Universal Network Access Policy

Transcription

1 Universal Network Access Policy Purpose Poynton Workmens Club makes extensive use of network ed Information Technology resources to support its research and administration functions and provides a variety of services for staff, members and guests, accessible over a comprehensive data communications infrastructure. It is certain that Information Technology will have a crucial and increasing role to play in the day-today activities of staff, members and guests; it is therefore important that staff, members and guests have access to their Information Technology resources whenever and wherever they need them. The purpose of this Policy is to ensure that Poynton Workmens Club provides, maintains and develops the infrastructure necessary to enable authorised Universal access to its Information Technology resources. Scope This Policy covers access to Information Technology resources delivered from the main site and all remote sites. It covers user access from on site and remote locations including remote working. This Policy defines the infrastructure and support strategies necessary to ensure that network services, applications and access technologies provide the most appropriate, efficient and secure environment for authorised users. Policy Poynton Workmens Club recognises that continual investment in network infrastructure will be required to help maintain its competitiveness and realise the benefits of advances in Information Technology. Poynton Workmens Club s network infrastructure consists of the following elements: Backbone fibre optic cabling infrastructure Remote sites interconnect Cabling infrastructure Backbone and remote sites routing services Local Area Networks (LANs) routing and switching services Flexible access facilities Remote access facilities Support Considering each element Poynton Workmens Club s policy will be as follows, NB. Actual investments will depend on Poynton Workmens Club s financial position and other commitments. Backbone fibre optic cabling infrastructure Poynton Workmens Club s Policy is to ensure that it s backbone fibre optic cabling infrastructure is maintained and developed to support the data communications requirements for current and future Information Technology service delivery. Initially the system was used to implement a 10Mbs bridged Ethernet backbone, whereas today it supports a trunked Gigabit Ethernet backbone and is capable of supporting 10Gigabit Ethernet and beyond. Poynton Workmens Club will continue to develop its strategic fibre optic cabling infrastructure by connecting new buildings as they come on stream and enhancing resilience to existing buildings where appropriate. Although cable choice, construction and fibre operating parameters have changed, the Policy of installing both multimode fibre and single mode fibre cables per link will continue. Remote sites interconnect Poynton Workmens Club s Policy is to ensure that staff located at remote sites are not disadvantaged in terms of the Information Technology resources and service levels provided for them.

2 Remote sites present many problems with respect to network provisioning and support. It is not uncommon for users at remote sites to feel left out of mainstream developments because of poor connectivity with the main site. Providing interconnects at bandwidths comparable with those available on the main network would not be affordable using traditional tariff services from the Public Telecommunications Operators (PTOs). This would generally lead to low bandwidth provisioning and associated reductions in the service levels that could be offered and supported. The availability of remote access services allows Poynton Workmens Club s IT Service to deliver high bandwidth services to remote sites on a par with the services delivered to the main network. Buildings cabling infrastructure Poynton Workmens Club s Policy is to ensure that data communications services are regarded as essential building utilities similar to water, gas and electricity. Poynton Workmens Club has adopted industry standard Premises Distribution Schemes (PDS) as the data communications wiring standard for all buildings. Each connection point is presented as either a wireless network connection or an RJ45 connector mounted within a suitable faceplate and containment system. The data transmission media used is industry standard unshielded twisted pair (UTP) cable providing four pairs of wires per connection point. The UTP cables run radialy from each connection point to specialized termination panels located within secure wiring closets that also house network and building LAN active components. PDS network connection points will provide the primary means by which end user systems connect to Local Area Networks (LANs) and hence Poynton Workmens Club s network. Backbone and remote sites routing services Poynton Workmens Club s Policy is to ensure that it s backbone network provides high performance, scaleable, secure and robust routing services between LANs and local, national and international resources. The backbone routing services are implemented via a number of core routers configured in a ring topology. The links between core routers consist of trunked gigabit Ethernet circuits; links to other buildings and departments are provided at 10Mbs, 100Mbs and 1Gbs as appropriate. Routing services are supported at wire rate for IP and IPX protocols and at considerably less than wire rate for AppleTalk protocols. High-speed routing services are provided for remote sites via open fibre circuits or leased (SDH) circuits. Poynton Workmens Club recognises that the replacement cycle for the core routers should be based on user and network application requirements, technological advances and available budgets. Under normal circumstances the replacement cycle is expected to be four years. Backbone replacement and upgrade programmes will address the following: Routing performance in terms of packets per second Trunk link upgrades to 10Gbs and beyond Access link upgrades to 100Mbs, 1Gbs, 10Gbs and beyond Quality of service provisions ensuring service performance and operational guarantees Service resilience Enhancements to overall management and network security provisions Poynton Workmens Club intends to provide an IP only routing service when it is practical to do so. AppleTalk backbone routing support is targeted for withdrawal by mid Microsoft server and client protocol support will only be routed in IP context. Local Area Networks (LANs) routing and switching services Poynton Workmens Club s Policy is to ensure that Local Area Networks (LANs) are maintained and developed within all buildings in order to provide the core technology and access ports necessary to deliver high quality network services and applications to end users; these services will be delivered via local servers, where appropriate, and servers located on other LANs or networks connected via the routing services.

