We have network which users (mostly management, it, and the presidents) use VPN to remote into their work desktops or to use their laptops from home.
After some users took it upon themselves to install their own remote access software, I suggested we write up a remote access policy that explains to the users what is acceptable and what is not, only use the software on OK'd systems, etc.
The bosses suggested that we just don't tell anyone about remote access - the less that know about it, the less of a problem it is .. I was just to block unauthorized remote access from the firewall (gotomypc etc.)
I feel that it is important to have policies for just about everything - but they disagree in this situation.
What do you think?