1.0 PURPOSE & SCOPE
Remote access refers to the process of connecting to Company internal network from external sources which are not controlled by the IT personnel, such as home, affiliate, hotel, or other public areas. The ability to connect to company resources securely and reliably from a remote location increases the productivity of the employees.
The purpose of this policy is to provide guidelines for connecting to company’s network from any host. These guidelines are designed to minimise potential exposure to the company from damages which may arise from unauthorized use of company resources. Damages include the loss of sensitive or company confidential data, intellectual property, damage to public image, damage to critical IT systems, etc.
This policy applies to all remote access users including but not limited to permanent employees, contract workers, business partners and vendors. This also applicable to all companies under the Matrix group.
The information systems involved as follows:
1. ERP System
2. Main Folder Server
3. Payroll System (UBS)
4. CCTV
5. Door Access System
2.0 DEFINITION IN THIS POLICY
2.1 IT personnel – refers to the iCompuCare and their team.
2.2 Firewall – refer to the network security system that controls incoming and outgoing of network traffic based on a set of rules.
2.3 Virtual Private Network (VPN) – refer to a private network that is built over a public infrastructure. Security mechanisms such as encryption, allow VPN users to securely access a company network from different locations via internet.
2.4 Users – defined as Matrix staffs.
3.0 POLICY
3.1 Remote Access Requirements
• All remote access requirement must be submitted to IT personnel via iCompuCARE system (https://www.formfill.online/clientrequest/ ) for consideration and approval with Head of Departments’ justifications.
• Upon obtaining approval from HOD, the user shall email a copy of the approval to HR department for recording and documentation purposes.
• Remote access will be provided only if reasonable business needs are identified and will be granted based on the user’s job functions.
• Remote access shall be activated for vendors that requires for specific purposes and shall be deactivated immediately after use.
• Access will be granted to users upon signing the acknowledgement form that user is agreed to be abided by this policy. Additionally, VPN users are required to sign VPN Acceptable Use policy.
• Remote access must be strictly controlled using unique user credentials. Remote access credentials are to be used only by the individual to whom they were assigned and may not to be shared.
• Access requirements will be reviewed periodically by IT personnel to ensure continuous usage is still needed. IT personnel must revoke all privileges no longer needed by the user.
• Any remote access credentials should not be shared with 2nd or 3rd party either intentionally or accidentally. The staff given access is fully responsible for the safety of these credentials and information. All access will be logged. If user feels it has been compromised, it must within 24 hours of this knowledge report to the IT department to change.
• If two (2) factories authentication using mobile is enforced. The user must ensure this phone has a lock code and ensure phone is always in their possession.
3.2 General
• All remote connections to company’s internal network must go through firewall.
• Transmission of sensitive and confidential data using remote shall be encrypted.
• All remote access devices that are connected to company’s internal network must be secured by up-to-date endpoint security software, operating system security patches.
• Departments or individuals who wish to implement non-standard Remote Access solutions must obtain prior approval from IT personnel via iCompuCARE system.
• Only traffic destined for company’s internal network will travel across VPN tunnel, all other traffic will go through the user’s Internet Service Provider (ISP).
• All remote access activities shall be logged and monitored.
• IT personnel shall ensure adequate controls are in place to manage and monitor all remote access activities.
• User must notify IT personnel immediately if personal or company-owned computer or related equipment used for remote access is damaged, lost or stolen.
4.0 ENFORCEMENT
• The company reserves the right to immediately suspend or terminate the remote access for any users who failed to abide to this policy.
• Indirect or attempted violations of this policy, and actual or attempted violation by third party on behalf of the remote access user, shall be considered violation of the policy by the remote access user.
5.0 AMMENDMENTS TO THE POLICY
The Company reserves the right to review periodically when significant changes occur and revise where necessary from time to time at its discretion.