3 Poynton Workmens Club has implemented the IEEE Ethernet standards as the technology of choice for Poynton Workmens Club s backbone and building LANs. Current LAN deployments provide network connections via 10Mbs contention based hubs or 10/100Mbs Ethernet switches; LANs typically connect to the backbone routing service via dedicated 10/100/1000Mbs router ports. By their nature contention based 10Mbs hubs provide relatively low useable bandwidth and allow all network traffic to be presented to network ports belonging to the same collision domain. By contrast 10/100Mbs Ethernet switches provide dedicated bandwidth for each port and ensure that only broadcast traffic and unicast traffic intended for a port is forwarded to it. Poynton Workmens Club recognises that it needs to address the disparity in network access provision between users on 10Mbs contention networks and users on switched networks. Poynton Workmens Club s policy will be that users are connected to Building LANs through dedicated switch ports operating at the most appropriate speed i.e., 10/100/1000Mbs.This Policy will enhance network security by reducing the opportunity for unapproved network monitoring/sniffing. The timescales for implementing this policy will depend on funding allocations and priorities. The core user access technology for local area networks will be centrally managed Ethernet switch ports providing dedicated connections for the following: Standard staff desktops Open access clusters Department supported staff workstations Standard staff desktops and open access clusters provide centrally managed customised environments tailored for specific user requirements. The key features of both environments are: User authentication is required before access to Information Technology resources is permitted Mobility Users do not need to be tied to a specific workstation at a specific location Desktop lock down Desk top environments are customised for specific requirements that can only be changed by authorised users and support staff Security Desk top environments provide security via anti-virus software, operating system and application patch management, authentication, desk top lock down and central support Data integrity File systems and data integrity is maintained by implementing network file storage for all common directories, user specific file store and applications System recovery System rebuilds are supported centrally using standard images Departments who provide local IT support for their staff workstations are encouraged to adopt similar safeguards. As a minimum local IT support staff and users must implement the following measures: Proactive systems security measures i.e., Enforce user authentication before access to Information Technology resources is permitted Workstations must be kept up to date with respect to operating system and applications patch levels Workstations must be protected by an up to date version of Poynton Workmens Club s recommended anti virus software operating with the latest virus definition files Data integrity File systems and data integrity must be maintained by implementing network file storage or local system backup and restore procedures Flexible access facilities

4 Poynton Workmens Club s Policy is to ensure that flexible and secure network access facilities are provided in order that authorised users can use their own systems to access their work related Information Technology resources from locations on or while working away from premises. On Flexible Access facilities The technology used to implement this provision will be a mixture of wireless and wired network connection points. The services available over the on flexible access network will be advertised via the IT Service web pages and will be similar to those provided for remote access users. User support will be largely self-service via Web based configuration instructions and FAQs. Whilst on, Flexible access users will be responsible for the following: Providing a suitable workstation with a functioning network interface card (NIC), NB, this may be an approved wireless or Ethernet NIC Registering their workstation for use with the flexible access facility Installing and properly configuring all network and client software in accordance with online instructions Ensuring all copyrighted software is properly licensed Complying with all relevant Information Technology Policies Ensuring laptop batteries have sufficient capacity before attempting critical work Systems security users should understand the risks involved in connecting their personal system to the Internet via different service providers (ISPs) either from home, the other institutions or commercial facilities (hotels etc). users must keep their systems up to date with respect to operating system and applications patch levels users must install, operate and maintain an up to date version of Poynton Workmens Club s recommended anti virus software users are strongly recommended to install, operate and maintain an up to date version of one of Poynton Workmens Club s recommended personal firewall shims Visitors must give assurances that their systems have been maintained to the most up to date operating system and application patch levels and are free from virus or other infections Physical security of their systems and accessories Users must not disclose their authentication credentials to anyone Users must not allow any other person to use their system to access IT resources Users must safeguard all sensitive or restricted data downloaded to their system Remote Flexible Access Facilities Poynton Workmens Club s Policy is that centrally supported VPN services will provide the main secure, authenticated remote flexible access facilities, augmented by application specific services including Terminal Servers and Web based portal services. The IT Service has introduced a more flexible solution based on Virtual Private Network (VPN) technology. The current VPN facility consists of a number of VPN concentrators and client software, which can be used to establish secure authenticated VPN tunnels over almost any IP network. The benefits for end users are as follows: Performance Users will be able to choose between a range of connect options including: V.90 analogue modems ISDN digital broadband services

