IZM Network Security Manual Highlighted

lOMoARcPSD|23780900 ENTERPRISE NETWORK – CAPSTONE PROJECT Table of Contents Page 1. 0 Purpose 2. 0 Responsible Organization 3. 0 System Identification 1 lOMoARcPSD|23780900 3. 1 General Description 3. 2 System Operational Status 3. 3 System Interconnection/Information Sharing 3. 4 Laws, Regulations, and Polices affecting the System 4. 0 Policies 4. 1 Management/Administrative Control Policies 4. 2 Operational Control Policies 4. 3 Technical Control Policies PURPOSE The purpose of this document is to provide an overview of the security requirements of the system and describe the controls in place or planned, for meeting those requirements. This lOMoARcPSD|23780900 document also delineates responsibilities and expected behavior of all individuals who access the system. RESPONSIBLE ORGANIZATION IZM Security’s intentions for publishing an Acceptable Use Policy are not to impose restrictions that are contrary to Sunshine Reality Investments LLC established culture of openness, trust, and integrity. IZM Security is committed to protecting Sunshine Reality Investments LLC employees, partners, and the company from illegal or damaging actions by individuals, either knowingly or unknowingly. Internet/Intranet/Extranet-related systems, including but not limited to computer equipment, software, operating systems, storage media, network accounts providing electronic mail, WWW browsing, and FTP, are the property of Sunshine Reality Investments LLC. These systems are to be used for business purposes in serving the interests of the company, and of our clients and customers during normal operations. Please review Human Resources policies for further details. Effective security is a team effort involving the participation and support of every Sunshine Reality Investments LLC employee and affiliate who deals with information and/or information systems. It is the responsibility of every computer user to know these guidelines, and to conduct their activities accordingly. Information System Owner: IZM Security Authorizing Official: IZM Security 3.0 SYSTEM IDENTIFICATION 3.1 GENERAL DESCRIPTION System Name / Title 3.2 SYSTEM OPERATIONAL STATUS The operational status of this system is: OPERATIONAL 3.3 SYSTEM INTERCONNECTION/INFORMATION SHARING Identify any system interconnections – the direct connection of systems for the purpose of sharing information resources 3.4 LAWS, REGULATIONS, AND POLICIES AFFECTING THE SYSTEM lOMoARcPSD|23780900 4.0 POLICIES MOBILE DEVICE ENCRYPTION POLICY OVERVIEW Mobile devices such as smart phone and tablets offer great flexibility and improved productivity for employees. However, they can also create added risk and potential targets for data loss. As such, there use must be in alignment with appropriate standards and encryption technology should be used when possible. PURPOSE This document describes IZM Security's requirements for encrypting data at rest on Sunshine Reality Investments LLC mobile devices. SCOPE This policy applies to any mobile device issued by Sunshine Reality Investments LLC or used for Sunshine Reality Investments LLC business which contains stored data owned by Sunshine Reality Investments LLC. POLICY All mobile devices containing stored data owned by Sunshine Reality Investments LLC must use an approved method of encryption to protect data at rest. Mobile devices are defined to include laptops, PDAs, and cell phones. Users are expressly forbidden from storing Sunshine Reality Investments LLC data on devices that are not issued by Sunshine Reality Investments LLC, such as storing Sunshine Reality Investments LLC email on a personal cell phone or PDA. • Laptops Laptops must employ full disk encryption with an approved software encryption package. No Sunshine Reality Investments LLC data may exist on a laptop in plaintext. • PDAs and Cell phones Any Sunshine Reality Investments LLC data stored on a cell phone or PDA must be saved to an encrypted file system using Sunshine Reality Investments LLC -approved software. Sunshine Reality Investments LLC shall also employ remote wipe technology to remotely disable and delete any data stored on a Sunshine Reality Investments LLC PDA or cell phone which is reported lost or stolen. • Keys All encryption keys and pass-phrases must meet complexity requirements described in Sunshine Reality Investments LLC’s Password Protection Policy. • Loss and Theft The loss or theft of any mobile device containing Sunshine Reality Investments LLC data must be reported immediately. POLICY COMPLIANCE Compliance Measurement