1.0 Overview

Standards for network access and authentication are highly required to the company's information security. Any user accessing the company's computer systems has the ability to compromise the security of all users of the network. Appropriate Network Access and Authentication Policy decrees the chances of a security breache by requiring application authentication and access standards across the network in all locations.

2.0 Purpose

The purpose of this policy is to illustrate what must be done to ensure that users connecting to the corporate network are authorized users in compliance with company standards, and are given the least amount of access required to perform their job function.

3.0 Scope

The scope of this policy includes all users who have access to company provided computers or require access to the corporate network and systems. This policy applies not only to employees, but also to guests, contractors, and anyone requiring access to the corporate network. Public accesses to the company’s externally-reachable systems, such as its corporate website or public web applications, are specifically excluded from this policy.

4.0 Policy

4.1 Account Setup
During initial account setup, certain checks must be performed maintain the integrity of the process. The following policies apply to account setup:

• Positive ID with Human Resources
• Users will be granted least amount of network access required to perform his or her job function as long as they remain employed with the company

• Users will be granted access only if he or she accepts the Acceptable Use Policy.

4.2 Account Use
Network accounts must be delegated in a standard form and used across the organization. The following policies apply to account use:

• Accounts must be created using a standard format firstnamelastname, etc.

• Accounts must be password protected.

• Accounts must be for individuals only. Account sharing and group accounts are not permitted in any circumstances’

• Guests will have a business need for access to the network. When a reasons demonstrated, temporary guest access is allowed for a period needed to complete the task. This access will give minimal access will be restricted to only the necessary timeframe to complete their job

• Individuals requiring access to confidential data must have an account. This account will be subject to additional monitoring or auditing at the discretion of the IT Manager or executive team, or as required.

4.3 Account Termination
Maintaining network and user accounts, it’s really important to have communication with the Human Resources department so that when employee are hired or no longer Employed at the company any more accounts can be disabled. Human Resources must let the IT Manager know
4.4 Authentication
User machines must be configured to request authentication at startup. If the domain is not available or can not verify for some reason cannot occur, then the machine should not be permitted to access the network.

4.5 Use of Passwords when accessing the network username and password are acceptable means of authentication. Usernames must be meet the requirements presented in this document, and passwords must meet all requirementsto the company's Password Policy.

4.6 Remote Network Access
Remote access to the network can be provided for convenience to users but this comes at some risk to security. For that reason, the company encourages additional scrutiny of users remotely accessing the network. The company's standards dictate that username and password is an acceptable means of authentication as long as appropriate policies are followed. Remote access must adhere to the Remote Access Policy.

4.7 Screensaver Passwords
Screensaver passwords offer an easy way to strengthen security by removing the opportunity for a malicious user, curious employee, or intruder to access network resources through an idle computer. For this reason screensaver passwords are required to be activated after 5 minutes of inactivity.

4.8 Minimum Configuration for Access
Any system connecting to the network can have a serious impact on the security of the entire network. Vulnerability, virus, or other malware may be inadvertently introduced in this manner. For this reason, users must strictly adhere to corporate standards with regard to antivirus software and patch levels on their machines. Users must not be permitted network access if these standards are not met. This policy will be enforced with product that provides network admission control.

4.9 Encryption
Industry best practices state that username and password combinations must never be sent as plain text. If this information were intercepted, it could result in a serious security incident. Therefore, authentication credentials must be encrypted during transmission across any network, whether the transmission occurs internal to the company network or across a public network such as the Internet.

4.10 Failed Logons logon failures are indications that someone is attempt to 'crack' a password to access a network account. In order to protect against password-guessing and brute-force attempts, the company must lock a user's account after 3 unsuccessful logins. This can be implemented as a time-based lockout or require a manual reset, at the discretion of the IT Manager.

4.11Applicability of Other Policies
This document is part of the company's cohesive set of security policies. Other policies may apply to the topics covered in this document and as such the applicable policies should be reviewed as needed.

5.0 Enforcement

This policy will be enforced by the IT Manager and/or Executive Team. Violations may result in disciplinary action, which may include suspension, restriction of access, or more severe penalties up to and including termination of employment. Where illegal activities or theft of company property are suspected, the company may report such activities to the applicable authorities.