5 Cable modem services currently provided by Virgin Media and Telewest; if located in providers franchise area ADSL broadband services from BT and participating ISPs; if connected to an ADSL enabled BT exchange Cost Local call rate options, surf packages and broadband packages would be available Support Improved support through concentrated local effort and ISP help lines The VPN facility is documented on the IT Service web site and provides native access to all network resources. This is achieved over a secure (IPSEC) tunnel between the client workstation and the VPN concentrator. Once connected and authenticated the concentrator allocates an IP address for the client from Poynton Workmens Club s IP address space. The client accesses resources using IP datagrams, with this assigned IP source address, encapsulated over the IPSEC tunnel. The VPN concentrator is responsible for unpacking/decryption and packing/encryption of data to and from the LAN and the relevant IPSEC client tunnel. The client workstation therefore looks like any other local workstation to hosts and servers on the network. Future versions of the VPN concentrator software will include WebVPN services, which will obviate the need for a thick VPN client whilst supporting a similar set of Network applications. Any persons wishing to access network resources off-site must submit an application to the Committee and/or its authorised persons Other service or application specific remote access services are provided as follows: SSL Secure web access is supported via secure socket layer protocols SSH Secure access to certain systems is supported over the secure shell protocol Secure is supported via PGP encryptions, secure pop/imap and secure web-mail Terminal services providing authenticated and secure access to virtual desktop environments It is important to note that although the VPN service provides a secure authenticated tunnel between a remote system and Poynton Workmens Club s network, this tunnel will only be as secure as the remote system itself. If for example a remote system has been compromised via another network then establishing a secure tunnel from it to Poynton Workmens Club s network will present a real security threat; this scenario would apply to all modes of remote flexible access. Users of Poynton Workmens Club s remote flexible access facilities must therefore safeguard their systems by adhering to the following Users must comply with all relevant Information Technology policies Remote access sessions, other than for the purpose of accessing public information, must be authenticated If a user requires access to restricted information then their remote access session must be authenticated and conducted using strong data encryption Users must not disclose their authentication credentials to anyone, not even family members Users must not allow their system to be used for access to any IT resources by any other person, not even family members Users must not enable access from other connected networks to Poynton Workmens Club s network over a remote access session Systems security Users should understand the risks involved in connecting their personal system to the Internet via different service providers (ISPs) either from home, other institutions or commercial facilities (hotels etc). Users must keep their systems up to date with respect to operating system and applications patch levels Users must install, operate and maintain an up to date version of Poynton Workmens Club s recommended anti virus software Users connecting via always on networks e.g., broadband networks, must have a approved personal firewall shim installed and kept up to date with recommended security policies.

6 Users must safeguard all sensitive or restricted data downloaded to their system Users must agree that if requested by Poynton Workmens Club s Computer Incident Response Team they will supply their remote access system for inspection Support Poynton Workmens Club s Policy is that the IT Service department provides central support for the following services: backbone cabling infrastructure and building PDS systems backbone routing service and all building LAN routing and switching services, unless by special arrangement All core support services including: DNS services WWW services WWW caches hubs and relays Remote access services IT Security services File store services Print services Directory services Authentication authorisation and accounting services Video conferencing and other collaboration services The key benefits associated with this approach may be summarised as follows Fully managed services Consistency of provision Clear lines of responsibility Economies of scale Accountability and compliance monitoring Single points of contact with users and other service providers Under certain circumstances decentralised support arrangements may be required; in such environments Policies and procedures will be established to guide departments and support staff to ensure that Poynton Workmens Club s overall security and access requirements are satisfied. Poynton Workmens Club s Policy is to introduce new network services and applications, where these would lead to improvements in the IT facilities offered to staff, members and guests. However introducing new network services and applications will depend on appropriate levels of funding, including all support overheads.