{"id":927,"date":"2020-06-23T10:41:23","date_gmt":"2020-06-23T20:41:23","guid":{"rendered":"https:\/\/www.hawaii.edu\/testinfosec\/?page_id=927"},"modified":"2025-12-10T11:37:31","modified_gmt":"2025-12-10T21:37:31","slug":"working-remotely","status":"publish","type":"page","link":"https:\/\/www.hawaii.edu\/infosec\/working-remotely\/","title":{"rendered":"Security Guidelines for Working Remotely"},"content":{"rendered":"<h2>Quick Links<\/h2>\n<ul>\n<li><a href=\"#leaving-office\">Securing your Office Workspace for Remote Work<\/a><\/li>\n<li><a href=\"#workspace\">Securing Your Remote Workspace<\/a><\/li>\n<li><a href=\"#network\">Securing Your Remote Workspace Network<\/a><\/li>\n<li><a href=\"#device\">Securing Your Device<\/a><\/li>\n<li><a href=\"#work-remotely\">When Working Remotely<\/a><\/li>\n<li><a href=\"#virtual-meetings\">Protecting your Virtual Meetings<\/a><\/li>\n<li><a href=\"#what-uh-vpn\">What is the Â鶹´«Ã½VPN<\/a><\/li>\n<li><a href=\"#data-consideration\">When working remotely, what do you need to consider when it comes to your work data?<\/a><\/li>\n<li><a href=\"#references\">References<\/a><\/li>\n<li><a href=\"#contact-info\">Contact Information<\/a><\/li>\n<\/ul>\n<h2 id=\"leaving-office\">Securing your Office Workspace for Remote Work<\/h2>\n<ul>\n<li>Backup important files (physical or digital) and secure them properly<\/li>\n<li>Lock up documents, flash drives, files, external hard drives, etc. that contain sensitive content<\/li>\n<li>Turn off any devices that are not needed while you are out (desktop computer, printer, fax machines, copiers, etc.)<\/li>\n<li>Setup primary\/alternate\/formal\/informal communication methods with your staff\/supervisor<\/li>\n<li>Setup call forwarding and\/or be familiar with retrieving voicemail messages<\/li>\n<li>Ensure that you have the proper equipment to work remotely (Mouse\/Keyboard, Camera, Microphone, etc.)<\/li>\n<li>Check with your IT support staff for specifics in connecting to your campus and\/or department resources (such as a file servers, shared drives, etc.).<\/li>\n<\/ul>\n<h2 id=\"workspace\">Securing Your Remote Workspace<\/h2>\n<p>Dedicate a working area that is suitable for teleworking. The working area should be physically secured and not accessible to the public. Listed below are considerations for securing your physical working environment:<\/p>\n<ul>\n<li>Your workspace should include locked doors\/rooms and windows to prevent unauthorized access to devices. If a dedicated room is unavailable, devices should enable a screen lock and be stored in a secured location when not in use.<\/li>\n<li>Do not leave devices unattended and place them in a secured location when not in use.<\/li>\n<li>Do not let friends\/family use work devices<\/li>\n<\/ul>\n<h2 id=\"network\">Securing Your Remote Workspace Network<\/h2>\n<p>Your remote workspace network should utilize secure protocols and be configured to block public access to your network. Listed below are configurations to secure your network:<\/p>\n<ul>\n<li>Set a strong password for your Wi-Fi network (SSID) and restrict access if possible. Some routers allow for the creation of guest networks for your personal devices, friends, and family.<\/li>\n<li>Configure your Wi-Fi network to utilize WPA3 or WPA2 at a minimum<\/li>\n<li>Change your remote workspace router&#8217;s default username and password.