Printable Version (HTML)

Table of Contents

Reason for This Policy

Statement of Policy

Compliance

Who Should Know This Policy

Related Documents

Contacts

Definitions

Reason for this Policy

This policy defines standards for connecting to the Purdue University network from any remote host. These standards are designed to minimize the potential exposure to the University from damages which may result from unauthorized use of University resources. Damages include the loss of Sensitive or Restricted Data, including Protected Healthcare Information (PHI); loss of intellectual property; damage to public image; or damage to critical internal systems.

Statement of Policy

Scope:

This policy applies to all Remote Users of Purdue University IT Resources including faculty, staff, students, outside contractors, vendors, and other agents with a University-owned or personally-owned computer used to connect to the Purdue University network. This policy applies to remote access connections used to do work on behalf of Purdue University, including but not limited to, reading or sending e-mail and viewing intranet Web resources.

All remote access implementations at Purdue are covered by this policy including dial-in modems, frame relay, ISDN, DSL, VPN, SSH, cable modems, and hardware or services provided by third parties.

Nothing in this policy supersedes the Secure Computing Best Practices Document for Electronically Stored Information.

General

1. It is the responsibility of Remote Users to ensure that all possible measures have been taken to secure the remote machine. When available, this includes hardware and software firewalls and anti-virus software. A Remote User's computer system must be at least as secure as its on-site counterpart.
2. Remote Users must comply with federal, state, and local law and all Purdue policies.

Requirements

1. Secure remote access must be strictly controlled. Access to Purdue IT Resources will be controlled via career account ID and password.
2. All Remote Users working with Sensitive or Restricted Data must use Purdue VPN services.
3. At no time will a Remote User provide their password to anyone, including family members. ITaP employees will never ask for a Remote User's password.
4. Remote Users must ensure that their University-owned or personal computer or workstation, which is remotely connected to the University network, is not connected to any other network at the same time, other than a Private Network under the user's control.
5. All hosts that are connected to the University network must use up-to-date anti-virus software, keep virus definitions up to date, and run regular scans.
6. Remote Users must ensure that systems used to connect to the University network have the most recent operating system and application patches applied.

Compliance

Anyone found to have violated this policy is subject to disciplinary action, up to and including termination and/or expulsion.

Who Should Know This Policy

Related Documents

IT Resource Acceptable Use Policy
http://www.purdue.edu/policies/pages/information_technology/v_4_1.html

Secure Computing Best Practices Document for Electronically Stored Information
http://www.itap.purdue.edu/security/procedures/dataHandling/electrStored.cfm

VPN Instructions
http://www.itap.purdue.edu/connections/vpn/

Contacts

Definitions