To establish usage and documentation requirements for remote access methods used at the University of Florida.
- Firewalls and other technology will be used to restrict Remote Access to only approved Remote Access mechanisms.
- To be approved, Remote Access mechanisms must include the following technical capabilities:
- Allow only identified, authenticated and authorized users to connect.
- Provide for strong encryption of traffic.
- Audit logs contain sufficient information to establish the following:
- Event type (authentication, connection or disconnection)
- Date and time
- User associated with the event
- Remote and local IP addresses
- Event success or failure
- Interconnections to the UF Network require interconnection agreements. Access must be restricted to the minimum necessary to achieve the goals of the interconnection.
- Documentation of remote access mechanisms includes:
- Local and remote end points, and mechanisms intended to enforce connection only by intended end points.
- Intended users (based upon role or group) and mechanisms to enforce those restrictions.
- What university information systems and data remote users may access, and methods to enforce those restrictions.
- Guidance provided to users of appropriate uses of the remote access method.
- Remote access methods must be monitored for unauthorized use, and signs of unauthorized use promptly reported.
- The following remote access methods have been approved:
- UF Gatorlink VPN https://vpn.ufl.edu
- UFHealth/Shands VPN https://vpn.ufhealth.org
January 25, 2017