lOMoARcPSD|23780900 The IZM Security team will verify compliance to this policy through various methods, including but not limited to, business tool reports, internal and external audits, and feedback to the policy owner. EXCEPTIONS Any exception to the policy must be approved by the IZM Security team in advance. Non-Compliance An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment. Personal Communication Devices and Voicemail Policy OVERVIEW See Purpose. PURPOSE This document describes IZM Security's requirements for Personal Communication Devices and Voicemail for Sunshine Reality Investments LLC. SCOPE This policy applies to any use of Personal Communication Devices and Sunshine Reality Investments LLC Voicemail issued by Sunshine Reality Investments LLC or used for Sunshine Reality Investments LLC business. POLICY • Issuing Policy Personal Communication Devices (PCDs) will be issued only to Sunshine Reality Investments LLC personnel with duties that require them to be in immediate and frequent contact when they are away from their normal work locations. For the purpose of this policy, PCDs are defined to include handheld wireless devices, cellular telephones, laptop lOMoARcPSD|23780900 wireless cards and pagers. Effective distribution of the various technological devices must be limited to persons for whom the productivity gained is appropriate in relation to the costs incurred. Handheld wireless devices may be issued, for operational efficiency, to Sunshine Reality Investments LLC personnel who need to conduct immediate, critical Sunshine Reality Investments LLC business. These individuals generally are at the executive and management level. In addition to verbal contact, it is necessary that they have the capability to review and have documented responses to critical issues. • Bluetooth Hands-free enabling devices, such as the Bluetooth, may be issued to authorized Sunshine Reality Investments LLC personnel who have received approval. Care must be taken to avoid being recorded when peering Bluetooth adapters, Bluetooth 2.0 Class 1 devices have a range of 330 feet. • Voicemail Voicemail boxes may be issued to Sunshine Reality Investments LLC personnel who require a method for others to leave messages when they are not available. Voicemail boxes must be protected by a PIN which must never be the same as the last four digits of the telephone number of the voicemail box. • Loss and Theft Files containing confidential or sensitive data may not be stored in PCDs unless protected by approved encryption. Confidential or sensitive data shall never be stored on a personal PCD. Charges for repair due to misuse of equipment or misuse of services may be the responsibility of the employee, as determined on a case-by-case basis. The cost of any item beyond the standard authorized equipment is also the responsibility of the employee. Lost or stolen equipment must immediately be reported. • Personal Use PCDs and voicemail are issued for Sunshine Reality Investments LLC business. Personal use should be limited to minimal and incidental use. 4.6 PCD Safety Conducting telephone calls or utilizing PCDs while driving can be a safety hazard. Drivers should use PCDs while parked or out of the vehicle. If employees must use a PCD while driving, Sunshine Reality Investments LLC requires the use of hands-free enabling devices. POLICY COMPLIANCE • Compliance Measurement The Infosec team will verify compliance to this policy through various methods, including but not limited to, business tool reports, internal and external audits, and feedback to the policy owner. • EXCEPTIONS Any exception to the policy must be approved by the IZM Security Team in advance. lOMoARcPSD|23780900 • NON-COMPLIANCE An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment. lOMoARcPSD|23780900 PARKING Visitors are encouraged to use designated Visitor Parking spots. If these spots are in use, regular employee parking spots can be used. lOMoARcPSD|23780900 CHECK-IN All Visitors must arrive at a designated Check-In entrance (the main reception desk in most locations). All Visitors must present government-issue photo identification at time of Check-In. All Visitors must be met by their employee sponsor at the time of Check-In. A Visitor cannot sponsor another Visitor. Pets are not permitted; however, assistance animals such as Seeing Eye Dogs are permitted. In some cases, prior arrangements may be required. Some manufacturing areas (such as assembly clean rooms) are not appropriate for animals under any circumstances. Visitors must sign two copies of a “Visitor