Remote Access

PS-08-023  Remote Access

Issue Date: 3/20/2008

Effective Date:  3/20/2008

Review Date: 7/1/2018

 

PURPOSE

Remote access, through technologies such as broadband, VPN, internet cafés, wireless and other mobile computing technologies have increased productivity for State of Georgia employees and contractors. However, the use of these technologies has introduced new security risks to the enterprise.  Allowing remote access to non-public information resources is a logical extension of the enterprise yet outside the security boundary of the agency’s control.   As employees connect remotely to the corporate networks, these entry points and data transmission modes become increasingly vulnerable to agency internal networks and must be properly secured.  Agencies need to approach security of remote devices in the same manner as the wired internal components of the network.

This policy establishes the requirement for agencies to protect internal state information resources from the risks associated with remote access.

POLICY

Agencies shall assess the risks and establish policies that explicitly define the architecture, methods, rules, procedures, and expectations for all forms of remote access to non-public state information systems, to include, but not limited to, wireless, mobile computing and teleworking systems. 

RELATED ENTERPRISE POLICIES, STANDARDS, GUIDELINES

Secure Remote Access (SS-08-038)

Teleworking and Remote Access (SS-08-037)

Wireless and Mobile Computing (SS-08-039)

REFERENCES

NIST SP 800-46, Security for Telecommuting and Broadband Communications

NIST SP 800-114 User’s Guide to Securing External Devices for Telework and Remote Access

NIST SP 800-48, Wireless Network Security

NIST SP 800- 28 Guidelines on Active Content and Mobile Code

NIST SP 800-19 Mobile Agent Security

TERMS and DEFINITIONS

Remote Access - The ability of an organization’s users to access its non-public computing resources from locations other than the organization’s facilities.

Telework or Telecommute - The ability of an organization’s employees and contractors to conduct work from locations other than the organization’s facilities.

Mobile Computing - A generic term describing one’s ability to use technology 'untethered', that is not physically connected, or in remote or mobile (non static) environments.