• No results found

The purpose of this policy is to provide guidelines for Remote Access IPSec or Virtual Private

N/A
N/A
Protected

Academic year: 2021

Share "The purpose of this policy is to provide guidelines for Remote Access IPSec or Virtual Private"

Copied!
6
0
0

Loading.... (view fulltext now)

Full text

(1)

1. Policy Overview

The purpose of this policy is to provide guidelines for Remote Access IPSec or Virtual Private Network (VPN) connections to the University of Dammam network.

1.1. Purpose

University VPN connection allows users to connect directly to the University network through the Internet. In order to allow this connectivity, secure connection issues, performance issues, and bandwidth utilization criteria must be addressed.

1.2. Scope

The policy statements written in this document are applicable to all UoD’s VPN Users at all levels of sensitivity; including:

 VPN Admins

 Executives

 Staff

 Contractors

 All other individuals and groups who have been granted access to UoD’s ICT Network and information through VPN access.

(2)

1.3. Terms and Definitions

Table 11 provides definitions of the common terms used in this document.

Term Definition

Accountability A security principle indicating that individuals shall be able to be identified and to be held responsible for their actions.

Asset Information that has value to the organization such as forms, media, networks, hardware, software and information system.

Availability The state of an asset or a service of being accessible and usable upon demand by an authorized entity.

Confidentiality An asset or a service is not made available or disclosed to unauthorized individuals, entities or processes.

Control A means of managing risk, including policies, procedures, and guidelines which can be of administrative, technical, management or legal nature. Guideline A description that clarifies what shall be done and how, to achieve the

objectives set out in policies. Information Security

The preservation of confidentiality, integrity, and availability of information. Additionally, other properties such as authenticity, accountability, non-repudiation and reliability can also be involved.

Integrity Maintaining and assuring the accuracy and consistency of asset over its entire life-cycle.

Malware (Malicious)

Software designed to disrupt computer operation, gather sensitive information, or gain access to private computer systems (e.g., virus or Trojan horse).

Policy

A plan of action to guide decisions and actions. The policy process inclues the identification of different alternatives such as programs or spending priorities, and choosing among them on the basis of the impact they will have. Risk A combination of the consequences of an event (including changes in

circumstances) and the associated likelihood of occurrence.

System

An equipment or interconnected system or subsystems of equipment that is used in the acquisition, storage, manipulation, management, control, display, switching, interchange, transmission or reception of data and that inclues computer software, firmware and hardware.

(3)

1.4. Change, Review and Update

This policy shall be reviewed once every year unless the owner considers an earlier review necessary to ensure that the policy remains current. Changes of this policy shall be exclusively performed by the Information Security Officer and approved by management. A change log shall be kept current and be updated as soon as any change has been made.

1.5. Enforcement / Compliance

Compliance with this policy is mandatory and it is to be reviewed periodically by the Information Security Officer. All UoD units (Deanship, Department, College, Section and Center) shall ensure continuous compliance monitoring within their area.

In case of ignoring or infringing the information security directives, UoD’s environment could be harmed (e.g., loss of trust and reputation, operational disruptions or legal violations), and the fallible persons will be made responsible resulting in disciplinary or corrective actions (e.g., dismissal) and could face legal investigations.

A correct and fair treatment of employees who are under suspicion of violating security directives (e.g., disciplinary action) has to be ensured. For the treatment of policy violations, Management and Human Resources Department have to be informed and deal with the handling of policy violations.

1.6. Waiver

Information security shall consider exceptions on an individual basis. For an exception to be approved, a business case outlining the logic behind the request shall accompany the request. Exceptions to the policy compliance requirement shall be authorized by the Information Security Officer and approved by the ICT Deanship. Each waiver request shall include justification and benefits attributed to the waiver.

The policy waiver period has maximum period of 4 months, and shall be reassessed and re-approved, if necessary for maximum three consecutive terms. No policy shall be provided waiver for more than three consecutive terms.

(4)

1.7. Relevant Documents

The following are all relevant policies and procedures to this policy:

 Information Security Policy

 Human Resource Security Policy

 Access Control Policy

 Compliance Policy

 Password Policy

1.8. Ownership

(5)

2. Policy Statements

Approved University members and authorized third parties (Contractors, etc...) may utilize the benefits of VPNs, which are a "user managed" service. This means that the user is responsible for selecting an Internet Service Provider (ISP), coordinating installation, installing any required software, and paying associated fees.

Additionally,

1. In order to obtain VPN Access, a change request must approved by DICT management board, filled with request justification, email and users contact details, resources to access (including IP addresses and Port no) and duration of access required

2. It is the responsibility of users with VPN privileges to ensure that unauthorized users are not allowed access to University internal networks.

3. VPN use is to be controlled using either a one-time password authentication such as a token device or a public/private key system with a strong passphrase.

4. When actively connected to the corporate network, VPNs will force all traffic to and from the PC over the VPN tunnel: all other traffic will be dropped.

5. Dual (split) tunnelling is not permitted; only one network connection is allowed. Exception must be through DICT board request and with Dean of DICT’s approval.

6. VPN gateways will be set up and managed by University network and security teams.

7. All computers connected to University internal networks via VPN or any other technology must use the most up-to-date anti-virus software; this includes personal computers.

8. VPN users will be automatically disconnected from University’s network after 15 minutes of inactivity. The user must then logon again to reconnect to the network. Pings or other artificial network processes are not to be used to keep the connection open.

9. The VPN concentrator is limited to connection time of 72 hours or time specified by DICT management board.

10. Users must configure their machines to comply with University's VPN and Network policies. 11. Users are required to download the VPN client software from University VPN gateway in order

(6)

12. Any exception to the policy must be approved by the DICT Management Board in advance. 13. Support will only be provided for VPN clients approved by UoD University's Information

Technology Services.

14. Users found to have violated the VPN Access Policy may be subject to loss of privileges of services and be subject to disciplinary action.

15. This policy is to be periodically reviewed and amended by DICT management board.

If you have any questions related to the use of the UoD University VPN, please contact the DCIT Help Desk

References

Related documents

An analysis of the economic contribution of the software industry examined the effect of software activity on the Lebanese economy by measuring it in terms of output and value

Mackey brings the center a laparoscopic approach to liver and pancreas surgery not available at most area hospitals.. JOSHUA FORMAN, MD

Figure 1 illustrates the proposed hybrid adaptive flight control. The control architecture com- prises: 1) a reference model that translates a rate command into a desired

Quality: We measure quality (Q in our formal model) by observing the average number of citations received by a scientist for all the papers he or she published in a given

The study investigated the effects of a Mobile-Assisted Language Learning (MALL) intervention to support the development of basic EFL literacy skills by students who lacked

In order to explore teachers’ purposes for and methods of using their personal writing as models, and to investigate whether teachers experience any benefits and

• 80 percent of revenue in fiscal 2002 was generated by residential land uses; 19 percent by commercial land uses; and 1 percent by farm, forest and open lands, • 95 percent

The summary resource report prepared by North Atlantic is based on a 43-101 Compliant Resource Report prepared by M. Holter, Consulting Professional Engineer,