Agreement.” Visitors must always read this document and keep their copy of this agreement with them during their visit. Visitors will be required to initial the Emergency Evacuation section of this agreement and will be asked verbally if they have read and understand this section. Visitors will also be required to initial the Exit Inspection section of this document. All Visitor electronics (laptops, other computer equipment, cell phones, etc.) will be checked in as described in the Laptop, Computer and Related Equipment Check-In / Check-Out Procedure. lOMoARcPSD|23780900 VISITOR BADGES Visitor Badges must be worn at all time. Employees are instructed to immediately report anyone not wearing a Visitor or Employee badge. Visitors requiring access to areas controlled by swipe card access locks should arrange temporary cards with their sponsor. Departments that have swipe card access locks in their area may have a small number of temporary swipe cards available. These cards are limited to activation windows of 24 hours. lOMoARcPSD|23780900 PHOTOGRAPHS AND CAMERAS Visitors are not permitted to take photographs inside of Sunshine Reality Investments LLC premises, unless discussed specifically with sponsoring employees. For instance, photographs are sometimes required for documentation purposes. If employees have any questions about the suitability of photographs, they should consult the Human Resources Department. Dedicated cameras are not permitted onsite. Cell phones and laptops equipped with cameras are permitted, but as previously stated photographs are not permitted without permission. INFORMATION DISCLOSURE Visitors should not request information that does not pertain to their visit or the work being performed. confidential or otherwise inappropriate nature, requests for corporate documents, customer information, financial projections, comments on any matter currently under litigation, future products or future corporate direction, or requests for information or statements in the name of the company (as might be requested by a reporter or a lawyer) will be reported to the Office of the CSO, and will be dealt with under the “Penalties” section of this document. lOMoARcPSD|23780900 CHECK-OUT Visitors will check out at the same station where they arrived. All Visitor electronics will be checked out individually as described in the Laptop, Computer, and related equipment CheckIn / Check-out Procedure. The checked-out Visitor will be taken off the On-Premise List, both in the paper and online copies. Checking out of computers and related equipment may take significantly longer after regular business hours. Visitors should factor this into their estimates for exit times. lOMoARcPSD|23780900 EXIT INSPECTION Visitors may be subject to a brief search of their laptop bags or other luggage as they exit the premise. Permission for this search is granted by the Visitor signature on the Visitor Agreement Form (see the Check-In section of this document). lOMoARcPSD|23780900 EMERGENCY EVACUATION In the event of an emergency, it is the sponsoring employee's responsibility to ensure that the Visitor remains in the Evacuation marshalling area. Emergency Coordinators will tally all Visitors using the Visitor Check-In information (using either the preferred online method or the fall-back paper sheets). Visitors will not leave the property until it is confirmed with the Emergency Coordinators that they have successfully evacuated the building. lOMoARcPSD|23780900 MULTIPLE DAY VISITS AND LONGER-TERM CONTRACTS Visitors who are at Sunshine Reality Investments LLC for multiple days must follow all procedures associated with this policy (Check-In, Check-Out, etc.) on each day of their visit. Longer term contractors can be sponsored for a photo-ID badge and would then fall under the Long-Term Contractor Policy. lOMoARcPSD|23780900 VISITORS AND GROUPS REQUESTING TOURS OF THE FACILITY All requests by groups for tours of Sunshine Reality Investments LLC facility will be referred to the Human Resources Department and/or the Office of the CSO for handling as an exception. In most cases, these groups will be handled by a single form, to be signed by a designated group leader or representative. In these cases, a verbal summary of the Emergency Evacuation Procedure and the restrictions on Photographs will be communicated to the Visitor Group prior to entry of the facility by a predesignated Sunshine Reality Investments LLC employee. Any hazard specific to the areas being visited will also be communicated at that time. Visits to areas of this type may require waivers