Once your VPN is up and running, you must train your users on how to use it. One of the most common challenges with IT infrastructure deployments, especially with security infrastructure like a VPN, is for the IT team to assume that, because they understand how the solution works, their end users understand it as well. That is almost always a bad assumption. It can turn a successful rollout into an unsuccessful one.

To develop good user training, start by setting appropriate training program goals. One of the first mistakes security practitioners make when developing training is jumping past any planning and starting with taking screen shots, typing up documentation, and scheduling meetings. However, much like a successful VPN deployment, the first part of successful training is planning. Determine the following before designing your user training:

• Who is your target audience for the training? Before you start writing your training, understand who will be learning.
• What is the technical awareness level of your audience? Are you training tech-savvy IT professionals, or salespeople who just want to turn on their PCs and start working?
• Where is your audience? Is your audience in one central location, or spread out regionally—or even nationally? This will affect the choice of media you use to train users.
• What level of training are you trying to deliver? Will users need to install the client software? Do you want to include basic troubleshooting in the training? Are you trying to sell features, or do you just want to train them on how to log on? Should you include additional security issues in this training?

Once you gather the appropriate information, determine the best mechanism for delivering the training. For example, you may distribute some written instructions, create a training video, have a conference call, or hold a web conference. For high-profile users or those who require significant support, hold classroom training. If you decide to go with live training, plan to do additional information security training. After all, you have their attention for the period of the training; you should maximize the benefit not only to your users, but also to your company. Remember that well-trained employees tend to be the most secure computer network users.

Other things to keep in mind as you plan user training: Make sure your training plan includes how you will train new employees. Will your training post to an intranet website that new hires can watch? Will you offer new-hire training at a regular interval to ensure that everyone understands how to use the VPN?

Finally, do not forget your support staff. If a user with VPN issues is supposed to call the help desk, make sure the help desk knows how to help.