What to include in an ISO 27001 remote access policy?

• Posted by sobhana s May 14, 2020 - Filed in Business - #ISO 27001 in India  - 2,139 views

   ISO 27001 Certification in Bangalore in this era of IT industries and competition, data security is the most challenging task for any company.

  Challenges for remote access policy controls.

  Teleworking, working while travelling or working from home is all becoming popular because of it's vast acceptance by companies for cost-saving factors. In this way the threat does exist. But, implementation of teleworking control policy and certain other safety measures could be a great step towards protecting and securing information accessed, processed and stored in the various teleworking sites.

  What to consider for your ISO 27001 remote access policy?

  Any company that uses teleworking should also have a policy, a plan and a specific procedure having all the restrictions and safety controls stated in-line along with a declaration of the fact that the company is completely abiding by the law in terms of the following ways;

  • The physical security of the teleworking site which could also be a building,
  •  Employees are not allowed to share the login ID and password with anybody including their family members,
  • Employees on the other hand should also be very unbias and not use the access for outside business interest,
  • Need for any access to internal data must be justified,
  • Encryptions must be used while transmission of data during a remote access connection and should also be authorised with multi-factor authentication,
  • The ability of the teleworking employees should be limited along with a policy to remove authority and access and return of equipments when such activities are no longer required,
  • Not having split tunneling is a best practice, since users bypass gateway-level security that might be in place within the company infrastructure,
  • An acceptance and rejection obligation should be clearly stated for future possibilities,
  • The firewall operation mode should be configured as stateful rather than stateless, in order to have the complete logs.

  How to select security controls to fulfill ISO 27001 requirements for the remote access policy?

  Fast access to the data while teleworking is essential for any company to be functioning properly and to have the best productivity in terms of work. There are and there has to be external risks which should be mitigated and proper security controls should be implemented. However, rules must also be defined to stop the exposure of data due to unauthorised use. Such use could also lead to loss of confidential data along with intellectual property and a significant compromise of resources. The following points could be very helpful in forming rules;

  • Remote access must be secured and strictly controlled with encryption by using firewalls and secure 2FA Virtual Private Networks (VPNs),
  • If a BYOD(Bring Your Own Device)policy is used then  the host should and must accept all the hardware and software configuration policies as set,
  • Hosts must be fully aware about the latest anti-virus signature,
  •  ISO 27001 in India Split VPN must be avoided as in if the host uses a company-provided or a personal device which is remotely connected to the company's network should not be simultaneously connected to any other network,
  • The host should be truthful towards the company with respect to non-violation of any of the policies as stated and again should also not use the access for outside business interest,
  • Ensuring that there is no host relying on a single point of failure in the remote access of your network by having more than one device comfigures on HA(High Availability) Mode.

  Why VPN? Is it secure? 

  VPN(Virtual Private Network) can be used for transfer of data from the host to the company or otherwise. VPNs securely tunnel the data transmitted between the host and the company network, to ensure that the data and files that are being sent are not accessible other than by the two parties. Also, other authentication measures along with VPNs can be used in data transmission. 

  Some of the advantages of VPN are multiple factor authentication, enhanced security, certain restrictions like strict use of encryptions,etc.

  Avoid risks with security controls. 

  Having the flexibility to work from anywhere is the best credit that any company can give to it's employees. But, there are certain very highly destructive threats which have to be taken care of. In the same way, remote access to the organisation's network is a risk that has to be worked with proper safety controls.  

  Our advice, Go for it

   By looking at all reasons everyone is getting how the ISO 27001 certification will help the information security management system. If you’re looking to get ISO 27001 Consultants in Saudi Arabia?

   How to get ISO 27001 Consultants in Saudi Arabia?

  Certvalue is one of the leading ISO 27001 Consultants in Saudi Arabia to provide the information security management system to all organizations. We are one of the well-recognized firms with experts in every industry sector to implement the standard with 100% track record of success. You can write us at contact@certvalue.com or visit our official website at we are ISO Certification Consultant Companies in Saudi Arabia, Australia, Oman, Lebanon, Qatar, New Zealand, Afghanistan, Kuwait, Malaysia, Italy and India. Certvalue and provide your contact details so that one of our certification experts shall contact you at the earliest to understand your requirements better and provide best available service at market.