Remote Access Policy

1.0 Purpose

The purpose of this policy is to define standards for connecting to the American University of Sharjah’s (AUS's) network from any host. These standards are designed to minimize the potential exposure to AUS from damages which may result from unauthorized use of AUS resources. Damages include the loss of sensitive or confidential data, intellectual property, damage to public image, damage to critical AUS internal systems, etc.
             
2.0 Scope

This policy applies to all AUS students, faculty, staff, contractors, vendors and agents with a AUS-owned or personally-owned computer or workstation used to connect to the AUS network. This policy applies to remote access connections used to do work on behalf of  AUS, including reading or sending email and viewing web resources.

Remote access implementations that are covered by this policy include, but are not limited to, dial-in modems, frame relay, ISDN, DSL, VPN, SSH, and cable modems, etc.
             
3.0 Policy

3.1 General

1. It is the responsibility of AUS students, faculty, staff, contractors, vendors and agents with remote access privileges to AUS's corporate network to ensure that their remote access connection is given the same consideration as the user's on-site connection to AUS.
2. General access to the Internet for recreational use by immediate household members through the AUS Network on personal computers is permitted for faculty and staff living on campus. The AUS faculty or staff member is responsible to ensure the family member does not violate any AUS policies, does not perform illegal activities, and does not use the access for outside business interests. The AUS faculty or staff bears responsibility for the consequences should the access be misused.
3. Please review the following policies for details of protecting information when accessing the corporate network via remote access methods, and acceptable use of AUS's network:
1. Acceptable Encryption Policy
2. Virtual Private Network (VPN) Policy
3. Wireless Communications Policy
4. Acceptable Use Policy
4. For additional information regarding AUS's remote access connection options, including how to order or disconnect service, cost comparisons, troubleshooting, etc., go to the Remote Access Services website.

            
3.2 Requirements

1. Secure remote access must be strictly controlled. Control will be enforced via password authentication or public/private keys with strong pass-phrases. For information on creating a strong pass-phrase see the Password Policy.
2. At no time should any AUS employee provide their login or email password to anyone, not even family members.
3. AUS students, faculty, staff and contractors with remote access privileges must ensure that their AUS-owned or personal computer or workstation, which is remotely connected to AUS's corporate network, is not connected to any other network at the same time, with the exception of personal networks that are under the complete control of the user.
4. AUS students, faculty, staff and contractors with remote access privileges to AUS's corporate network must not use non-AUS email accounts (i.e., Hotmail, Yahoo, AOL), or other external resources to conduct AUS business, thereby ensuring that official business is never confused with personal business.
5. Reconfiguration of a home user's equipment for the purpose of split-tunneling or dual homing is not permitted at any time.
6. All hosts that are connected to AUS internal networks via remote access technologies must use the most up-to-date anti-virus software, this includes personal computers. Third party connections must comply with requirements as stated in the Third Party Agreement.
7. Personal equipment that is used to connect to AUS's networks must meet the requirements of AUS-owned equipment for remote access.
8. Organizations or individuals who wish to implement non-standard Remote Access solutions to the AUS production network must obtain prior approval from the IT Department.

4.0 Enforcement

Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment. Any student found to have violated this policy may be subject to disciplinary action, up to and including expulsion.

5.0 Definitions

Term                                     Definition

CHAP                                    Challenge Handshake Authentication Protocol is an authentication method that uses a one-way hashing function. DLCIData Link Connection Identifier ( DLCI) is a unique number assigned to a Permanent Virtual Circuit (PVC) end point in a frame relay network. DLCI identifies a particular PVC endpoint within a user's access channel in a frame relay network, and has local significance only to that channel.

Dial-in Modem                     A peripheral device that connects computers to each other for sending communications via the telephone lines. The modem modulates the digital data of computers into analog signals to send over the telephone lines, then demodulates back into digital signals to be read by the computer on the other end; thus the name "modem" for modulator/demodulator.

Dual Homing                        Having concurrent connectivity to more than one network from a computer or network device. Examples include: Being logged into the Corporate network via a local Ethernet connection, and dialing into AOL or other Internet service provider (ISP). Being on a AUS-provided Remote Access home network, and connecting to another network, such as a spouse's remote access. Configuring an ISDN router to dial into AUS and an ISP, depending on packet destination.

DSL                                        Digital Subscriber Line (DSL) is a form of high-speed Internet access competing with cable modems. DSL works over standard phone lines and supports data speeds of over 2 Mbps downstream (to the user) and slower speeds upstream (to the Internet).
                 
Frame Relay                         A method of communication that incrementally can go from the speed of an ISDN to the speed of a T1 line. Frame Relay has a flat-rate billing charge instead of a per time usage. Frame Relay connects via the telephone company's network.
                 
ISDN                                      There are two flavors of Integrated Services Digital Network or ISDN: BRI and PRI. BRI is used for home office/remote access. BRI has two "Bearer" channels at 64kbit  (aggregate 128kb) and 1 D channel for signaling info.

Remote Access                    Any access to AUS's corporate network through a non-AUS controlled network, device, or medium.

Split-tunneling                      Simultaneous direct access to a non-AUS network (such as the Internet, or a home network) from a remote device (PC, PDA, WAP phone, etc.) while connected into AUS's corporate network via a VPN tunnel. VPN Virtual Private Network (VPN) is a method for accessing a remote network via "tunneling" through the Internet.

6.0 Revision History