Working from home AUP!!!!

[Koldov]

Not sure where to post this... Mod - please feel free to move if there is a more appropriate forum...

 

TL;DR - Does anyone have a working from home AUP I could use/modify?!

 

A couple of weeks ago I asked the question of SLT whether any kind of home working/remote access would be needed for teachers or students.

 

I was told that it wouldn't be necessary, the children will be sent home with some resources and our website would have links to various websites. As for teachers, we are a very small Junior School and we have never deemed it necessary.

 

So, come Thursday last week and the head dropped the bombshell that I should start looking into teachers working from home and some way to get resources/homework to children and for it to be marked and returned.

 

Now, this is unprecedented I understand that, but to go from 0 - 100mph in a couple of days just blows my mind!!!

 

I need to get GSuite or O365 or something set-up and working now, accessible and safe with all the staff trained... Just not possible!

 

Luckily we are an LGfL school and there is a quick and dirty option of using their Cisco Anyconnect VPN for remote access, they also have myUSO which has a homework section/resources etc. We have an auto-update from SIMS, so all accounts have already been created and are ready to be used.

 

I am working on trying to get it all up and running, but I am concerned about having the school network open on a teachers laptop at home... Not only from a Network Security angle but also GDPR veiwpoint.

Edited March 23, 2020 by Koldov

[Koldov]

Or any helpful one-liners I can cobble together to come up with a workable document of my own?

[Koldov]

Ok, this so far... Too much/not enough?

 

WORKING FROM HOME/REMOTE ACCESS VPN.

Acceptable Use Policy.

This ‘acceptable use policy’ (AUP) is a document stipulating constraints and practices that a user must agree to for access to the school network remotely.

 

1. You are agreeing to access the school network remotely and therefore must behave accordingly in a professional manner just as you would whilst at school.

 

2. All communication from your school owned device and the school network can and will be logged and/or monitored.

 

3. Using the VPN to connect to the school network remotely means that your school owned device will effectively work as it does whilst you are on the premises at school and therefore all of the school resources such as the Q: or M: drive (where applicable) will be available to you. This will mean that certain files which require ‘Data Protection & Information Handling’ precautions may be accessible from your device.

 

4. No other person is permitted access to your school owned device at any time (this includes family members) for any reason whatsoever.

 

5. You MUST allow your school owned device to perform Windows Updates as and when required. This will ensure that the device is kept secure from vulnerabilities which could spread a virus or malware to the school network.

 

6. You must SHUTDOWN your school owned device at the end of EVERY working session. DO NOT put your school owned device into STANDBY/SLEEP by just closing the lid or just logging-off. This will provide an extra layer of security for the school network by requiring the school owned device to pass the Bitlocker encryption password stage of booting up.

 

7. You must keep your school owned device stored securely (preferably locked away) at all times when it is not in use.

 

By signing this agreement I confirm I will adhere to ALL points above and understand there will be action taken against me if I am found to be in contravention of this AUP.

[FN-GM]

I don't understand why you would have a seperate policy? Surely your existing ones will cover this? All the above would apply inside the school building anyway?

[jmak]

I don't understand why you would have a seperate policy? Surely your existing ones will cover this? All the above would apply inside the school building anyway?

FWIW I agree. Might be worth sending out a copy of the original AUP and reminding the them of what they already signed and then something similar to the above as an explainer of how the policy applies when working from home.

 

Lots of people sign agreements without reading them - never mind taking any notice of what's in them...

[Koldov]

No, absolutely not.

 

I do agree that a standard AUP 'may' cover some eventualities but I (and the SLT) believe that as this is our first foray into the world of remote working that it should be made a specific entity.

 

There are a few things that are covered here that would not be in our standard AUP as I see it, I think ours was just a generic one copied from someone else...

 

As they will need to be trained in the use of the VPN, so they will be required to read and sign the AUP at that time.

 

Also as they may be away for more than a couple of weeks, there is nothing in our standard AUP which covers Windows Updates, shutting down at the end of the day or having access to the school system whilst away from school.

 

Sure they may take the laptop homes already and leave them logged on/let their children use the apps/internet, but they now need to realise that there are other dangers of leaving the laptop signed on and connected to the live school network and leaving it sitting on the dining table with friends/family members around...

[highsky]

Is this one from Sans any good:

 

https://www.sans.org/security-resources/policies/network-security/pdf/remote-access-policy

[FN-GM]

No, absolutely not.

 

I do agree that a standard AUP 'may' cover some eventualities but I (and the SLT) believe that as this is our first foray into the world of remote working that it should be made a specific entity.

 

There are a few things that are covered here that would not be in our standard AUP as I see it, I think ours was just a generic one copied from someone else...

 

As they will need to be trained in the use of the VPN, so they will be required to read and sign the AUP at that time.

 

Also as they may be away for more than a couple of weeks, there is nothing in our standard AUP which covers Windows Updates, shutting down at the end of the day or having access to the school system whilst away from school.

 

Sure they may take the laptop homes already and leave them logged on/let their children use the apps/internet, but they now need to realise that there are other dangers of leaving the laptop signed on and connected to the live school network and leaving it sitting on the dining table with friends/family members around...

 

Again all those points you made apply to everyday use? As you say it's not acceptable to leave a logged in laptop hanging around at home but nor is that acceptable in the workplace. It sounds like your existing AUP is weak (by your own admission it was copied from some place else) and needs improving rather than making a new one.

 

In the world of business where working remotely is common they generally don't have seperate policies to cover different physical locations.

Edited March 23, 2020 by FN-GM