Slashdot Log In
Remote Access Policies
Posted by
samzenpus
on Wed Nov 12, 2008 08:17 PM
from the write-it-down-from-home dept.
from the write-it-down-from-home dept.
Samalie writes "My company is considering implementing a formal remote access policy (and agreement for staff to sign) for users who access our network from home via VPN. Does anyone out there have any suggestions as to what this policy/agreement should contain? Anyone have their own corporate policy that I can borrow from? This is the first time I've come across anyone wanting a formal policy for this & online searches haven't been very helpful."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
SANS Templates (Score:5, Informative)
The templates provided by SANS are a good place to start:
All of them are here:
http://www.sans.org/resources/policies/ [sans.org]
Here's the remote access policy example:
http://www.sans.org/resources/policies/Remote_Access_Policy.pdf [sans.org] [PDF]
Too long (Score:5, Insightful)
Inform: part from the little "purpose" bit, the SANS does not do much.
(2) A legal rope to hang a user with. What most of the SANS doc is.
Folks, nobody reads a document like this. They will lose interest after the first few lines then either skip to the signing bit or throw it away.
Real security comes from informing the user, not from baffling and swamping them with techno-legal bs.
If you want real security, then clearly explain the issues.
Parent
What about their work desktop policies? (Score:5, Insightful)
Parent
Re: (Score:3, Interesting)
Re:What about their work desktop policies? (Score:5, Informative)
Yes, they use a java app which utilizes the SSL capabilties in the browser to create a tunnel. Usuallly they do like a lightweight remote desktop type thing, or you can spawn something that redirects IP. Lastly, they usally have a link to install a package for a standard IPSEC VPN client. Cisco offers this in their ASA (formerly PIX) firewalls, Sonicwall does also. It's helpful for users logging in from a non-company computer as there's not much config/support required. Obviously your LAN needs to be secure also, in case they log in at an airport kiosk and forget to log out or something. With RADIUS and some auditing, you're almost as safe as in the office.
Parent
Re:What about their work desktop policies? (Score:4, Insightful)
In three words: don't do it. The only "safe" way to allow remote access is if you issue company laptops to all of the affected employees.
Assuming your corporate network is locked down pretty tight, the biggest thing you have to ensure is the security of the computer that the worker is using to access the VPN. The agreement and technology policy should either a) limit VPN access to company-issued computers (i.e., laptops) or b) require the use of firewall, anti-virus, hard-disk encryption and other security software from a list of approved products.
Once you open the access to non-company-owned computers, you expand your scope of security, legal and system administrative risks dramatically. For example, what happens when some PHB downloads a report from your customer/sales database to their personal laptop while on vacation in Bermuda, and someone steals the laptop? Or if there's a keylogger on the computer that they use to log into the VPN?
Unless your corporate security software licenses allow deployment of the software on non-company owned computers, you are going to incur a per-seat cost over $150 (possibly up to $500?) just to install required security software, or you will be forcing your workers to bear those costs. And then your network infrastructure team needs an on-going process to monitor those non-company computers to make sure that they are kept up to date with security updates for each of the installed products. At that point, it's more practical to issue company-owned laptops and integrate them into your standard support/licensing/update architecture.
Parent
Re:Too long (Score:5, Interesting)
Folks, nobody reads a document like this. They will lose interest after the first few lines then either skip to the signing bit or throw it away.
Why is it when we ask people to read through a 2-page user policy, they skip through and don't even bother reading to just sign it, yet those same people will sit down and pour through 3 inches of legal documents for 4 hours when buying a home?
If you want real security, then clearly explain the issues.
Bullshit. If you want real Security, enforce the punishment. Yes, it's that simple, and is also the answer to my previous question.
People read through 3 inches of legal docs when buying a home because they know damn well they could get burned legally.
Name the last time someone you know got fired for breaking a Security policy, or losing a laptop and not following protocol properly to report the company confidential data loss.
I thought so.
'Nuff said.
Parent
Re:Too long (Score:5, Insightful)
Why is it when we ask people to read through a 2-page user policy, they skip through and don't even bother reading to just sign it, yet those same people will sit down and pour through 3 inches of legal documents for 4 hours when buying a home?