to be signed individually before entry to the facility. All Visitors or Groups on a tour will always be accompanied by their sponsor(s). lOMoARcPSD|23780900 NETWORK OR SYSTEM ACCESS Consultants or other Visitors that require internet network access can freely access the Visitor Wireless Network. Access to this network requires on-line agreement to the terms and conditions of network use. The unique number on the back of the Visitor badge is required to authenticate on the web page that is presented on access to this network. Visitors who require access to production IT networks will need permission from their employee sponsor, who will arrange temporary credentials with the Helpdesk. Part of this procedure will require the Visitor to review the Acceptable Use Policy. After credentials are arranged, activities on the network will be subject to the Acceptable Use Policy. Visitor use of employee credentials is not permitted under any circumstances. Visitors who require access to the production PLC or SCADA network will require prior permission from the Plant Manager and the Office of the CSO. Visitor use of employee credentials is not permitted under any circumstances. Contractors making changes to production systems on either the IT or PLC/SCADA networks are subject to the IT and Production Systems Change Control Policy. In these cases, employee sponsors are required to review this policy with affected Visitors and ensure that the lead time and exceptions sections especially are clearly identified. Remote Access to Sunshine Reality Investments LLC networks are governed by the Sunshine Reality Investments LLC Remote Access Policy. lOMoARcPSD|23780900 ON COURTESY All employees of Sunshine Reality Investments LLC are always to bear in mind that all Visitors are either Customers or potential Customers. Even in the case of clear violations of this policy, all actions, dealings, and conversations are to be courteous in nature. lOMoARcPSD|23780900 RESPONSIBILITY This document is maintained jointly by the Human Resources Department and the Office of the CSO (Chief Security Officer). Enforcement of this policy falls to these offices, as indicated in this document Administration of the Check-In / Check-Out procedure is the responsibility of identified individuals in each facility. In most facilities it is a duty of the main Reception Desk. lOMoARcPSD|23780900 PENALTIES Violation of any of the requirements in this policy by any employee will result in suitable disciplinary action, up to and including prosecution and / or termination. Violation of any of the requirements in this policy by any Visitor can result in similar disciplinary action against the sponsoring employee and can also result in termination of services with any associated consulting organization or prosecution in the case of criminal activity. lOMoARcPSD|23780900 RELATED DOCUMENTS The following documents are referenced in this policy. It is the responsibility of employees sponsoring Visitors to Sunshine Reality Investments LLC to ensure that Visitors are compliant with all policies and procedures that apply to any activities and situations that occur while onsite. In some cases, Visitors to Sunshine Reality Investments LLC may be asked to review, agree to, and in some cases sign one or more of these documents as part of their Check-In process. • Visitor Check-In Procedure • Visitor Check-In Agreement • Laptop, Computer, and related equipment Check-In / Check-out Procedure • Emergency Evacuation Policy • Emergency Evacuation Procedures (Note that this encompasses several documents) • Visitor Network Access Agreement (online webpage, a paper copy of this agreement under revision control is maintained by and available from the Office of the CSO) • IT and Production Systems Change Control Policy • Network User Registration Policy • Network User Registration Procedure • Computer and Network Acceptable Use Policy • Remote Access Policy All Corporate Policies and Procedures are to be considered confidential information. While many of these Corporate Documents are required by Visitors as part of their visit, any policies or procedures not required in this capacity should be considered to be governed by the “Information Disclosure” section of this document. Password Protection Policy OVERVIEW Passwords are an important aspect of computer security. A poorly chosen password may result in unauthorized access and/or exploitation of our resources. All staff, including contractors and vendors with access to Sunshine Reality Investments LLC systems, are responsible for taking the