Remote Access (PS-08-023)
PS-08-023 Remote Access
Issue Date: 3/20/2008
Effective Date: 3/20/2008
Review Date: 1/31/2022
Remote access, through technologies such as broadband, VPN, internet cafés, wireless and other mobile computing technologies have increased productivity for State of Georgia employees and contractors. However, the use of these technologies has introduced new security risks to the enterprise. Allowing remote access to non-public information resources is a logical extension of the enterprise yet outside the security boundary of the agency’s control. As employees connect remotely to the corporate networks, these entry points and data transmission modes become increasingly vulnerable to agency internal networks and must be properly secured. Agencies need to approach security of remote devices in the same manner as the wired internal components of the network.
This policy establishes the requirement for agencies to protect internal state information resources from the risks associated with remote access.
Agencies shall assess the risks and establish policies that explicitly define the architecture, methods, rules, procedures, and expectations for all forms of remote access to non-public state information systems, to include, but not limited to, wireless, mobile computing and teleworking systems.
RELATED ENTERPRISE POLICIES, STANDARDS, GUIDELINES
NIST SP 800-46, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security (Revision 2)
NIST SP 800-114 User’s Guide to Securing External Devices for Telework and Remote Access
NIST SP 800-53 (Rev. 5) AC-17: Remote Access https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5…
NIST SP 800-28 Guidelines on Active Content and Mobile Code Ver. 2 https://csrc.nist.gov/publications/detail/sp/800-28/version-2/final
TERMS and DEFINITIONS
Remote Access - The ability of an organization’s users to access its non-public computing resources from locations other than the organization’s facilities.
Telework or Telecommute - The ability of an organization’s employees and contractors to conduct work from locations other than the organization’s facilities.
Mobile Computing - A generic term describing one’s ability to use technology 'untethered', that is not physically connected, or in remote or mobile (non static) environments.