If you want real security, then clearly explain the issues.
Bullshit. If you want real Security, enforce the punishment. Yes, it's that simple, and is also the answer to my previous question.
People read through 3 inches of legal docs when buying a home because they know damn well they could get burned legally.
Name the last time someone you know got fired for breaking a Security policy, or losing a laptop and not following protocol properly to report the company confidential data loss.
I thought so.
'Nuff said.
The current problems which are being, at least partially, blamed on deceptive lending practices in the mortgage industry would suggest that many people do not actually read through the legal documents they sign when they purchase a home. Do you think that for these deceptive loans, the stack of legal documents did not contain the truth? Of course it did. It was just buried in a pile of legalese, and people simply went with what the nice broker told them.
Parent
Re:Too long (Score:4, Insightful)
And most of those people actually thought they could get away with it, that is legally stealing from the banks. I had similar offers made when I was looking for a home and I KNEW something was fishy about having loans that are cheaper than the deprecation of it's own value although I'm not a lawyer (if yearly inflation rates are higher than your APR something is wrong because then the bank would over time pay you to loan their money).
Also I know that VARIABLE percentages means that the person loaning to you can jack up the prices as they want (just look at your energy bill with variable adjustments) but unlike an energy bill which you can change every year, you make the choice for the next 15-30 years no matter what happens to either yourself or the economy. It's a matter of federal law that rates and types are made clear to the buyer before lending and usually it's either on the first or last page, requiring a signature next to it.
If people are too stupid and like to listen to their SALESman instead of forking over $200 to a real-estate lawyer (that's what it costed my parents 2 years ago) to review and make clear the paperwork to them then that's their own fault.
Parent
Re:Too long (Score:4, Interesting)
I'm not arguing with this; you're right on. I was simply disputing the notion put forth by the post I was responding to. geekmux said that if these legal agreements had teeth, people would read them and offered as an example the notion that people generally read the paperwork that they have to sign when they purchase a home. I maintain that the current financial mess is due, in part, to the fact that people don't read legalese even when not doing so can have dire consequences. So giving these agreements more teeth would be of little help in getting people to read and adhere to them :-/
Parent
Re:SANS Templates (Score:4, Funny)
1. Same restrictions as what you have from work. No pr0n, nothing illegal.
2. User must have at least xp sp2 with patches installed with virus scanner X - or whatever your default company policy is. Or give them a pre-setup laptop. (Probably save you money in the long term, less chance of viruses etc)
3. Users must email their manager every 10 minutes to let them know that they're online.
Parent
Very first (non-sponsored) hit on Google! (Score:4, Insightful)
A link to the SANS Institute example for a Remote Access Policy doc (PDF format):
http://www.sans.org/resources/policies/Remote_Access_Policy.pdf [sans.org]
This is the first time I've come across anyone wanting a formal policy for this & online searches haven't been very helpful.
It looks like there's a trend going on; most of the last few Ask Slashdot articles seem to be written by people who can't be bothered to do a little work.
Re:Very first (non-sponsored) hit on Google! (Score:5, Funny)
most of the last few Ask Slashdot articles seem to be written by people who can't be bothered to do a little work.
That's why I got into computers.
Parent
Re:Very first (non-sponsored) hit on Google! (Score:4, Interesting)
Parent
Re: (Score:3, Funny)
My company uses a router and we're all in a NAT environment. We just use simple Hamachi + VNC to get directly into my PC at night. No one notice and we're happy with that.
This is some real Enterprise level shit right here.
You don't need a policy (Score:4, Interesting)
above what you should already have for them to use a computer.
Seriously. It's all going to be the same stuff. What makes people think behavior will be different depending on which keyboard they happen to be behind.
You could make a VPN boot disk.
This way you can separate what is on their machine with the VPN instance. Requires no brain power to use. Boot's up, big VPN icon. Click enter password, good to go.
Obviously, encrypt it.
Uh, yes you do (Score:5, Insightful)
Here's a few things that are different and need to be considered when working from home. These are all things that I've been thinking about a lot for our company and, in my opinion, are very real issues for any company:
1) Local shortcuts on your PC with saved passwords to work resources (eg, VPN connection details, saved passwords in web browser to access work webmail/intranets, etc)
2) Log files for work-related chat - MSN, IRC, etc can sometimes contain confidential details.
