1.0 Purpose

The purpose of this policy is to define standards for connecting to the Smeal College of Business network from any remote host. These standards are designed to minimize the potential exposure to the Smeal College of Business from damages which may result from unauthorized use of Smeal College of Business resources. Damages include the loss of institutional sensitive or confidential data, intellectual property, damage to public image; damage to critical Smeal College of Business internal systems, etc.

2.0 Scope

This policy applies to all Smeal College of Business employees, contractors, consultants, temporary personnel, and other workers or students with a Smeal College of Business owned or personally owned computer or workstation that is used to connect to the Smeal College of Business network or computing resources. This policy applies to remote access connections used to do work on behalf of the Smeal College of Business and/or University, including reading or sending email, viewing intranet web resources or accessing internal Smeal or Penn State sytems (AIS, Calendar, etc).

Remote access implementations that are covered by this policy include, but are not limited to, dial-in modems, ISDN, DSL, VPN, SSH, and cable modems, etc.

3.1  Policy

3.2 General

1. It is the responsibility of the Smeal College of Business employees, contractors, vendors and agents with remote access privileges to the Smeal College of Business network to ensure that their remote access connection is given the same consideration as their on-site connection to the Smeal College of
2. Please review the following policies for details on protecting information when accessing the college network remotely, and for details on the acceptable use of the Smeal College of Business network:
   1. Smeal College of Business Virtual Private Network (VPN) Policy SCB-VPN-01
   2. Smeal College of Business Acceptable Use Policy: SCB-AD20
   3. Smeal College of Business - Anti-Virus and Anti-Spyware Protection

3.3  Requirements

1. Secure remote access must be strictly Control will be enforced via the Smeal College of Business VPN gateway.
2. At no time should any Smeal College of Business employee provide their login or email password to anyone, not even family members.
3. Smeal College of Business employees and contractors with remote access privileges must ensure that any PC, PDA, Cell phone or other computing device either personally owned,

or provided, by the Smeal College of Business which is used to remotely connect to the Smeal College of Business network, is not connected to any other network at the same time, with the exception of personal networks that are under the complete control of the user.

4. All hosts connected to the Smeal College of Business internal networks via remote access technologies must use the most up-to-date anti-virus software, this includes personal
5. For remote access, personal equipment used to connect to the Smeal College of Business networks must meet all the same requirements as equipment provided and owned by the Smeal College of Business.
6. Organizations or individuals within the Smeal College of Business may NOT implement non-standard Remote Access solutions to the College production network without obtaining prior approval from the RIIT

4.0 Enforcement

The Smeal College of Business Research Instructional and Information Technology Group (RIIT Group) has been authorized by the Dean of the Smeal College of Business to enforce this policy.

Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

5.0 Definitions

6.0 Revision History

06/04/2007 - Initial modification from COE policies, used with permission in conjunction with the Penn State IPAS project. http://www.ipas.psu.edu/

Printable PDF available