Wireless Communication Policy
  20. Wireless Communication Standard
  21. Database Credentials Policy
  22. Technology Equipment Disposal Policy
  23. Information Logging Standard
  24. Lab Security Policy
  25. Server Security Policy 
  26. Software Installation Policy
  27. Workstation Security (For HIPAA) Policy
  28. Web Application Security Policy
  29.  Analog/ISDN Line Security Policy
  30. Anti-Virus Guidelines
  31. Server Audit Policy
  32. Automatically Forwarded Email Policy
  33. Communications Equipment Policy
  34. Dial In Access Policy
  35. Extranet Policy
  36. Internet DMZ Equipment Policy
  37. Internet Usage Policy
  38. Mobile Device Encryption Policy
  39. Personal Communication Devices and Voicemail Policy
  40. Removable Media Policy
  41. Risk Assessment Policy
  42. Server Malware Protection Policy
  43. Social Engineering Awareness Policy
  44. DMZ Lab Security Policy
  45. Email Retention Policy
  46. Employee Internet Use Monitoring and Filtering Policy
  47. Lab Anti Virus Policy
  48. Mobile Employee Endpoint Responsibility Policy
  49. Remote Access Mobile Computing Storage
  50. Virtual Private Network Policy