3) Work documents and other files.
You can't just say you don't need a policy other than some vague notion of basic computer knowledge. Most people wouldn't think twice about downloading an important document and putting it on their computer at home.
The two obvious risks that might lead to information leakage are a) their computer is compromised b) their computer is stolen. It's just a standard risk management excercise from here on it.
Parent
Just obvious stuff (Score:5, Insightful)
KISS principle: just say the VPN should only be used as you'd use the connection at work. (Keep it work-related, no excessive personal utilisation. No pr0n or illegal material. Don't forward the connection in any way - including web proxies and Tor. Keep your security software up to date. Take reasonable measures to ensure private keys, passwords and other security devices are not lost. Report any potential breaches immediately.)
Well... (Score:4, Interesting)
What rules do you want to set up? What do you want to allow and disallow of your users / employees?
Figure this out, write it down, get a lawyer to look at it, and you're done.
Use Laptops (Score:5, Informative)
Re:Use Laptops (Score:5, Funny)
Parent
Re:Use Laptops (Score:4, Informative)
Parent
Re:Use Laptops (Score:5, Interesting)
Parent
Re:Use Laptops (Score:4, Insightful)
Okay...I'll ask...
For one thing you state that "you can get in from all but the most severely locked down internet kiosks". I guess you look at that as a feature, while I look at it as a malfunction. You've now extended your boundary and your risk to every poorly managed internet kiosk that any of your users use. So, you've never seen an internet kiosk in a hotel or other location that has questionable software, even obvious malware, installed?
Then, you claim "there's no risk to the corporate network". I don't know what sort of company you use, but if you think that providing a full desktop via Citrix, with access to all a user's regular internal documents and resources, to an endpoint that cannot be proved to be secure, is a "no risk" proposition then I would recommend you reconsider.
Not saying that Citrix doesn't have a place--but the authentication/authorization needs to be two-factor (not just a re-usable username/password combo) and the authenticated user should ideally only have read access and then only to less sensitive files. If someone needs the ability to modify files, or to access particularly sensitive ones, then the Citrix client just can't be proved to be providing enough assurance that the underlying OS/hardware isn't compromised. And *that* is why I have three separate laptops from three separate organizations just to be able to get my job(s) done...
Parent
Re: (Score:3, Interesting)
Re:Use Laptops (Score:4, Insightful)
This is how 98% of all fortune 500 companies do this.
you're a nut if you allow a personal PC to connect to the company network.
Parent
One policy: don't make it necessary (Score:4, Interesting)
Either give people laptops or give them a way to do what they need to do on servers you control.
This can be a web-based front-end to the applications they use, an ftp site so they can up/download files and edit them on their home computer, or even something like Windows Terminal Services or Citrix.
If your company is enlightened enough to not use Microsoft, there are even more options available.
If you allow people to remote login, you need to make very sure that not only is the VPN tunnel secure against attacks, but that their machine can't do anything hostile to your LAN in case their password is compromised. Of course, you should be doing that anyways but many companies don't treat computers in the network as "presumed hostile" to every other device on the network. You should always do that, but If you are going to allow remote login it's even more important.
As a bonus, if you put most of your business-critical applications on a server you control, it's easier to make sure data gets backed up and you can usually get away with a longer computer-replacement cycle or buy slightly cheaper computers when you do replace them. Of course, you'll pay more for server costs and you'll need more expertise in your IT dept. to manage it, but in many shops this is worth it.
Re:One policy: don't make it necessary (Score:5, Interesting)
Smartcards and native connection stuff in Windows. Once connected you were "quarantined" until a security scan had been run on your machine, and even then you had different access based on location.
But of course, this is Slashdot...
Parent
Re: (Score:3, Interesting)
Consequences of the NT4/Win2K source code leak a few years back? Didn't that happen via VPN?
