Remote users will be trained or given instructions on proper and authorized usage of the VPN client prior to accessing the DoD network.

Part of SRC-EPT-620 Remote user training

Associated with IA controls: ECSC-1

SV-6821r1_rule Remote users will be trained or given instructions on proper and authorized usage of the VPN client prior to accessing the DoD network.

Vulnerability discussion

Without proper training, remote users may not completely understand the procedures for connecting to a DoD network remotely, which may result in a system compromise.

Check content

Verify the existence of VPN client configuration and access procedures. Also, examine the site user training program to ensure VPN security procedures are included. Such items as local LAN access, split tunneling, and obtaining approval for configuration changes should be addressed in the training. If written VPN procedures do not exist, are inadequate, or are not provided to the users, this is a finding. If VPN security is not included in the training program, this is a finding.

Fix text

Develop and distribute user instructions for the VPN client.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.