appropriate steps, as outlined below, to select and secure their lOMoARcPSD|23780900 passwords. PURPOSE The purpose of this policy is to establish a standard for creation of strong passwords and the protection of those passwords. SCOPE The scope of this policy includes all personnel who have or are responsible for an account (or any form of access that supports or requires a password) on any system that resides at any Sunshine Reality Investments LLC facility, has access to the Sunshine Reality Investments LLC network, or stores any non-public Sunshine Reality Investments LLC information. POLICY • • • • • • PASSWORD CREATION ALL USER-LEVEL AND SYSTEM-LEVEL PASSWORDS MUST CONFORM TO THE PASSWORD CONSTRUCTION GUIDELINES. USERS MUST USE A SEPARATE, UNIQUE PASSWORD FOR EACH OF THEIR WORK-RELATED ACCOUNTS. USERS MAY NOT USE ANY WORK-RELATED PASSWORDS FOR THEIR OWN, PERSONAL ACCOUNTS. USER ACCOUNTS THAT HAVE SYSTEM-LEVEL PRIVILEGES GRANTED THROUGH GROUP MEMBERSHIPS OR PROGRAMS SUCH AS SUDO MUST HAVE A UNIQUE PASSWORD FROM ALL OTHER ACCOUNTS HELD BY THAT USER TO ACCESS SYSTEM-LEVEL PRIVILEGES. IN ADDITION, IT IS HIGHLY RECOMMENDED THAT SOME FORM OF MULTI-FACTOR AUTHENTICATION IS USED FOR ANY PRIVILEGED ACCOUNTS PASSWORD CHANGE PASSWORDS SHOULD BE CHANGED ONLY WHEN THERE IS REASON TO BELIEVE A PASSWORD HAS BEEN COMPROMISED. 4.2.2 PASSWORD CRACKING OR GUESSING MAY BE PERFORMED ON A PERIODIC OR RANDOM BASIS BY THE IZM SECURITY TEAM OR ITS DELEGATES. IF A PASSWORD IS GUESSED OR CRACKED DURING ONE OF THESE SCANS, THE USER WILL BE REQUIRED TO CHANGE IT TO BE IN COMPLIANCE WITH THE PASSWORD CONSTRUCTION GUIDELINES. • • PASSWORD PROTECTION PASSWORDS MUST NOT BE SHARED WITH ANYONE, INCLUDING SUPERVISORS AND COWORKERS. ALL PASSWORDS ARE TO BE TREATED AS SENSITIVE, CONFIDENTIAL SUNSHINE REALITY INVESTMENTS LLC INFORMATION. CORPORATE INFORMATION SECURITY RECOGNIZES THAT LEGACY APPLICATIONS DO NOT SUPPORT PROXY SYSTEMS IN PLACE. PLEASE REFER TO THE TECHNICAL REFERENCE FOR ADDITIONAL DETAILS. PASSWORDS MUST NOT BE INSERTED INTO EMAIL MESSAGES, ALLIANCE CASES OR OTHER FORMS OF ELECTRONIC • lOMoARcPSD|23780900 • • • • • • • • COMMUNICATION, NOR REVEALED OVER THE PHONE TO ANYONE. PASSWORDS MAY BE STORED ONLY IN “PASSWORD MANAGERS” AUTHORIZED BY THE ORGANIZATION. DO NOT USE THE "REMEMBER PASSWORD" FEATURE OF APPLICATIONS (FOR EXAMPLE, WEB BROWSERS). ANY USER SUSPECTING THAT HIS/HER PASSWORD MAY HAVE BEEN COMPROMISED MUST REPORT THE INCIDENT AND CHANGE ALL PASSWORDS. APPLICATION DEVELOPMENT Application developers must ensure that their programs contain the following security precautions: Applications must support authentication of individual users, not groups. Applications must not store passwords in clear text or in any easily reversible form. Applications must not transmit passwords in clear text over the network. Applications must provide for some sort of role management, such that one user can take over the functions of another without having to know the other's password. • 4.5.1 MULTI-FACTOR AUTHENTICATION Multi-factor authentication is highly encouraged and should be used whenever possible, not only for work related accounts but personal accounts also. POLICY COMPLIANCE • Compliance Measurement The IZM Security team will verify compliance to this policy through various methods, including but not limited to, periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner. EXCEPTIONS Any exception to the policy must be approved by the IZM Security Team in advance. NON-COMPLIANCE An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment. Password Construction Guidelines OVERVIEW Passwords are a critical component of information security. Passwords serve to protect user accounts; however, a poorly constructed password may result in the compromise of individual systems, data, or network. This guideline provides best practices for creating secure passwords. PURPOSE The purpose of this guidelines is to provide best practices for the created of strong passwords. lOMoARcPSD|23780900 SCOPE This guideline applies to employees, contractors, consultants, temporary and other workers, including all personnel affiliated with third parties. This guideline applies to all passwords including but not limited to user-level accounts, system-level accounts, web accounts, e-mail accounts, screen saver protection, voicemail, and local router logins. STATEMENT OF GUIDELINES Strong passwords are long, the more characters you have the stronger the password. We recommend a minimum of 14 characters in your password. In addition, we highly encourage the use of