Big Brother Invasion (Score:4, Interesting)
my company requires the following
1. A specific virus scanner (Nortan AV yuck)
2. A specific Firewall with company preset settings (blackice is what it used to be called its something else now)
3. We are assigned an RSA SecurID FOB which my manager must periodically re-confirm that I am authorized to use (like once a year)
basically it is a Huge pain only slightly offset by the convenience
Policies don't solve problems. people solve them. (Score:4, Insightful)
Before putting too much effort into this policy thing... Can I ask you one question: What's management going to do if someone breaks it? The majority of security policies only exist for two reasons -- to fire anyone who questions them and make management feel safe in having "done something to solve the problem". It's rather like expecting a terrorist to care that his car bomb is taking up two parking spaces... If this is management's only goal, just write some boiler-plate, broadly generalized piece that sounds really great but doesn't give any technical guidance. As a bonus, it'll never have to be updated after that, saving countless hours that would otherwise be spent securing the network.
Note: This post contains 30% recycled sarcasm.
Don't use 'user' policies - use 'system' policies (Score:5, Interesting)
I find that whatever the user signs, it always gets broken one time or another. That is why I use - whenever possible - system policies instead of making them sign anything. If they can't do what you don't want them to do, it ought to be more reliable.
The main idea is: restrict their remote access to what they really need. Some purist will reply 'oh yeah, but even if you do that, there's a way around for such and such reason.' or that it will become too restrictive. My answer: adapt to your user needs without letting it be the Wild Wild West.
Maybe both signing an agreement AND enforcing policies is the best way to go.
Avoid Microsoft products at all cost (Score:4, Insightful)
Re: (Score:3, Informative)
WPA2 can no longer [slashdot.org] be considered safe.
A VPN connection with strong encryption must be used.
Multi-factor authentication should be used to gain access.
And once access is gained, traffic coming in from outside should be restricted to certain safe protocols and hosts (according to the user's needs)
Look Broader (Score:4, Insightful)
So what do your users do with VPN access? Access your network, yeah... then what? Email? Web access? You should already have AUPs for all of that, and access to those services via VPN is no different than if they're connected in the office.
What you may be looking for is controlling the access, i.e. firewalls and virus scanners etc. If that's important, set up two-tier access:
1. For users who have a laptop, put the access controls there, and make them only access the VPN via their company provided and controlled laptop. Then you set up the controls (firewall, virus scan, etc.) once and they apply whether they are directly connected or VPN'd in.
2. For users who don't have a laptop, set up a remote desktop-type system where they use a web browser to access the remote desktop with SecurID.
3. And I almost hate to mention this, but if most of your users are only accessing e-mail, think about setting up a Blackberry server. Sorry. Got my flame-retardant suit on. :)
What are the requirements? (Score:5, Interesting)
Did an executive really just say, "I think we should have a formal policy"? Don't create bureaucracy and policy just for the sake of having bureaucracy and policy (making management look busy). Build your policy on the demands of your organization, and formalize it when it's necessary to do so.
That being said, if your business doesn't deal much with sensitive data, you could get by with allowing personal computers, with up-to-date anti-virus software (maybe the company can pay for AV software for home computers). If you do deal with sensitive data, I would recommend issuing laptops to employees that need to work from home, and only allow VPN from those systems. Use certificates.
Rule Number 1: No Porn on the WebServer (Score:5, Funny)
Unless, of course, you work for a porn company. Then porn away.
Not SANS (Score:5, Interesting)
They are generic reference documents to use as a guide not as a final product. Even the guy who wrote the Remote Access policy for SANS thinks it's a joke.
It's fairly simple... (Score:3, Funny)
Ground rules.
The computer, as provided by (name of employer) are the sole property of (name of employer).
All use of this computer is subject to monitoring, logging and review by (name of employer)'s IT department.
No modifications of any kind may be made to (name of employer)'s computer by the employee.
VPN Rules..
#1 Only computers provided by (name of employer) (with appropriate user restrictions, group policies, security software, etc...) are allowed to connect via VPN.
#2 Only computers provided by (name of employer) may be connected to the network used for VPN access, at the time of VPN access.
ie - home/personal computers must be disconnected before connecting the work computer - unless the work computer is on a completely separated / isolated network from the home / personal computers.
#3 Any personal use of work computer will result in loss of VPN privelege on first offense, no exceptions.
