(Originally posted on the work place and was suggested to post here)
I know being an employee I am paid to do what my boss tells me to do, however:
I am currently writing a website for my company that I work for, we work with sensitive data, so much so that my line manager told me the over all boss wants me to lock IP addresses to accounts so that you cannot access it unless you are in that particular location
For my company we are creating a private portal so the company can log in and get the information about their product from our website. My boss wants it to be that only people logging in from that specific area can access the files. I.E. not going home and logging in and showing their wife of friends, or them getting fired and showing off the documents to our competitors.
Having searched for this it has made me think:
Is locking down an account a really good idea?
I used to play a lot of on-line games, If your IP addressed changed it sometimes caused major problems (i.e. WOW)
What if that companies IP address changes and the entire company is banned from logging in?
I am trying to think of a better solution to this and was wondering if you guys have any ideas?