Remote Access Policy

Overview

Remote access to Marion Military Institute’s (MMI) network is essential to maintain productivity, but in many cases this remote access originates from networks that may already be compromised or are at a significantly lower security posture than MMI’s network. While these remote networks are beyond the control of MMI’s policy, we must mitigate these external risks to the best of our ability.

Purpose

The purpose of this policy is to define rules and requirements for connecting to Marion Military Institute’s network from any host. These rules and requirements are designed to minimize the potential exposure to MMI from damages which may result from unauthorized use of MMI resources. Damages include the loss of sensitive or company confidential data, intellectual property, damage to public image, damage to critical MMI internal systems, and fines or other financial liabilities incurred as a result of those losses.

Scope

This policy applies to all Marion Military Institute employees, contractors, vendors and agents with a Marion Military Institute-owned or personally-owned computer or workstation used to connect to the MMI network. This policy applies to remote access connections used to do work on behalf of Marion Military Institute, including reading or sending email and viewing intranet web resources. This policy covers any and all technical implementations of remote access used to connect to MMI networks.

Policy

It is the responsibility of Marion Military Institute employees, contractors, vendors and agents with remote access privileges to MMI’s network to ensure that their remote access connection is given the same consideration as the user’s on-site connection to MMI.

General access to the Internet for recreational use through the MMI network is strictly limited to MMI employees, contractors, vendors and agents (hereafter referred to as “Authorized Users”). When accessing the MMI network from a personal computer, Authorized Users are responsible for preventing access to any MMI computer resources or data by non-Authorized Users. Performance of illegal activities through the MMI network by any user (Authorized or otherwise) is prohibited. The Authorized user bears responsibility for and consequences of misuse of the Authorized User’s access. For further information and definitions, see the Acceptable Use Policy.

Authorized Users will not use Marion Military Institute networks to access the Internet for outside business interests.

Requirements

• Secure remote access must be strictly controlled with encryption (i.e., Virtual Private Networks (VPNs)) and strong pass-phrases.
• Authorized Users shall protect their login and password, even from family members.
• While using a MMI-owned computer to remotely connect to MMI’s network, Authorized Users shall ensure the remote host is not connected to any other network at the same time, with the exception of personal networks that are under their complete control or under the complete control of an Authorized User or Third Party.
• Use of external resources to conduct MMI business must be approved in advance by the Information Technology Department and the appropriate Department manager.
• All hosts that are connected to MMI’s internal networks via remote access technologies must use the most up-to-date anti-virus software; this includes personal computers.

Policy Compliance

Compliance Measurement

• The Information Technology Department will verify compliance to this policy through various methods, including but not limited to, periodic walk-throughs, business tool reports, internal and external audits, and inspection.

Exceptions

• Any exception to the policy must be approved by the Information Technology Department in advance.

Non-Compliance

• An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.