لطفا منتظر باشید ...
Sample Security Policy
This is a portion of a sample security policy for a VPN. It includes all the points that a good security policy must contain.
Purpose
The purpose of this policy is to provide guidelines for remote access IPSec connections to the XYZ corporate network.
Scope
The policy applies to all XYZ employees, contractors, consultants, temporaries, and other workers, including all personnel affiliated with third parties who are using VPNs to access the XYZ corporate network. The policy applies to implementations of VPN that are established though a VPN concentrator.
Policy
Employees and authorized third parties (customers, vendors, and so on) who are approved by XYZ may use the benefits of VPNs, which constitute a company-managed service. This means that the user is not responsible for selecting an Internet service provider (ISP). XYZ will coordinate the installation and will pay associated fees. No equipment other than that ordered by XYZ can be used for this purpose. Further details can be found in the Remote Access Policy.The following list identifies some additional guidelines:
- It is the responsibility of employees with VPN privileges to ensure that unauthorized users are not allowed access to XYZ's internal networks.
- VPN access is controlled by using a one-time password authentication with a token device. While connected to the corporate network, no other connections can be established.
- When actively connected to the corporate network, VPNs force all traffic to and from the PC over the VPN tunnel. All other traffic is dropped.
- Split tunneling is not permitted. Only one network connection is allowed.
- VPN gateways are set up and managed by XYZ network operational groups.
- All computers connected to XYZ internal networks via VPN or any other technology must use the most up-to-date antivirus software that is the corporate standard.
- VPN users are automatically disconnected from XYZ's network after 15 minutes of inactivity. The user has to log on again to reconnect to the network.
- The VPN concentrator is limited to an absolute connection time of 12 hours.
Enforcement
Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
Definitions
In this security policy, the following definitions apply:
- VPN concentrator
A device in which VPN connections are terminated. This device is sometimes also called the IPSec concentrator. - InfoSec
A term used to refer to the team of people responsible for network and information security. - Split tunneling
The term used to describe a multiple-branch networking path. A tunnel is split when some network traffic is sent to the VPN concentrator and other traffic is sent directly to the remote location without passing through the VPN concentrator.