Re:It's fairly simple... (Score:4, Interesting)
#2 Only computers provided by (name of employer) may be connected to the network used for VPN access, at the time of VPN access.
ie - home/personal computers must be disconnected before connecting the work computer
Just how do you propose to enforce this policy?
Parent
Completely ridiculous (Score:5, Insightful)
Parent
hang on, the real answer is (Score:4, Insightful)
youre a system administrator, not a lawyer, or a board director, or an hr manager, or anything else so you dont know what the company needs. you just know how to enforce their policy and keep systems patched and secure. nothing to see here, move along.
Important: Please read, VPN Corporate Policy #3281 (Score:4, Funny)
1. If you connect to the VPN and place your own machine's IP onto our network... we will kill you.
Signing below indicates that you have read the policy in question and agree to adhere to it.
What should your policy contain? (Score:4, Insightful)
Mainly your legal counsel's advice. If you can't afford that, don't bother - you couldn't afford to make your policy stick when it counted, either.
Key points (Score:4, Informative)
I don't have a formal policy, but I work with students on data that falls under privacy laws.
What we tell them is:
- Access from one computer only and that has to be specially secured
-- Linux: Keep intsllation current, close all ports for incomming data, web-surfing only
with current firefox or opera and limited to what is absolutely neccessary for their work.
-- Windows: In addition a current anti-virus software. Discouraged.
- We provide a computer for the VPN/SSH access for the thesis duration for the secured installation
and even a second one for ordinary work, if they do not have one.
- We warn them that loss of data would possibly be a criminal offense on their part (privacy laws)
and that they need to be very careful.
If you are really paranoid, gibve your users that second computer, or alternatively a CD-system created/modified by you for the remote access, and make using that mandatory. I think you will find that formal agreements carry little impact, as neglience is allways relative to the competence level of the person acting. Better to secure the access and not rely on legal stuff. If you require a specific installation for remote access, everybody not using it is doing something contrary to agreement regardless of competence level. You could even hardcode the VPN keys on a boot-CD (e.g. a modified Knoppix) to make it hard to circumvent this "remote Terminal" set-up.
Citrix (Score:3, Interesting)
Orion Blastar's VPN from Home Policy (Score:5, Interesting)
#1 Keep the VPN use work related. Follow the same network policies as if in the workplace.
#2 Scan the home PC on a regular basis for malware. Last thing the company needs is trade secrets, password and login info, and email stolen by some hacker who happened to get a key logger trojan on the Home PC, and then sell them to the higher bidder or steal corporate bank and credit card accounts. That means keeping your Antivirus programs updated every day and scan for viruses at least three times a week.
#3 You are on the honor system, Work can only monitor your activities on the VPN network, but not your Home PC and the Internet being used by your home PC. Yes it is alright to check your local email on your home computer, but use common sense and don't spend a lot of time doing personal things on your home computer and home Internet connection. We'll notice it when the VPN activity stops for more than 15 minutes, and your work productivity drops on the VPN. Yes you can take two 15 minute breaks and lunch hour or half hour, but we'll really notice it when you do nothing on the VPN for hours. Either you are goofing off and doing personal things, or the connection is dead, but we can tell by pinging your home computer to test if the connection is dead and deduce your wasting time.
#4 Keep all company email professional. Make effective use of company email and web sites and software. Don't use them and act like you do when you are posting Anonymous trolls on the Internet or your Myspace page.
#5 Do not access other user's accounts unless you are given permission by management for troubleshooting something or testing out software. We know that your profile might not have the same issues as a coworker, but only IT staff should be loging in as other employee's accounts only for testing purposes. Do not use an alias either on the VPN or create a fake account via a hack, but use the account and account name assigned to you.
#6 Do not save work data on your personal hard drive, instead store it on a server drive.
#7 Do not run cracking and/or hacking tools on the VPN, do not do any denial of service attacks over the VPN.
An agreement? (Score:3, Insightful)
Re:Is this real? (Score:5, Insightful)
Parent
Re:Is this real? (Score:5, Insightful)
The inquirer did say:
This ain't my area either but googling for:
corporate vpn policy
produces sans' example policy as the first hit. As such, it looks to me like the OP was in order.
Parent