IT Resources Remote Access Policy

Purpose

The purpose of this policy is to define standards for minimizing security risks that may result from unauthorized remote access to the University’s IT Resources. 

Scope

This IT security policy, and all policies referenced herein, shall apply to all members of the University community including faculty, students, administrative officials, staff, alumni, authorized guests, delegates, and independent contractors (the “User(s)” or “you”) who use, access, or otherwise employ, locally or remotely, the University’s IT Resources, whether individually controlled, shared, stand-alone, or networked. 

Policy Statement

• Users must only use remote access for approved business or academic purposes.
• Users who need remote desktop access to their University desktop (e.g., to work from home, access from a conference) must use the University-approved software, LogMeIn, provided by the IT Service Desk 
  
  • The use of remote access software must not be self-approved. Approval and provisioning responsibilities must be appropriately separated. 
  • You must make a request through the IT Service Desk.  
• Other than remote desktop access or VPN, users requesting remote access need approval from Information Security and Assurance.
• Only authorized users can enable the Windows™ Remote Desktop (RDP) and must access the IT Resource assigned to them utilizing the University’s centralized authentication system (CAS) and multi-factor authentication (MFA). 
• Remote access authorization and privileges must be based on users’ roles, access levels, and business or academic need, and must follow the principle of least privilege. 
• Remote access must use University-approved connection methods and encrypted communications. 
• Remote access authentication must enforce University-defined limits on unsuccessful logon attempts and apply approved protective measures when those limits are exceeded. 
• Remote sessions must lock after a University-defined period of inactivity and require reauthentication before access resumes. Sessions must terminate when University-defined session limits or conditions are reached. 
• Devices used for remote access that store Fordham Protected Data or Fordham Sensitive Data must comply with University encryption requirements. 
• Unless Fordham's Office of Information Technology provides the software, installing remote access software is prohibited. Any exceptions must be requested from Information Security and Assurance. 
• Information Security and Assurance may remove any unauthorized remote software installed on the University’s IT Resources.  
• All remote access is subject to monitoring and logging per the Logging Requirements Policy and the Acceptable Uses of IT Infrastructure and Resources Policy. 
• Users must adhere to the password and authentication policies per the Password Management Policy, Multi-Factor Authentication Policy, and the Acceptable Uses of IT Infrastructure and Resources Policy.  
• IT Resources must not have multiple interfaces concurrently active per the Dual-Homed Network Policy. 
• Authorized remote User access must follow the Provisioning and Deprovisioning Policy during provisioning and deprovisioning.  
• Remote access must be granted only when needed, reviewed periodically, and must be revoked immediately when no longer required. 
• Follow the Clean Desk and Clear Screen Guidelines when using remote desktop access.

Definitions

Desktop, for this policy, includes but is not limited to laptops, notebooks, or any “personal computer” that can be accessed remotely.

IT Resources include computing, networking, communications, applications, and telecommunications systems, infrastructure, hardware, software, data, databases, personnel, procedures, physical facilities, cloud-based vendors, Software as a Service (SaaS) vendors, and any related materials and services. 

Related Policies and Procedures

• Acceptable Uses of IT Infrastructure and Resources Policy 
• Central Authentication Services Policy 
• Clean Desk and Clear Screen Guidelines
• Dual-Homed Network Policy 
• Logging Requirements Policy
• Multi-Factor Authentication Policy 
• Password Management Policy 
• Provisioning and Deprovisioning Policy
• Virtual Private Network (VPN) 

NIST SP 800-53 Rev. 5 Alignment

• Access Control: AC-2 Account Management; AC-3 Access Enforcement; AC-5 Separation of Duties; AC-6 Least Privilege; AC-7 Unsuccessful Logon Attempts; AC-11 Session Lock; AC-12 Session Termination; AC-16 Security and Privacy Attributes; AC-17 Remote Access, including monitoring and control, encryption, managed access points, and privileged access. 
• Audit and Accountability: AU-2 Event Logging; AU-12 Audit Record Generation. 
• Identification and Authentication: IA-2 Identification and Authentication (Organizational Users). 
• System and Communications Protection: SC-8 Transmission Confidentiality and Integrity. 

Implementation Information

Revision History

Policy Disclaimer Statement

Deviations from policies, procedures, or guidelines published and approved by Information Security and Assurance (ISA) will only be considered cooperatively between ISA and the requesting entity with sufficient notice to allow for conducting appropriate risk analysis, documentation, review, and notification to authorized University representatives where necessary. Failure to adhere to ISA written policies may be met with University sanctions up to and including dismissal.