Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have network which users (mostly management, it, and the presidents) use VPN to remote into their work desktops or to use their laptops from home.

After some users took it upon themselves to install their own remote access software, I suggested we write up a remote access policy that explains to the users what is acceptable and what is not, only use the software on OK'd systems, etc.

The bosses suggested that we just don't tell anyone about remote access - the less that know about it, the less of a problem it is .. I was just to block unauthorized remote access from the firewall (gotomypc etc.)

I feel that it is important to have policies for just about everything - but they disagree in this situation.

What do you think?

share|improve this question
1  
Tough (and good) question, but I fear it's off-topic. –  EEAA Feb 17 '12 at 4:22
    
@ErikA I thought it would be better here after posting it as well. –  Jeff Feb 17 '12 at 5:41
add comment

migrated from serverfault.com Feb 17 '12 at 4:48

This question came from our site for professional system and network administrators.

2 Answers

up vote 2 down vote accepted

I think it is very important to have a policy. This will not only help protect your companies data, but also open the air for users to bring it up. I personally would much rather have a user approach me and ask about using GoToMeeting or Logmein, rather than finding out months after they started using it, or find out when something gets lost.

I've written lots of HIPAA security policies for my work, and the biggest take away I've received is that its all a trade off of the perceived cost/value of your risk/data versus the cost of implementing something to protect it. Writing the policy gets you to sit down and think about how important your data really is, and this dictates how secure and strict you must be with users.

share|improve this answer
add comment

If remote access should not be allowed, having no policy will leave your bosses no base for disciplinary action if someone manage to circumvent your firewall and creates any kind of problem, because doing so wasn't forbidden.

How important that is in your situation is up to you and your bosses to decide.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.