1. VPN Security Policy By: Fred Cicilioni

2. VPN, or Virtual Private Network, is a protocol that allows remote access, allowing the user to connect to all of the network resources seamlessly from an off site location. VPN, or Virtual Private Network, is a protocol that allows remote access, allowing the user to connect to all of the network resources seamlessly from an off site location. Connections can be managed by either software or routers. Connections can be managed by either software or routers.

3. This policy must apply to everyone from the CEO to staff, because no matter who you are your account can be marginalized equally easily. This policy must apply to everyone from the CEO to staff, because no matter who you are your account can be marginalized equally easily. It is the user’s responsibility to keep unauthorized users from having access to the institution’s resources. It is the user’s responsibility to keep unauthorized users from having access to the institution’s resources.

4. VPN should use encryption or a one time use password. VPN should use encryption or a one time use password. The user will not use any other connections at the same time as the VPN tunnel. The user will not use any other connections at the same time as the VPN tunnel. Only one simultaneous connection is allowed per user. Only one simultaneous connection is allowed per user.

5. The user is responsible for supplying their own ISP and connection and to pay all associated fees. The user is responsible for supplying their own ISP and connection and to pay all associated fees. As with other remote connection schemes the user must have recently updated virus software running on the client machine. As with other remote connection schemes the user must have recently updated virus software running on the client machine. VPN connections will time out after a period of inactivity. VPN connections will time out after a period of inactivity. Users may be limited to a certain length of time per connection even if the connection is constantly active. Users may be limited to a certain length of time per connection even if the connection is constantly active.

6. Only approved VPN clients may be used to connect to network resources. Only approved VPN clients may be used to connect to network resources. The client computer must be configured to meet the institution’s security standards. The client computer must be configured to meet the institution’s security standards. Any employee found breaking this policy will be subject to disciplinary action including the possibility of termination. Any employee found breaking this policy will be subject to disciplinary action including the possibility of termination.

7. Thank You! Visit http://www.sans.org/resources/policies/ for more information or for other policies. http://www.sans.org/resources/policies/