passphrases, passwords made up of multiple words. Examples include “It’s time for vacation” or “block-curious-sunny-leaves”. Passphrases are both easy to remember and type yet meet the strength requirements. Poor, or weak, passwords have the following characteristics: • Contain eight characters or less. • Contain personal information such as birthdates, addresses, phone numbers, or names of family members, pets, friends, and fantasy characters. • Contain number patterns such as aaabbb, qwerty, zyxwvuts, or 123321. • Are some version of “Welcome123” “Password123” “Changeme123” In addition, every work account should have a different, unique password. To enable users to maintain multiple passwords, we highly encourage the use of ‘password manager’ software that is authorized and provided by the organization. Whenever possible, also enable the use of multifactor authentication. POLICY COMPLIANCE Compliance Measurement The IZM Security team will verify compliance to this policy through various methods, including but not limited to, periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner. EXCEPTIONS Any exception to the policy must be approved by the IZM Security team in advance. NON-COMPLIANCE An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment. System and Network Activities The following activities are strictly prohibited, with no exceptions: • Violations of the rights of any person or company protected by copyright, trade secret, patent or other intellectual property, or similar laws or regulations, including, but not limited to, the installation or distribution of "pirated" or other software products that are not appropriately licensed for use by Sunshine Reality Investments LLC. • Unauthorized copying of copyrighted material including, but not limited to, digitization lOMoARcPSD|23780900 • and distribution of photographs from magazines, books or other copyrighted sources, copyrighted music, and the installation of any copyrighted software for which Sunshine Reality Investments LLC or the end user does not have an active license is strictly prohibited. Accessing data, a server, or an account for any purpose other than conducting Sunshine Reality Investments LLC business, even if you have authorized access, is prohibited. • Exporting software, technical information, encryption software or technology, in violation of international or regional export control laws, is illegal. The appropriate management should be consulted prior to export of any material that is in question. • Introduction of malicious programs into the network or server (e.g., viruses, worms, Trojan horses, e-mail bombs, etc.). • Revealing your account password to others or allowing use of your account by others. This includes family and other household members when work is being done at home. • Using a Sunshine Reality Investments LLC computing asset to actively engage in procuring or transmitting material that is in violation of sexual harassment or hostile workplace laws in the user's local jurisdiction. • Making fraudulent offers of products, items, or services originating from any Sunshine Reality Investments LLC account. • Making statements about warranty, expressly or implied, unless it is a part of normal job duties. • Effecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, "disruption" includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes. • Port scanning or security scanning is expressly prohibited unless prior notification to IZM Security is made. • Executing any form of network monitoring which will intercept data not intended for the employee's host unless this activity is a part of the employee's normal job/duty. • Circumventing user authentication or security of any host, network, or account. • Introducing honeypots, honeynets, or similar technology on the Sunshine Reality Investments LLC network. • Interfering with or denying service to any user other than the employee's host (for example, denial of service attack). Using any program/script/command, or sending messages of any kind, with the intent to interfere with, or disable, a user's terminal session, via any means, locally or via the Internet/Intranet/Extranet. • lOMoARcPSD|23780900 Providing information about, or lists of, Sunshine Reality Investments LLC employees to parties outside Sunshine Reality Investments LLC. Virtual Private Network (VPN) Policy OVERVIEW See Purpose. PURPOSE The purpose of this policy is to provide guidelines for Remote Access IPSec or L2TP Virtual Private Network (VPN) connections to the Sunshine Reality Investments LLC corporate network. SCOPE