Technology Division

1. In today’s business environment, being able to access information stored on a user’s work station quickly from any location can be critical. To be able to access data on the user’s own workstation requires virtual private network (VPN) access. VPN is a secured private network connection built on top of a public network, such as the Internet. A VPN provides a secure, encrypted connection, or tunnel, over the Internet between an individual computer (such as a computer off campus) and a private network (such as Chattanooga State’s). Access for email or Self Service Banner (SSB) does not require VPN access. Faculty, staff and students can access email from Office 365.SSB can be accessed through TigerWeb. Please contact the Technology service desk for instructions for either of these two access avenues.
2. The purpose of this policy is to state the requirements for remote access to computing resources hosted at Chattanooga State using VPN technology. These standards apply to all Chattanooga State employees (except for student workers or other workers that are not authorized VPN access,) authorized users, contractors and visitors that have verified access requirements to Chattanooga State computing resources or data. All College wireless and wired local area network (i.e., WLAN) technologies and both inside and outside areas at all Chattanooga State campuses are covered. Chattanooga State employees, and authorized third parties (customers, vendors, etc.) may utilize VPN to access Chattanooga State computing resources for which they have been granted access. Access is determined by the requesting individual’s immediate supervisor or by the individual that is responsible for vendors/contractors based on business requirements for the assigned job duties.
3. Regular, full-time Chattanooga State faculty or staff employees that have a valid Chattanooga State domain user account may request VPN access to the Chattanooga State network by completing a Technology service request. All service requests for VPN will need to include the business justification and the form should be signed by appropriate Director or higher level of management. This justification should address exactly what type of work will be done off campus that will require VPN access.  Requests without the business justification will be returned to the requestor as incomplete. This stringent security requirement is to ensure that only those individuals that have job duties that require the need to access Internet Native Banner from an off- site location are granted access in order to lessen the security risk.

1. VPN access is valid for only a set period of time and will be reviewed annually.  Further information; please go to Technology web page. Only individual accounts may be granted VPN access to ensure accountability.

2. Vendor accounts may be granted VPN access. Vendor accounts must be sponsored by a Chattanooga State Director or higher-level manager. The account sponsor bears responsibility for the account and its use by the vendor. If the vendor account does not already exist, a request to establish one must be made at the same time VPN access is requested.

D. In order to use the VPN from off campus, users will need a connection to the Internet. Chattanooga State does not provide users with an Internet connection or equipment to use for offsite work on a permanent basis. Users will need to connect his or her offsite desktop or laptop with his or her Internet Service Provider. While dial-up Internet connections may utilize a VPN connection, performance is very slow and is not recommended or supported. For further details to access VPN from the user’s personal computer/laptop/etc., please contact Technology service desk.

E.  Any user found to have violated the terms of use may be subject to loss of privileges or services and other disciplinary action.

1. It is the responsibility of all Chattanooga State employees and authorized third parties with VPN privileges to ensure that unauthorized users are not allowed access to internal College networks and associated content.
2. All individuals and machines, while using Chattanooga State’s VPN technology, including college-owned and personal equipment, are a de facto extension of Chattanooga State’s network, and as such are subject to the College’s Acceptable Use Policy.
3. All computers connected to Chattanooga State’s internal network via the VPN or any other technology must use a properly configured, up-to-date operating system and anti-virus software; this includes all personally owned computers.
4. Redistribution of the Chattanooga State VPN Installer or associated installation information is prohibited.         
5. All network activity during a VPN session is subject to Chattanooga State policies.
6. All users of the Chattanooga State VPN shall only utilize resources for which they have been granted permission and rights to use.                                                               

References:

1. National Institute of Standards and Technology, Special Publication 800-46 Rev 2, Guide to Enterprise Telework, Remote Access and Bring Your Own Device (BYOD) Security, 7/2016
2. The State of Tennessee Department of Finance and Administration Strategic Security Program, 12/15/2016
3. Chattanooga State Technology Division Policy 08:14 Responsible Use Policy, 5/30/2017

Dr. Rebecca Ashford, President                                                                                        October 24, 2017

Signature                                                                                                                                Date Approved

New Policy

Division Name: Technology Division

Policy Number and Title: 08:22:00 Virtual Private Network Access

1. Reformatted the whole policy to new format.
2. All pages - Information Technology Services was changed to new division name - Technology Division.

Signature                                                                                                                                Date Approved