The contents of this presentation are:

1
The contents of this presentation are
Remote network and email access

• UNCLASSIFIED

2
Introduction

• This presentation overviews some of the security
  risks, and possible preventative measures,
  associated with remote network access and remote
  email access.

3
Our Responsibilites

• We must abide by the following
• Security in the Government Security (SIGS)
• ISO/IEC 17799
• Existing in-house IT security policies
• Best Practice.

4
Managing the risks

• Make remote access hard to get and easy to lose
• Users should read and sign a separate remote
  access usage policy
• Only allow connections from known machines, that
  have a single authenticated user - no home PCs
  where other people may have access

5
Managing the risks

• Ensure your internal IT security policies are
  followed, particularly
• Physical security and information-handling
  security
• Anti-virus and personal firewalls
• Operating system patch management
• Logon and logoff procedures.

6
Managing the risks

• We recommend that you do not allow the following
• PDAs, mobile or wireless devices, or wireless
  connections
• Access from internet kiosks
• Guest or anonymous accounts
• Users connecting via the internet with
  Administrator privileges set on their machine

7
Managing the risks

• We highly recommend
• Users have a separate remote access profile.
• Remote machines are audited regularly.
• Restrict access to the minimum set of rights
  possible, i.e. read-only.
• Connect via a major ISP and use encrypted VPN
  tunnels.

8
Remote Webmail Access

• Should not be used for SEE mail.
• The browser and OS caches must be flushed to
  remove temporary files.
• Connections to a remote machine can remain live
  if the user closes the browser window, but
  forgets to log-off.
• Authentication and privacy are issues.

9
Microsoft Outlook Web Access (OWA)

• Requires the use of Microsoft IIS.
• Uses only basic authentication.
• Bypasses security measures and connects directly
  to the Exchange server.
• Restricted anti-virus and content checking
  options.

10
Domino Web Access

• Sometimes viewed as being less insecure than
  OWA, it is still subject to number of
  vulnerabilities, especially when it is located on
  a Linux server.

11
Managing the Accounts

• It is highly important that all remote access
  accounts be reviewed on an ongoing basis, with
  inactive accounts being disabled and accounts
  that are no longer required being removed
  permanently.

12
Summary

• Stay within the existing rules.
• No kiosk, anonymous or home PC access.
• Make sure everyone knows what they are
  responsible for.
• Manage ongoing compliance.
• Assume the worst will happen and plan for it.