This policy applies to all Sunshine Reality Investments LLC employees, contractors, consultants, temporaries, and other workers including all personnel affiliated with third parties utilizing VPNs to access the Sunshine Reality Investments LLC network. This policy applies to implementations of VPN that are directed through an IPSec Concentrator. POLICY Approved Sunshine Reality Investments LLC employees and authorized third parties (customers, vendors, etc.) may utilize the benefits of VPNs, which are a "user managed" lOMoARcPSD|23780900 service. This means that the user is responsible for selecting an Internet Service Provider (ISP), coordinating installation, installing any required software, and paying associated fees. Further details may be found in the Remote Access Policy. Additionally, • It is the responsibility of employees with VPN privileges to ensure that unauthorized users are not allowed access to Sunshine Reality Investments LLC internal networks. • VPN use is to be controlled using either a one-time password authentication such as a token device or a public/private key system with a strong passphrase. • When actively connected to the corporate network, VPNs will force all traffic to and from the PC over the VPN tunnel: all other traffic will be dropped. • Dual (split) tunneling is NOT permitted; only one network connection is allowed. • VPN gateways will be set up and managed by Sunshine Reality Investments LLC network operational groups. • All computers connected to Sunshine Reality Investments LLC internal networks via VPN or any other technology must use the most up-to-date anti-virus software that is the corporate standard (provide URL to this software); this includes personal computers. • VPN users will be automatically disconnected from Sunshine Reality Investments LLC network after thirty minutes of inactivity. The user must then logon again to reconnect to the network. Pings or other artificial network processes are not to be used to keep the connection open. • The VPN concentrator is limited to an absolute connection time of 24 hours. • Users of computers that are not Sunshine Reality Investments LLC-owned equipment must configure the equipment to comply with Sunshine Reality Investments LLC VPN and Network policies. • Only IZM Security-approved VPN clients may be used. • By using VPN technology with personal equipment, users must understand that their machines are a de facto extension of Sunshine Reality Investments LLC network, and as such are subject to the same rules and regulations that apply to Sunshine Reality Investments LLC-owned equipment, i.e., their machines must be configured to comply with IZM Security Policies. POLICY COMPLIANCE Compliance Measurement The IZM Security team will verify compliance to this policy through various methods, lOMoARcPSD|23780900 including but not limited to, periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner. EXCEPTIONS Any exception to the policy must be approved by the IZM Security Team in advance. NON-COMPLIANCE An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment. Remote Access Policy OVERVIEW Remote access to our corporate network is essential to maintain our Team’s productivity, but in many cases this remote access originates from networks that may already be compromised or are at a significantly lower security posture than our corporate network. While these remote networks are beyond the control of IZM Security, LLC policy, we must mitigate these external risks the best of our ability. lOMoARcPSD|23780900 PURPOSE The purpose of this policy is to define rules and requirements for connecting to Sunshine Reality Investments LLC 's network from any host. These rules and requirements are designed to minimize the potential exposure to Sunshine Reality Investments LLC from damages which may result from unauthorized use of Sunshine Reality Investments LLC resources. Damages include the loss of sensitive or company confidential data, intellectual property, damage to public image, damage to critical Sunshine Reality Investments LLC internal systems, and fines or other financial liabilities incurred as a result of those losses. SCOPE This policy applies to all Sunshine Reality Investments LLC employees, contractors, vendors and agents with a Sunshine Reality Investments LLC -owned or personally-owned computer or workstation used to connect to the Sunshine Reality Investments LLC network. This policy applies to remote access connections used to do work on behalf of Sunshine Reality Investments LLC, including reading or sending email and viewing