* Creating use agreements and getting them signed
Editor’s Note : On Dec. 4, this newsletter will shift its focus from VPNs to network access control. NAC is an emerging network security architecture that starts with securing endpoints before they connect to networks and extends to monitoring and controlling their activity after they have been admitted. There are working NAC products today, but most vendors committed to NAC are still fleshing out their products, which makes it an area that warrants a newsletter of its own. Along with the shift in focus comes a new, intuitive name: the Network Access Control Newsletter. We hope you find it useful. Network World and networkworld.com will continue to cover VPNs as part of our regular news coverage. Thanks for reading.
A reader recently talked about a nontechnical VPN-related problem that everybody should be involved with – getting third parties that use a corporate VPN to sign a use agreement.
A use agreement is a document that explains what restrictions should be put on service contractors and vendors that use VPNs as a way to access servers on corporate VPNs. The use agreement is a way to get these things spelled out in writing and should be signed by the third parties.
Such documents detail what configurations their machines will have and what procedures they will comply with if they are to access the company network via the VPN. These might include keeping the operating systems of their machines patched against known vulnerabilities, turning on virus protection and using personal firewalls. Malware on their machines can be dumped directly on corporate networks.
Procedures they follow once on the network should be spelled out, too. One reader says an application contractor accessed the VPN to get to the server running its application, or so the reader thought.
Instead, the contractor also accessed the corporate WAN and visited workstations at branch offices. As it turned out, the contractor was just checking on application clients on those machines, but it opened the reader’s eyes to what damage a dishonest technician might have been able to do.
Writing such documents takes time, as does getting them signed. And they don’t directly prevent bad things from happening if they are violated; they just detail what the consequences are for the third party.
But the exercise of writing the agreement helps the owner of the VPN think through the possible security problems that such arrangements could lead to and perhaps then to mechanisms that could be put in place to prevent them.
Since VPNs can offer broad network access, writing such a document is well worth the time.