<\/li>\n<li>Update your remote workspace router&#8217;s firmware and ensure it is kept up-to-date<\/li>\n<li>Do not utilize any public or &#8220;free&#8221; networks<\/li>\n<\/ul>\n<h2 id=\"device\">Securing Your Devices<\/h2>\n<div id=\"yellow-info-box\">\n<h3>Device Considerations<\/h3>\n<p>If possible, utilize a UH-owned device such as a Â鶹´«Ã½provided laptop for remote work. If you are unable to utilize a UH-owned device, your device should be dedicated to work-related activities. All devices used for remote work must be running fully supported Operating Systems and be able to meet the <a href=\"https:\/\/www.hawaii.edu\/infosec\/minimum-standards\/\">Â鶹´«Ã½Minimum Security Standards<\/a>.<\/p>\n<\/div>\n<p><\/br><\/p>\n<p>\n  Listed below are specific configurations to secure your devices:<\/p>\n<ul>\n<li>Ensure automatic updates are enabled on your device and confirm that your devices are running the latest Operating System (OS) version.<\/li>\n<li>Uninstall software that are not required for work-related responsibilities. Ensure all authorized software are kept up-to-date.<\/li>\n<li>Ensure that your device&#8217;s host-based firewall is enabled.<\/li>\n<li>Ensure your device&#8217;s user account(s) are configured with strong and unique passwords (Minimum 12 characters long)<\/li>\n<li>Enable screen locking\/login protection; recommend 10 minutes or fewer\n<ul>\n<li>Windows Instructions: <a href=\"https:\/\/www.hawaii.edu\/askus\/1807\">https:\/\/www.hawaii.edu\/askus\/1807 <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a><\/li>\n<li>macOS Instructions: <a href=\"https:\/\/www.hawaii.edu\/askus\/1806\">https:\/\/www.hawaii.edu\/askus\/1806 <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a><\/li>\n<\/ul>\n<\/li>\n<li>Enable Full-Disk Encryption on your device. For instructions on how to enable encryption, see <a href=\"https:\/\/www.hawaii.edu\/infosec\/resources-tips\/encryption\/\">https:\/\/www.hawaii.edu\/infosec\/resources-tips\/encryption\/<\/a><\/li>\n<li>If you have media with Sensitive\/Regulated data such as hard drives, utilize full-disk encryption to encrypt them.<\/li>\n<li>Ensure your device&#8217;s built-in anti-malware capabilities are enabled (Defender for Windows and X-Protect on Mac). If your device is UH-owned, ensure that <a href=\"https:\/\/www.hawaii.edu\/infosec\/assets\/sentinelone\/\">Sentinel One<\/a> is installed.<\/li>\n<li>Utilize the <a href=\"https:\/\/www.hawaii.edu\/infosec\/assets\/minimum-standards\/implementation-guides\/\">Â鶹´«Ã½Minimum Security Standards Implementation Guides<\/a> which contain practical instructions on configuring your device to meet the Â鶹´«Ã½Minimum Security Standards<\/li>\n<\/ul>\n<h2 id=\"work-remotely\">When Working Remotely<\/h2>\n<p>Listed below are procedures to follow when working remotely:<\/p>\n<ul>\n<li>Separate personal and work Internet use (e.g. use two different devices)<\/li>\n<li>Avoid downloading sensitive material onto home devices<\/li>\n<li>If downloading sensitive material is necessary, use HTTPS and <a href=\"\/infosec\/resources-tips\/encryption\/\">file encryption<\/a>. Avoid printing sensitive material.<\/li>\n<li>Do not print materials that contain Protected Data or bring such materials from your workplace to your remote work location, except on an as-needed basis subject to supervisor prior approval if applicable. Printed materials should be stored in a secured locked cabinet or room when not in use and documents must be shredded and destroyed promptly once they are no longer needed.<\/li>\n<li>Never use email to send sensitive material, use <a href=\"https:\/\/www.hawaii.edu\/filedrop\/\">Â鶹´«Ã½FileDrop <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a> instead<\/li>\n<li>For high risk transactions, verify email senders using alternate methods (e.g. phone call)<\/li>\n<li>Watch out for phishing, malicious attachments, scams, etc.