Body
Whenever Cedar Crest College purchases a product, there may be a situation when a vendor or support technician will need to get in to the Cedar Crest College network or on to a Cedar Crest College computer/server. The purpose of this document is to detail the methods that non-Cedar Crest individuals are authorized to use in order to provide support to the systems on campus.
This policy is designed to allow access from the outside of the Cedar Crest network to devices inside the network in as easy a manner as possible while minimizing security risk, reducing the potential for unauthorized access to Cedar Crest resources, minimizing the risk of systemic damage and reducing any chance of an outside vendor making alterations or changes without the authorization of Cedar Crest College staff. Damages include the exposure of sensitive or confidential information, damage to the performance of production systems or any incident which may damage the public image of the college.
This policy applies to all Cedar Crest College employees, contractors or vendors doing work on behalf of Cedar Crest College. This policy applies to work on college owned computers, servers, network equipment, video equipment or any other device that is connected to the Cedar Crest College network.
Vendor/Contractor Remote Access
Vendors requesting or needing remote access to Cedar Crest servers, networks, systems, or other technology resources must connect through a secure TeamViewer session facilitated by Cedar Crest IT. This is the only authorized method of remote access for non-Cedar Crest personnel.
When necessary, vendors may access network devices or other systems from the specific Cedar Crest server to which they have been granted access. Remote access is limited to the systems and resources required to perform the approved work.
The following process must be followed for vendor remote access:
- A Help Desk request must be submitted by an authorized Cedar Crest employee responsible for, or associated with, the system requiring vendor support.
- Whenever possible, the request should be submitted in advance of the vendor's need for access. In an emergency, IT should be notified as soon as the need for vendor assistance is identified or the vendor is contacted. IT will make every reasonable effort to accommodate emergency requests but cannot guarantee immediate remote access without prior notice.
- An IT staff member will coordinate a scheduled time for the vendor and appropriate Cedar Crest employee to access the system. IT will facilitate the TeamViewer connection and provide any additional system credentials required during the authorized session. System or administrative credentials will not be provided to vendors in advance.
- Vendors are responsible for installing TeamViewer on their own systems prior to the scheduled session. TeamViewer is available directly from the TeamViewer website. Cedar Crest IT does not distribute or install TeamViewer software on vendor-owned devices.
- Cedar Crest IT determines the authorized method of remote access to College systems. Vendors may not install, require, or use alternative remote-access technologies. This includes, but is not limited to, VPN access, Splashtop, vendor-installed remote management agents, or other remote-access software unless specifically authorized by Cedar Crest IT.
- Remote access authorization is limited to the approved support activity and does not constitute ongoing authorization to access Cedar Crest systems.