What is your approach to handling Guest Internet access?

Question

Suppose you're a company that uses a web proxy to block objectionable content on your corporate network, and this technology may cause issues with some 3rd party VPNs. Or perhaps this 3rd party is working on a project that IT should not manage or be involved in for political reasons.

How would you handle a request from a visiting vendor, or contractor, who needs unrestricted internet access?

Under what conditions would you need to exempt them from monitoring?

Would you handle certain visitors differently than others? How would you handle financial auditors (PWC) for example?

What technical solution would you employ, and how would you manage access to that solution?

[Edit]

If your solution involves using Wireless to solve the above issue, how do you prevent abuse from internal employees who may simply associate to your access point and download content. Is it not a concern today until someone abuses it?

Answer 1

We provide an open guest wireless network that only blocks categories like porn, gambling and racist. The corporate network blocks a little more, like social networking, but the guest network can't access internal resources. Nobody gets "unrestricted" access, we always block sites categorized as malicious. If there is a specific site categorized wrong we are willing to change it, but any site blocked needs to be reviewed individually. If a vendor doesn't like it they can supply their own cellular network card.

All common types of VPNs are open outbound on our network. In our environment if a vendor is on-site and needs to connect to their corporate network that's fine; if we didn't trust them we wouldn't hire them.

Auditors connect to the guest wireless network. If they need data from a system they tell us what query or report is desired and we run it. At no point are they given direct access to any of our systems.

To more directly answer your question, if the IT systems used conflict with a project that IT is not supposed to be involved with or know about I'd say that project needs their own internet connection. They would also need to be off the corporate network if they are running independent of the main security system and I'd guess they are operating outside of your policies around system security (unless you have a lot of these and put it in the policy).

Answer 2

From a background of having worked for an auditor, and from providing guidance to large banks, the two main categories are as follows:

Guest access entirely separate to the corporate network - this is simplest, and as Wayne said requires some security but this shouldn't be too onerous. You should look to block broad categories of unsuitable content, and put in basic controls to prevent attackers gaining access to the data or systems of other 'guests' but aside from that you don't want to be looking at it too closely - otherwise it could be assumed you are trating it like your corporate network and your responsibilities may be much higher. Definitely worth getting all guests to sign an Acceptable Use policy.

For auditors, they often require access both to your systems and to their own, but general unrestricted access to the internet is usually not a requirement, which means you can provide a much simpler solution - often just a VPN endpoint which will only allow connection to their remote access solution. Then if they want internet connectivity they can connect through their own corporate proxy. This protects you to a great extent, and means they can still be monitored by their own systems. It can take a little time to set up, but having worked in a large number of organisations in an IT audit role, this was often the simplest/cheapest. (okay, sometimes the simplest solution was for the auditors to have a GPRS card in the laptop, but it was never cheapest:-)

Both solutions have as light a requirement as possible in terms of ongoing monitoring and management.