한국어
2.6.6

Remote Access Control

Based on official sourcesISMSISMS-PCheckpoints 4Evidence 7Cases 4

Certification criterion

Managing information systems and processing personal information from locations outside protected areas must in principle be prohibited. When remote access is allowed for unavoidable reasons such as telework, fault response, or remote collaboration, protective measures such as approval by the responsible officer, designation of access terminals, setting of the permitted access scope and period, strengthened authentication, link encryption, and access terminal security (antivirus, patches, etc.) must be established and implemented.

Key checkpoints

  1. Is remote operation of information systems over external networks such as the internet prohibited in principle, and are compensating measures in place when it is unavoidably allowed for reasons such as fault response?
  2. When information systems are operated remotely over the internal network, is access allowed only from specific terminals?
  3. When performing remote work such as telework, remote collaboration, and smart work, are protective measures established and implemented to prevent breaches such as leakage of important information and hacking?
  4. Are terminals that remotely access the personal information processing system for purposes such as management, operation, development, and security designated as management terminals, and are safety measures applied such as prohibition of arbitrary manipulation and use for purposes other than intended?

Detailed explanation

Remote operation of important information (personal information) processing, information systems, personal information processing systems, and associated major assets (servers, network equipment, security equipment, etc.) over external networks such as the internet must in principle be prohibited. When it is unavoidably allowed, the following measures must be established and implemented.

  • Approval by the responsible officer for remote operation and access
  • Application of secure authentication methods (certificates, OTP, etc.)
  • Application of secure connection methods (VPN, etc.)
  • Granting of temporary access rights and management of the status of authorized users
  • Access terminal security such as antivirus installation and security patches
  • Monitoring of remote operation status (periodic review of VPN account issuance/usage status, etc.)
  • Logging of remote access records and periodic analysis
  • Security awareness training related to remote operation, etc.

When information systems are operated remotely over the internal network, access must be allowed only from specific terminals.

  • Restricting the terminals that can connect by IP address, MAC address, etc.
  • Blocking access paths that bypass the normal remote access path, etc.

When performing remote work such as telework, remote collaboration, and smart work, protective measures must be established and implemented to prevent breaches such as leakage of important information and hacking.

  • Defining smart work forms : telework, smart work center, remote collaboration, mobile office environment
  • Setting the scope of permitted work by smart work form : the scope of allowed remote access to internal systems and services
  • Smart work approval procedure : application, approval, and revocation of remote access rights for smart work, etc.
  • Technical protective measures required for remote access : transmission link encryption (VPN, etc.), strengthened user authentication (OTP, etc.)
  • Access terminal (PC, mobile device, etc.) security : antivirus installation, application of security patches, terminal authentication, measures for loss/theft (reporting procedure, terminal lock, deletion of important information, etc.), prohibition of storing important information (encryption measures where necessary), etc.
  • Establishment of an information security guideline for the smart work environment and training, etc.

The following protective measures must be applied to terminals (management terminals or important terminals) that remotely access the personal information processing system for purposes such as management, operation, development, and security of the personal information processing system.

  • Designation of management terminals and management of their inventory
  • Measures to prevent unauthorized persons from accessing and arbitrarily manipulating management terminals
  • Measures to prevent access from terminals other than registered management terminals
  • Measures to prevent use for purposes other than intended
  • Application of protective measures to prevent malicious code infection of management terminals, etc.

Related laws

  • Personal Information Protection Act Article 29 (Duty of Safety Measures)
  • Standards for Measures to Ensure the Safety of Personal Information Article 6 (Access Control)

Evidence (examples)

  • Application forms for external access such as VPN
  • VPN account list
  • Status of VPN access control policy settings
  • IP management ledger
  • Remote access control settings (server settings, security system settings, etc.)
  • Status of designation and management of management terminals
  • Network configuration diagram

Nonconformity examples

  • A case where the internal rules specify that remote access to systems is prohibited in principle and that, in unavoidable cases, only authorized users may access through IP-based access control; however, remote desktop connection and SSH access to systems are not restricted by IP address, etc., so remote access is possible from all PCs
  • A case where a VPN is built and operated for remote operation management, but it is permanently allowed without use approval or a limit on the access period for the VPN
  • A case where business mobile apps are installed and operated on personal smart devices for external workers, but appropriate protective measures (antivirus, reset, encryption, etc.) to prevent leakage of personal information due to malicious code, loss/theft, etc. are not applied
  • A case where the external-access VPN does not restrict, per user, the network segments and information systems accessible remotely, so a user who has passed remote access authentication can excessively access the entire internal network and information systems

Source

Source: The certification criterion is based on [Annex 7] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2023.10.5); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2023.10.31); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7
Applies toISMS / ISMS-P
Key checkpoints4
Evidence7
Cases4
Related lawsYes