2.2.5Establish secure communication

Remote enterprise subjects and assets cannot fully trust their local network connection. Remote subjects should assume that the local (i.e., non enterprise-owned) network is hostile. Assets should assume that all traffic is being monitored and potentially modified. All connection requests should be authenticated and authorized, and all communications should be done in the most secure manner possible (i.e., provide confidentiality, integrity protection, and source authentication).