Remote Access Policy
Access to key information systems and services resident on the ºÚÁÏ³Ô¹Ï network from the public Internet is a requirement for a significant portion of the ºÚÁÏ³Ô¹Ï community. With the pandemic, health and safety necessities are a top priority for the College and take these risks seriously. ºÚÁÏ³Ô¹Ï takes employee concerns seriously.
Scope
All financial and administrative policies involving community members across campus, including volunteers are within the scope of this policy. If there is a variance between departmental expectations and the common approach described through college policy, the college will look to the campus community, including volunteers to support the spirit and the objectives of college policy. Unless specifically mentioned in a college policy, the college’s Board of Trustees are governed by their Bylaws.
Policy
Purpose
The intent of this policy is to identify remote access methods and procedures that will insure a high level of security for ºÚÁÏ³Ô¹Ï IT physical assets and data. These include network infrastructure, College servers, College workstations, Financial data, HR data, student information, other forms of personal information and other information necessary to support the academic mission and business functions of the College. The policy will define standard approved remote access methods for connecting to ºÚÁÏ³Ô¹Ï network resources by any/all authorized users. It will establish guidelines for managing and protecting information resources and services on the College LAN and enable the use of hardware, software and procedures for implementing the policy.
The policy's guiding philosophy is to keep ºÚÁÏ³Ô¹Ï information within the ºÚÁÏ³Ô¹Ï internal network. As such, this policy is designed to enable users' full remote access to authorized resources that are necessary to perform their jobs while minimizing the exposure of College IT resources to external threats. For example, copying or moving files that contain protected ºÚÁÏ³Ô¹Ï information from a system on the College Local Area Network (LAN) to a remote workstation is prohibited. All policy decisions not explicitly outlined in the policy will be based on this philosophy.
This policy does not identify approved users or their authorization. It only identifies the method of access and authentication and defines the process for requesting access. The Data Custodians, Data Owners, or Managers of a Business unit or application administrators responsible for the information being accessed grant additional access privileges.
In order to provide ease of use the College offers Virtual Desktop Infrastructure (VDI) remote access service utilizing a VMWare platform. The service is maintained and administered by the ITS department and is available in two versions. One version provides full access to a user’s desktop and allows the user the same control over services that they would have while seated at their workstation using a virtual terminal client that requires a download and installation of the application. The other uses a browser based experience that offers the same compatibility.
This policy applies to all, faculty, staff, students, volunteers and contractors of ºÚÁÏ³Ô¹Ï who require remote access to the College network while away from their on-campus space. These users are responsible for reading, understanding, and complying with this policy.
Responsibilities
It is the responsibility of ºÚÁÏ³Ô¹Ï users to ensure that their remote access connection is given the same consideration as their on-site connection. For example, computers logged in via VDI should not be left unattended, or be used by unauthorized persons. It also their responsibility to protect their user credentials to prevent unauthorized users from accessing the ºÚÁÏ³Ô¹Ï network from other devices. Any user accessing ºÚÁÏ³Ô¹Ï resources remotely bears responsibility for the consequences should the access be misused.
Requirements
Remote access must be strictly controlled. Control will be enforced via domain password authentication. For information on creating a strong domain password and other information related to Multi-Factor Authentication please the ITS resource guides.
To use VDI, please review ºÚÁϳԹϒs “Connect from Off Campus” resource guide.
General responsibilities for the use of devices on ºÚÁϳԹϒs network (on-campus or remote) are included in the Acceptable Use Policy.
At no time should any ºÚÁÏ³Ô¹Ï user provide their login or email password to anyone, including family members.
Additional Requirements for Accessing Secure Data Remotely
For users that wish to access our secure resources remotely with elevated privileges, they will be required to submit a request via our and complete a mandatory online data security training with the understanding of how to safeguard the institution’s data.
Additional Requirement for Contract Workers
Any contract worker requesting remote access privileges to the ºÚÁÏ³Ô¹Ï network, systems and data contained therein must submit a signed copy of the System Access Agreement for Contract Workers and a Non-Disclosure Agreement before access will be granted. In signing the agreement, the contract worker acknowledges that the individual or service provider has read and agrees to abide by this Remote Access Policy and the ºÚÁÏ³Ô¹Ï Acceptable Use Policy. If the contract worker will have access to secure data, the individual that is provided a directory account will be required to have a CC department sponsor for authorization to access any CC resources.
Enforcement
Failure to abide by the responsibilities outlined in this policy will result in the user’s remote access capability being revoked until he or she produces proof that the problems have been remedied. Abusers of the college’s information technology resources will be subject to existing disciplinary procedures under current college policies in accordance with the abuser’s campus status. When appropriate or required by law, the college may request or provide assistance to law enforcement agencies to investigate suspected illegal activities.
Any contractor that violates this policy will have access privileges revoked immediately and will be subject to fines that are at a minimum equivalent to any, and all damages incurred by the College. The contractor or the vendor providing contract services may additionally be subject to legal action.