1. Policy Overview
The purpose of this policy is to provide guidelines for Remote Access IPSec or Virtual Private Network (VPN) connections to the University of Dammam network.
1.1. Purpose
University VPN connection allows users to connect directly to the University network through the Internet. In order to allow this connectivity, secure connection issues, performance issues, and bandwidth utilization criteria must be addressed.
1.2. Scope
The policy statements written in this document are applicable to all UoD’s VPN Users at all levels of sensitivity; including:
VPN Admins
Executives
Staff
Contractors
All other individuals and groups who have been granted access to UoD’s ICT Network and information through VPN access.
1.3. Terms and Definitions
Table 11 provides definitions of the common terms used in this document.
Term Definition
Accountability A security principle indicating that individuals shall be able to be identified and to be held responsible for their actions.
Asset Information that has value to the organization such as forms, media, networks, hardware, software and information system.
Availability The state of an asset or a service of being accessible and usable upon demand by an authorized entity.
Confidentiality An asset or a service is not made available or disclosed to unauthorized individuals, entities or processes.
Control A means of managing risk, including policies, procedures, and guidelines which can be of administrative, technical, management or legal nature. Guideline A description that clarifies what shall be done and how, to achieve the
objectives set out in policies. Information Security
The preservation of confidentiality, integrity, and availability of information. Additionally, other properties such as authenticity, accountability, non-repudiation and reliability can also be involved.
Integrity Maintaining and assuring the accuracy and consistency of asset over its entire life-cycle.
Malware (Malicious)
Software designed to disrupt computer operation, gather sensitive information, or gain access to private computer systems (e.g., virus or Trojan horse).
Policy
A plan of action to guide decisions and actions. The policy process inclues the identification of different alternatives such as programs or spending priorities, and choosing among them on the basis of the impact they will have. Risk A combination of the consequences of an event (including changes in
circumstances) and the associated likelihood of occurrence.
System
An equipment or interconnected system or subsystems of equipment that is used in the acquisition, storage, manipulation, management, control, display, switching, interchange, transmission or reception of data and that inclues computer software, firmware and hardware.
1.4. Change, Review and Update
This policy shall be reviewed once every year unless the owner considers an earlier review necessary to ensure that the policy remains current. Changes of this policy shall be exclusively performed by the Information Security Officer and approved by management. A change log shall be kept current and be updated as soon as any change has been made.
1.5. Enforcement / Compliance
Compliance with this policy is mandatory and it is to be reviewed periodically by the Information Security Officer. All UoD units (Deanship, Department, College, Section and Center) shall ensure continuous compliance monitoring within their area.
In case of ignoring or infringing the information security directives, UoD’s environment could be harmed (e.g., loss of trust and reputation, operational disruptions or legal violations), and the fallible persons will be made responsible resulting in disciplinary or corrective actions (e.g., dismissal) and could face legal investigations.
A correct and fair treatment of employees who are under suspicion of violating security directives (e.g., disciplinary action) has to be ensured. For the treatment of policy violations, Management and Human Resources Department have to be informed and deal with the handling of policy violations.
1.6. Waiver
Information security shall consider exceptions on an individual basis. For an exception to be approved, a business case outlining the logic behind the request shall accompany the request. Exceptions to the policy compliance requirement shall be authorized by the Information Security Officer and approved by the ICT Deanship. Each waiver request shall include justification and benefits attributed to the waiver.
The policy waiver period has maximum period of 4 months, and shall be reassessed and re-approved, if necessary for maximum three consecutive terms. No policy shall be provided waiver for more than three consecutive terms.
1.7. Relevant Documents
The following are all relevant policies and procedures to this policy:
Information Security Policy
Human Resource Security Policy
Access Control Policy
Compliance Policy
Password Policy
1.8. Ownership
2. Policy Statements
Approved University members and authorized third parties (Contractors, etc...) may utilize the benefits of VPNs, which are a "user managed" service. This means that the user is responsible for selecting an Internet Service Provider (ISP), coordinating installation, installing any required software, and paying associated fees.
Additionally,
1. In order to obtain VPN Access, a change request must approved by DICT management board, filled with request justification, email and users contact details, resources to access (including IP addresses and Port no) and duration of access required
2. It is the responsibility of users with VPN privileges to ensure that unauthorized users are not allowed access to University internal networks.
3. VPN use is to be controlled using either a one-time password authentication such as a token device or a public/private key system with a strong passphrase.
4. When actively connected to the corporate network, VPNs will force all traffic to and from the PC over the VPN tunnel: all other traffic will be dropped.
5. Dual (split) tunnelling is not permitted; only one network connection is allowed. Exception must be through DICT board request and with Dean of DICT’s approval.
6. VPN gateways will be set up and managed by University network and security teams.
7. All computers connected to University internal networks via VPN or any other technology must use the most up-to-date anti-virus software; this includes personal computers.
8. VPN users will be automatically disconnected from University’s network after 15 minutes of inactivity. The user must then logon again to reconnect to the network. Pings or other artificial network processes are not to be used to keep the connection open.
9. The VPN concentrator is limited to connection time of 72 hours or time specified by DICT management board.
10. Users must configure their machines to comply with University's VPN and Network policies. 11. Users are required to download the VPN client software from University VPN gateway in order
12. Any exception to the policy must be approved by the DICT Management Board in advance. 13. Support will only be provided for VPN clients approved by UoD University's Information
Technology Services.
14. Users found to have violated the VPN Access Policy may be subject to loss of privileges of services and be subject to disciplinary action.
15. This policy is to be periodically reviewed and amended by DICT management board.
If you have any questions related to the use of the UoD University VPN, please contact the DCIT Help Desk