<\/li>\n<li>Utilize headphones to protect the confidentiality of phone calls and video conferencing.<\/li>\n<li>Do not plug in any personal or unauthorized external media devices such as USB drives, external hard drives, etc.<\/li>\n<li>Disconnect authorized external devices such as external hard drives when not in use<\/li>\n<li>Always disconnect shared drives on a department file server when done working<\/li>\n<li>Disconnect from the Â鶹´«Ã½VPN when you are done working<\/li>\n<\/ul>\n<h2 id=\"virtual-meetings\">Protecting your Virtual Meetings<\/h2>\n<p>Utilize the <a href=\"https:\/\/drive.google.com\/a\/hawaii.edu\/file\/d\/1nZAu5dCtgqNn2MST_21RfcDFy9SM3xG6\/view?usp=sharing\">ITS Recommended Zoom Settings [PDF]<\/a> to ensure that you don\u2019t have &#8220;uninvited&#8221; guests joining your Zoom sessions.\n<\/p>\n<p>\n  <strong>More Resources:<\/strong><\/p>\n<ul>\n<li>Zoom Recommendations: <a href=\"https:\/\/blog.zoom.us\/wordpress\/2020\/03\/20\/keep-the-party-crashers-from-crashing-your-zoom-event\/\">https:\/\/blog.zoom.us\/wordpress\/2020\/03\/20\/keep-the-party-crashers-from-crashing-your-zoom-event\/ <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a><\/li>\n<li>NIST Best Practices on conducting virtual meetings securely:  <a href=\"https:\/\/www.nist.gov\/blogs\/cybersecurity-insights\/preventing-eavesdropping-and-protecting-privacy-virtual-meetings\">https:\/\/www.nist.gov\/blogs\/cybersecurity-insights\/preventing-eavesdropping-and-protecting-privacy-virtual-meetings <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a><\/li>\n<li>ITS Zoom Blog: <a href=\"https:\/\/www.hawaii.edu\/its\/videoconferencing\/zoomblog\/\">https:\/\/www.hawaii.edu\/its\/videoconferencing\/zoomblog\/ <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a><\/li>\n<\/ul>\n<h2 id=\"what-uh-vpn\">What is the Â鶹´«Ã½VPN<\/h2>\n<p><\/p>\n<p>\nVPN stands for &#8220;Virtual Private Network&#8221;.  It enables IP traffic to travel securely over a public TCP\/IP network by encrypting all traffic from one network to another. VPNs are generally used when a person wants to use a computer from a remote site (such as their home) to access &#8220;enterprise&#8221; (corporate) resources. The Â鶹´«Ã½VPN allows you to become part of the Â鶹´«Ã½network from anywhere.\n<\/p>\n<p>\nAccess to the Â鶹´«Ã½VPN is only necessary if it is required by a specific institutional application. Most general applications (Â鶹´«Ã½email, Lamaku, etc.) are accessible without having to use the Â鶹´«Ã½VPN. Please verify with the application owner to see if VPN access is necessary. <a href=\"https:\/\/www.hawaii.edu\/infosec\/assets\/uh-vpn-services\/\">List of Â鶹´«Ã½Services that require the Â鶹´«Ã½VPN (Login Required)<\/a>\n<\/p>\n<p>\nSpecific details on using the Â鶹´«Ã½VPN can be found at:  <a href=\"http:\/\/www.hawaii.edu\/its\/vpn\/\">http:\/\/www.hawaii.edu\/its\/vpn\/ <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a>\n<\/p>\n<h2 id=\"data-consideration\">When working remotely, what do you need to consider when it comes to your work data?<\/h2>\n<p><\/p>\n<ol>\n<li><strong>Determine the level of sensitivity of the data you work with<\/strong><br \/>\n  Â鶹´«Ã½has four data classification categories: Public, Restricted, Sensitive, and Regulated. They are listed in order based on increasing levels of sensitivity and risk. The following table describes the four groups. Looking at the type of data you work with, identify the category with the highest level of sensitivity. That will determine the security guidelines you need to follow. For example, if you work with a mix of Public, Restricted, and Sensitive data, follow the security guidelines for Sensitive data.