1. Policy Overview The purpose of this policy is to provide guidelines for Remote Access IPSec or Virtual Private Network (VPN) connections to the University of Dammam network. 1.1. Purpose University VPN connection allows users to connect directly to the University network through the Internet. In order to allow this connectivity, secure connection issues, performance issues, and bandwidth utilization criteria must be addressed. 1.2. Scope The policy statements written in this document are applicable to all UoD s VPN Users at all levels of sensitivity; including: VPN Admins Executives Staff Contractors All other individuals and groups who have been granted access to UoD s ICT Network and information through VPN access.
1.3. Terms and Definitions Table 11 provides definitions of the common terms used in this document. Term Accountability Asset Availability Confidentiality Control Guideline Definition A security principle indicating that individuals shall be able to be identified and to be held responsible for their actions. Information that has value to the organization such as forms, media, networks, hardware, software and information system. The state of an asset or a service of being accessible and usable upon demand by an authorized entity. An asset or a service is not made available or disclosed to unauthorized individuals, entities or processes. A means of managing risk, including policies, procedures, and guidelines which can be of administrative, technical, management or legal nature. A description that clarifies what shall be done and how, to achieve the objectives set out in policies. The preservation of confidentiality, integrity, and availability of information. Information Security Additionally, other properties such as authenticity, accountability, nonrepudiation and reliability can also be involved. Integrity Maintaining and assuring the accuracy and consistency of asset over its entire life-cycle. Software designed to disrupt computer operation, gather sensitive Malware (Malicious) information, or gain access to private computer systems (e.g., virus or Trojan horse). A plan of action to guide decisions and actions. The policy process inclues Policy the identification of different alternatives such as programs or spending priorities, and choosing among them on the basis of the impact they will have. Risk A combination of the consequences of an event (including changes in circumstances) and the associated likelihood of occurrence. An equipment or interconnected system or subsystems of equipment that is System used in the acquisition, storage, manipulation, management, control, display, switching, interchange, transmission or reception of data and that inclues computer software, firmware and hardware. Table 1: Terms and Definitions
1.4. Change, Review and Update This policy shall be reviewed once every year unless the owner considers an earlier review necessary to ensure that the policy remains current. Changes of this policy shall be exclusively performed by the Information Security Officer and approved by management. A change log shall be kept current and be updated as soon as any change has been made. 1.5. Enforcement / Compliance Compliance with this policy is mandatory and it is to be reviewed periodically by the Information Security Officer. All UoD units (Deanship, Department, College, Section and Center) shall ensure continuous compliance monitoring within their area. In case of ignoring or infringing the information security directives, UoD s environment could be harmed (e.g., loss of trust and reputation, operational disruptions or legal violations), and the fallible persons will be made responsible resulting in disciplinary or corrective actions (e.g., dismissal) and could face legal investigations. A correct and fair treatment of employees who are under suspicion of violating security directives (e.g., disciplinary action) has to be ensured. For the treatment of policy violations, Management and Human Resources Department have to be informed and deal with the handling of policy violations. 1.6. Waiver Information security shall consider exceptions on an individual basis. For an exception to be approved, a business case outlining the logic behind the request shall accompany the request. Exceptions to the policy compliance requirement shall be authorized by the Information Security Officer and approved by the ICT Deanship. Each waiver request shall include justification and benefits attributed to the waiver. The policy waiver period has maximum period of 4 months, and shall be reassessed and re-approved, if necessary for maximum three consecutive terms. No policy shall be provided waiver for more than three consecutive terms.
1.7. Relevant Documents The following are all relevant policies and procedures to this policy: Information Security Policy Human Resource Security Policy Access Control Policy Compliance Policy Password Policy 1.8. Ownership This document is owned and maintained by the ICT Deanship of University of Dammam.
2. Policy Statements Approved University members and authorized third parties (Contractors, etc...) may utilize the benefits of VPNs, which are a "user managed" service. This means that the user is responsible for selecting an Internet Service Provider (ISP), coordinating installation, installing any required software, and paying associated fees. Additionally, 1. In order to obtain VPN Access, a change request must approved by DICT management board, filled with request justification, email and users contact details, resources to access (including IP addresses and Port no) and duration of access required 2. It is the responsibility of users with VPN privileges to ensure that unauthorized users are not allowed access to University internal networks. 3. VPN use is to be controlled using either a one-time password authentication such as a token device or a public/private key system with a strong passphrase. 4. When actively connected to the corporate network, VPNs will force all traffic to and from the PC over the VPN tunnel: all other traffic will be dropped. 5. Dual (split) tunnelling is not permitted; only one network connection is allowed. Exception must be through DICT board request and with Dean of DICT s approval. 6. VPN gateways will be set up and managed by University network and security teams. 7. All computers connected to University internal networks via VPN or any other technology must use the most up-to-date anti-virus software; this includes personal computers. 8. VPN users will be automatically disconnected from University s network after 15 minutes of inactivity. The user must then logon again to reconnect to the network. Pings or other artificial network processes are not to be used to keep the connection open. 9. The VPN concentrator is limited to connection time of 72 hours or time specified by DICT management board. 10. Users must configure their machines to comply with University's VPN and Network policies. 11. Users are required to download the VPN client software from University VPN gateway in order to activate their VPN account.
12. Any exception to the policy must be approved by the DICT Management Board in advance. 13. Support will only be provided for VPN clients approved by UoD University's Information Technology Services. 14. Users found to have violated the VPN Access Policy may be subject to loss of privileges of services and be subject to disciplinary action. 15. This policy is to be periodically reviewed and amended by DICT management board. If you have any questions related to the use of the UoD University VPN, please contact the DCIT Help Desk