Remote Access VPN STIG

Without secure management implemented with authenticated access controls, strong two-factor authentication, encryption of the management session and audit logs, unauthorized users may gain access to network managed devices compromised, large parts of the network could be incapacitated with only a few commands.Information Assurance OfficerECSC-1

Digital certificates which are self-generated are not encouraged but may be unavoidable. If used, then key length and hashing algorithm must conform to DoD standards.Information Assurance OfficerECSC-1

AAA network security services provide the primary framework through which a network administrator can set up access control on network points of entry or network access servers, which is usually the function of an access server. These servers centralize user identification, authentication, authorization and monitors the user's network usage. Separation of services provides added assurance to the network if the access control server is compromised.Information Assurance OfficerDCBP-1

The access control policy configuration is the key security control of the remote access solution. This policy should be centralized particulary when multiple remote access control gateways and communications devices are used. Use of a policy server that can service all types of is highly encouraged. This reduces policy complexity, facilitates management of remote access, and reduces the threat posed by inadvertent administration error with access restrictions. Access control should be managed using access groups and placing the users into these groups. RADIUS or Active Directory groups will facilitate single sign-on and make modification of users and resources across the network easier. Information Assurance OfficerECSC-1

The number of concurrent logins will be limited in order to guard against the potential for Denial of Service attacks. Recommended setting should be based on usage trends and the number of approved remote users in the organization.System AdministratorECSC-1

The access control policy will be integrated with endpoint security controls. Users accessing from untrusted devices such as kiosks, personaly owned, or unmanaged devices may require active content in the client Web Browser which clears the cache or remove files, cookies, and session information. For example, users detected as accessing from a kiosk may be subjected to a host integrity check prior to authentication in order to guard against keystroke loggers. Consideration should also be taken for emergency and disaster recovery. Remote access for remote reset or for special circumstances should be considered.System AdministratorECSC-1

If users are allowed access to system files or configuration applications, they may change the application setting and create a denial of service incident.Information Assurance OfficerECSC-1

The VPN software on a host can be configured in either of two modes. It can be set to encrypt all IP traffic originating from that host, and send all of that traffic to the remote IP address of the network gateway. This configuration is called “tunnel-all” mode, because all IP traffic from the host must traverse the VPN tunnel to the remote system, where it will either be processed or further forwarded to additional IP addresses after decryption. Alternately, the VPN software can be set only to encrypt traffic that is specifically addressed to an IP at the other end of the VPN tunnel. All other IP traffic bypasses the VPN encryption and routing process, and is handled by the host as if the VPN relationship did not exist. This configuration is called “split-tunnel” mode, because the IP traffic from the host is split between encrypted packets sent across the VPN tunnel and unencrypted packets sent to all other external addresses. There are security and operational implications in the decision of whether to use split-tunnel or tunnel-all mode. Placing a host in tunnel-all mode makes it appear to the rest of the world as a node on the connected logical (VPN-connected) network. It no longer has an identity to the outside world based on the local physical network. In tunnel-all mode, all traffic between the remote host and any other host can be subject to inspection and processing by the security policy devices of the remote VPN-linked network. This improves the security aspects of the connected network, since it can enforce all security policies on the VPN-connected computer. Information Assurance OfficerECSC-1

Pass through communications from remote endpoints may allow network attack through the remote access gateway. To mitigate this risk, the VPN gateway or host will be configured with two interfaces. Remote users use the external interface while internal communications are sent using the internal interface.Information Assurance OfficerECSC-1

The TLS protocol allows clients and HTTP servers to communicate over a secure connection. It offers encryption, source authentication, and data integrity as means to protect information exchanged over unsecured, public networks. Only TLS is allowed because the manner in which previous version of the protocol used some unapproved cryptographic algorithms for its operation, thus this makes these older verison untrusted.Information Assurance OfficerECSC-1