Security Policy : Remote Access Policy

Richman Investments has decided to expand their business. We have been given their new growth projections of 10,000 employees in 20 countries, with 5,000 located within the U.S. Richman has also established eight branch offices located throughout the U.S. and has designated Phoenix, AZ being the main headquarters. With this scenario, I intend to design a remote access control policy for all systems, applications and data access within Richman Investments.

With the use of remote access solution to balance the need for mobile access and user productivity is one way to keep corporate resources secure. The Portal app for iOS and Android devices simplifies secure mobile access to Riordan web applications that reside behind the access policy manager and Gateway. With the Portal applications, employees can access internal web pages and web applications fast. The Portal, along with customers’ existing Gateway, and access policy manager deployments, provides access to internal web applications such as Riordan intranet sites. This portal access provides a launch pad that IT department use to allow mobile access to precise web resources, without exposing full network access from unknown devices. Riordan employees can sync their e-mail, calendar, and contacts directly to the company Microsoft Exchange Server. This also permits IT department to award secure mobile access to web-based resources.

Sadly, there is no way to alleviate the numerous amounts of threats that haunt networks and computers worldwide. The foundation and framework for choosing and implementing countermeasures against them are very important. A written policy is vital in helping to insure that everyone within the organization understands and behaves in an appropriate manner with regards to the fact that sensitive data and the security of software should be kept safe.

The consumer expects that when using a public computer for a specified task such as printing through a service, that the data or material is protected from other users including employees. When using a public computer for internet surfing, tax filing banking, etc. the general public user does not always think about the threats to security of their own personal information. It is important for the company to protect the users in addition to the users understanding the potential threats that exist when entering personal information.

Remote access must be strictly controlled. Remote access allows authorized users to access network resources as if they were at the physical location of the company network. These connections may be made over the phone lines by directly dialing into a remote access server on the network, or they may be made by virtual private networking (VPN).The VPN server will support Layer 2 Tunneling Protocol (L2TP) tunneling with Internet Protocol Security (IPSec) encryption. Dial-in remote access uses modems, servers running the Routing and Remote Access (RRAS) service, and the Point-to-Point (PPP) protocol to enable remote users to access the network.

The framework of security policy is defined to construct a structure by the help of which policy gaps can be identified in an easy manner. A system specific policy would assist to ensure that all employees and management comply with the policies. This is also used to maintain the confidentiality for user authentication would assist in the confidentiality aspect of security, maintain integrity (There are several limiting rules or constraints which are distinct in the relational data model and whose work is to maintain the data’s accuracy and maintain its integrity.), availability and authenticity of the system. Access controls are a collection of mechanisms that work together to create security architecture to protect the assets of an information system. One of the goals of access control is personal accountability, which is the mechanism that proves someone performed a computer activity at a specific point in time. So, the framework acts as the guideline

Any enterprise has to pay special attention to computer security. Computer security is a field that is concerned with the control of risks related to computer use. A primary focus should be on the external threats to the computing environment. In enterprise with branches cross country, it is important to allow information from "trusted" external sources, and disallow intrusion from anonymous or non-trusted sources. In a secure system, the authorized users of that system are still

With today’s technology, security has become the center point of most strives in technology. The security that TACACS+ will provide helps outweigh the risk of implementing remote access. Through dedicated logging and monitoring, TACACS+ is a very secure protocol that provides continuing support. The 9-Iron Country Club must train all employees who will be using remote access to mitigate risk of breach. The training provide will include an acceptable use policy, account protection measures, secure log-in procedures, and awareness

For example a clerk will only be able to access a limited amount of information, such as inventory at each store. The limitations will be different for an accountant or the mangers. All information will be protected with several different layers of security. The first layers will be simple hardware protection for access to the network; from there the security will increase with password protection and restrictions to users. (Merkow & Breithaupt 2006)

All customer information will be stored in the system and accessible to the clerks as read only. Everything is to be password protected and only managers will have the ability to alter said information.

Restricting access to sensitive information plays a vital role in the success of any organization. Information is deemed sensitive when it needs protection from unauthorized access. Protecting this information is essential in safeguarding security and privacy of an organization. Thus, an organization such as Bank of America has taken measures geared towards protecting its sensitive information from unauthorized access. Just like other organizations, Bank of America has two types of sensitive information. The first type of sensitive information is personal information. This is data that may affect an individual if

Given the ability move from one location to another and still maintain access information systems have now become a necessary evil. Unfortunately, a slew security concerns which must be addressed and mitigated to ensure the three pillars of the CIA triad are maintained. Guided by policy, remote access is granted once authorized users follow the processes established by Army Regulation 25-2, which also covers the encryption standards utilized to establish secure connection.

The DHHS passwords need to be strong and fully comply with the following measures of a good password. It will help in ensuring that they perform as expected in preventing unauthorized accesses to the Information systems when a malicious person manages to crack a simple password.

1) Control Matrix: A listing of the risk and 1 or more countermeasure to address the risk. (200 points)

Safety of information is the most valuable asset in any organization particular those who provide financial service to others. Threats can come from a variety of sources such as human threats, natural disasters and technical threats. By identifying the potential threats to the network, security measure can be taken to combat these threats, eliminate them or reduce the likelihood and impact if they should occur.