IT Security Standards | Incident Response Plan for PCI DSS Incidents | ITS Information Technology Security Standard | Password Complexity Standard | Remote Access User Standard | Remote Access Device Standard |

Remote Access Device Standard

George Mason University’s Information Technology Services (ITS) division maintains a Virtual Private Network (VPN) system that supports off-campus access to internal university networks and hosts. All remote access gateway devices shall meet the following requirements:

  1. VPN tunnels must use industry-standard strong encryption.
  2. VPN must prevent split tunneling, with an allowed exception for local network access.
  3. Active VPN sessions must time out after no more than 12 hours. Idle VPN sessions shall time out after no more than 60 minutes.
  4. Direct remote access to internal University network devices using Remote Desktop Protocol (RDP) or Secure Shell (SSH) protocol is prohibited.
  5. Passwords shall, at a minimum, comply with the same standards as Patriot Pass.

Version: 2.0
Date of last revision: 26 June 2018