intranet web resources. This policy covers any and all technical implementations of remote access used to connect to Sunshine Reality Investments LLC networks. POLICY It is the responsibility of Sunshine Reality Investments LLC employees, contractors, vendors and agents with remote access privileges to Sunshine Reality Investments LLC 's corporate network to ensure that their remote access connection is given the same consideration as the user's on-site connection to Sunshine Reality Investments LLC. General access to the Internet for recreational use through the Sunshine Reality Investments LLC network is strictly limited to Sunshine Reality Investments LLC employees, contractors, vendors and agents (hereafter referred to as “Authorized Users”). When accessing the Sunshine Reality Investments LLC network from a personal computer, Authorized Users are responsible for preventing access to any Sunshine Reality Investments LLC computer resources or data by non-Authorized Users. Performance of illegal activities through the Sunshine Reality Investments LLC network by any user (Authorized or otherwise) is prohibited. The Authorized User bears responsibility for and consequences of misuse of the Authorized User’s access. For further information and definitions, see the Acceptable Use Policy. Authorized Users will not use Sunshine Reality Investments LLC networks to access the Internet for outside business interests. For additional information regarding Sunshine Reality Investments LLC 's remote access connection options, including how to obtain a remote access login, free anti-virus software, troubleshooting, etc., go to the Remote Access Services website (company url). • • • • Requirements Secure remote access must be strictly controlled with encryption (i.e., Virtual Private Networks (VPNs)) and strong pass-phrases. For further information see the Acceptable Encryption Policy and the Password Policy. Authorized Users shall protect their login and password, even from family members. While using a Sunshine Reality Investments LLC -owned computer to remotely connect to Sunshine Reality Investments LLC 's corporate network, Authorized Users shall ensure the remote host is not connected to any other network at the lOMoARcPSD|23780900 • • • same time, with the exception of personal networks that are under their complete control or under the complete control of an Authorized User or Third Party. Use of external resources to conduct Sunshine Reality Investments LLC business must be approved in advance by IZM Security and the appropriate business unit manager. All hosts that are connected to Sunshine Reality Investments LLC internal networks via remote access technologies must use the most up-to-date anti-virus software (place url to corporate software site here), this includes personal computers. Third party connections must comply with requirements as stated in the Third Party Agreement. Personal equipment used to connect to Sunshine Reality Investments LLC 's networks must meet the requirements of Sunshine Reality Investments LLC -owned equipment for remote access as stated in the Hardware and Software Configuration Standards for Remote Access to Sunshine Reality Investments LLC Networks. POLICY COMPLIANCE COMPLIANCE MEASUREMENT The IZM Security Team will verify compliance to this policy through various methods, including but not limited to, periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and inspection, and will provide feedback to the policy owner and appropriate business unit manager. EXCEPTIONS Any exception to the policy must be approved by Remote Access Services and the IZM Security Team in advance. NON-COMPLIANCE An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment. Remote Access Tools Policy lOMoARcPSD|23780900 OVERVIEW Remote desktop software, also known as remote access tools, provide a way for computer users and support staff alike to share screens, access work computer systems from home, and vice versa. Examples of such software include LogMeIn, GoToMyPC, VNC (Virtual Network Computing), and Windows Remote Desktop (RDP). While these tools can save significant time and money by eliminating travel and enabling collaboration, they also provide a back door into the Sunshine Reality Investments LLC network that can be used for theft of, unauthorized access to, or destruction of assets. As a result, only approved, monitored, and properly controlled remote access tools may be used on Sunshine Reality Investments LLC computer systems. PURPOSE This policy defines the requirements for remote access tools used at