<\/p>\n<p>Review the table on the data governance site (login required): <a href=\"https:\/\/datagov.intranet.hawaii.edu\/institutional-data-classification-levels\/\">https:\/\/datagov.intranet.hawaii.edu\/institutional-data-classification-levels\/ <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a><\/p>\n<p><a href=\"https:\/\/www.hawaii.edu\/policy\/e2.214\">More information is available at EP 2.214, Institutional Data Classification Categories and Information Security Guidelines. <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a><\/p>\n<\/li>\n<li><strong>Review data security guidelines<\/strong><br \/>The Security Guidelines for Working Remotely provides guidance on how to protect your work data in accordance with <a href=\"\/infosec\/policies\/\">Â鶹´«Ã½policies<\/a> and the <a href=\"https:\/\/www.hawaii.edu\/ohr\/documents\/12693\/\">Â鶹´«Ã½Telework Policy and Guidelines<\/a>. The most common types of applications are listed in the table below. If an application is not listed or you need further clarification, contact the Information Security Team at <a href=\"mailto:infosec@hawaii.edu\">infosec@hawaii.edu<\/a><\/li>\n<\/ol>\n<table class=\"table table-bordered table-striped\">\n<thead>\n<tr>\n<th colspan=\"3\">Services<\/td>\n<\/tr>\n<\/thead>\n<tr>\n<th>System<\/th>\n<th>Public\/Restricted Data<\/th>\n<th>Sensitive\/Regulated Data<\/th>\n<\/tr>\n<tr>\n<td>\nAudio and video conferencing (Zoom, Google Hangouts Meet, WebEx, etc.)<\/p>\n<p>To schedule recurring conferences and\/or classes on Zoom: <a href=\"https:\/\/www.hawaii.edu\/its\/videoconferencing\/desktop\/\">https:\/\/www.hawaii.edu\/its\/videoconferencing\/desktop\/ <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a> <\/p>\n<\/td>\n<td>No restrictions<\/td>\n<td>\nYes, issue passwords to participants to prevent unauthorized individuals from accessing the link or recording the session without permission or plan to secure the file (recording) properly.<\/p>\n<p>If you are part of JABSOM and will be using Individually Identifiable Health Information (IIHI), please contact JABSOM IT\n<\/td>\n<tr>\n<td>Online Document management (Google@UH: Docs, Sheets, Forms, etc.)<\/td>\n<td>No restrictions<\/td>\n<td>\nGoogle Drive, Docs, Sheets, Forms, etc. are not authorized for the storage of Sensitive\/Regulated data. The <a href=\"https:\/\/www.hawaii.edu\/infosec\/dropbox\/\">Â鶹´«Ã½Enterprise Dropbox<\/a> should be used instead.\n<\/td>\n<\/tr>\n<tr>\n<td>Document management (MS Office: Word, Excel, etc.)<\/td>\n<td>No restrictions<\/td>\n<td>Yes, at a minimum, password protect your file.<\/td>\n<\/tr>\n<tr>\n<td>Email (Gmail, Outlook, Thunderbird, etc.) <\/td>\n<td>No restrictions<\/td>\n<td>Yes, do not send data\/information via email. <\/p>\n<p> The data needs to be <a href=\"\/infosec\/resources-tips\/encryption\/\">encrypted<\/a> when stored and when transmitted. <\/p>\n<p>Use <a href=\"https:\/\/www.hawaii.edu\/filedrop\/\">Â鶹´«Ã½FileDrop <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a> to send sensitive\/regulated documents<\/td>\n<\/tr>\n<tr>\n<td>Storage (Downloading or saving work to your personal computer at home)<\/td>\n<td>No restrictions<\/td>\n<td>If necessary to save files to your local computer, it must be <a href=\"\/infosec\/resources-tips\/encryption\/\">encrypted<\/a> and deleted from your local computer when it&#8217;s no longer needed. <\/p>\n<p>Learn more about encryption here: <a href=\"\/infosec\/resources-tips\/encryption\/\">https:\/\/www.hawaii.edu\/infosec\/resources-tips\/encryption\/<\/a><\/td>\n<\/tr>\n<tr>\n<td>\nFile transmission (FileDrop)<br \/>\n<a href=\"https:\/\/www.hawaii.edu\/filedrop\/\">https:\/\/www.hawaii.edu\/filedrop\/ <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a>\n<\/td>\n<td>Not required<\/td>\n<td>Yes, use to receive or transmit files. Files can be exchanged with non-Â鶹´«Ã½parties as long as one party has a Â鶹´«Ã½username. <\/td>\n<\/tr>\n<\/table>\n<p><\/p>\n<h2 id=\"references\">References<\/h2>\n<ul>\n<li>Â鶹´«Ã½Telework Policy and Guidelines Document: <a href=\"https:\/\/www.hawaii.edu\/ohr\/documents\/12693\/\">https:\/\/www.hawaii.edu\/ohr\/documents\/12693\/ <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a><\/li>\n<li>Desktop Videoconferencing (Zoom) \u2014 <a href=\"https:\/\/www.hawaii.edu\/its\/videoconferencing\/desktop\/\">https:\/\/www.hawaii.edu\/its\/videoconferencing\/desktop\/ <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a> <\/li>\n<li>ITS Zoom Blog: <a href=\"https:\/\/www.hawaii.edu\/its\/videoconferencing\/zoomblog\/\">https:\/\/www.hawaii.edu\/its\/videoconferencing\/zoomblog\/ <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a><\/li>\n<li>Report Security-Related Issues or Incidents \u2014 <a href=\"https:\/\/www.hawaii.edu\/infosec\/notification\/\">https:\/\/www.hawaii.edu\/infosec\/notification\/<\/a><\/li>\n<li>Â鶹´«Ã½Minimum Security Standards<a href=\"https:\/\/www.hawaii.edu\/infosec\/minimum-standards\/\">https:\/\/www.hawaii.edu\/infosec\/minimum-standards\/ <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a><\/li>\n<li>Â鶹´«Ã½FileDrop \u2014 <a href=\"https:\/\/www.hawaii.edu\/filedrop\/\">https:\/\/www.hawaii.edu\/filedrop\/ <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a><\/li>\n<li>Â鶹´«Ã½Institutional Data Classification Levels \u2014 <a href=\"https:\/\/datagov.intranet.hawaii.edu\/institutional-data-classification-levels\/\">https:\/\/datagov.intranet.hawaii.edu\/institutional-data-classification-levels\/ <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a><\/li>\n<li>Â鶹´«Ã½ITS Help Desk \u2014 <a href=\"https:\/\/www.hawaii.edu\/its\/help-desk\/\">https:\/\/www.hawaii.edu\/its\/help-desk\/ <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a><\/li>\n<li>Â鶹´«Ã½ITS VPN Information \u2014 <a href=\"http:\/\/www.hawaii.edu\/its\/vpn\/\">http:\/\/www.hawaii.edu\/its\/vpn\/ <i class=\"fa fa-external-link\" aria-hidden=\"true\"><\/i><\/a><\/li>\n<\/ul>\n<h2 id=\"contact-info\">Contact Information<\/h2>\n<p>\n\tITS Help Desk <\/p>\n<p>\tPhone: (808) 956-8883<br \/>\n\tToll Free: (neighbor isles) (800) 558-2669<br \/>\n\tFax: (808) 956-2108<br \/>\n\tEmail: help@hawaii.edu<br \/>\n\tPhone and Email Support<\/p>\n<p>\t24 hours a day, 7 days a week<br \/>\n\tOpen during all Holidays<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Quick Links Securing your Office Workspace for Remote Work Securing Your Remote Workspace Securing Your Remote Workspace Network Securing Your Device When Working Remotely Protecting your Virtual Meetings What is the Â鶹´«Ã½VPN When working remotely, what do you need &hellip; <\/p>\n","protected":false},"author":82,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"page-onecolumn.php","meta":{"footnotes":""},"class_list":["post-927","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/pages\/927","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/users\/82"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/comments?post=927"}],"version-history":[{"count":18,"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/pages\/927\/revisions"}],"predecessor-version":[{"id":2546,"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/pages\/927\/revisions\/2546"}],"wp:attachment":[{"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/media?parent=927"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}