Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suppose you're a company that uses a web proxy to block objectionable content on your corporate network, and this technology may cause issues with some 3rd party VPNs. Or perhaps this 3rd party is working on a project that IT should not manage or be involved in for political reasons.

How would you handle a request from a visiting vendor, or contractor, who needs unrestricted internet access?

Under what conditions would you need to exempt them from monitoring?

Would you handle certain visitors differently than others? How would you handle financial auditors (PWC) for example?

What technical solution would you employ, and how would you manage access to that solution?

[Edit]

If your solution involves using Wireless to solve the above issue, how do you prevent abuse from internal employees who may simply associate to your access point and download content. Is it not a concern today until someone abuses it?

share|improve this question
    
... oh yes, and please mention the industry you are involved in, as that may shed light on common approaches in a vertical market. –  makerofthings7 Dec 2 '10 at 3:47
add comment

2 Answers

We provide an open guest wireless network that only blocks categories like porn, gambling and racist. The corporate network blocks a little more, like social networking, but the guest network can't access internal resources. Nobody gets "unrestricted" access, we always block sites categorized as malicious. If there is a specific site categorized wrong we are willing to change it, but any site blocked needs to be reviewed individually. If a vendor doesn't like it they can supply their own cellular network card.

All common types of VPNs are open outbound on our network. In our environment if a vendor is on-site and needs to connect to their corporate network that's fine; if we didn't trust them we wouldn't hire them.

Auditors connect to the guest wireless network. If they need data from a system they tell us what query or report is desired and we run it. At no point are they given direct access to any of our systems.

To more directly answer your question, if the IT systems used conflict with a project that IT is not supposed to be involved with or know about I'd say that project needs their own internet connection. They would also need to be off the corporate network if they are running independent of the main security system and I'd guess they are operating outside of your policies around system security (unless you have a lot of these and put it in the policy).

share|improve this answer
    
Do you have any issues with employees using the wireless to circumvent the proxy filtering? –  makerofthings7 Dec 2 '10 at 4:04
    
We have chosen to not get involved in that debate. If an employee isn't doing their job we can run reports for their manager. but we don't prevent them from using the guest wireless. –  Wayne Dec 2 '10 at 4:08
    
I work in healthcare. –  Wayne Dec 2 '10 at 4:08
1  
When we first put the filter in it was to save bandwidth, not prevent access to certain types of sites. It was so bad that radiology images couldn't transfer between locations due to no bandwidth. Now that the bandwidth is under control we try to only have as light of a filter as necessary to protect the network and discourage wasting time but if someone has a legitimate reason for a site to be open we'll do it. –  Wayne Dec 2 '10 at 4:11
    
Thanks! +1 for the thoughtful responses BTW. I hope to see more perspectives that may align with yours, or contrast with your approach –  makerofthings7 Dec 2 '10 at 4:12
add comment

From a background of having worked for an auditor, and from providing guidance to large banks, the two main categories are as follows:

Guest access entirely separate to the corporate network - this is simplest, and as Wayne said requires some security but this shouldn't be too onerous. You should look to block broad categories of unsuitable content, and put in basic controls to prevent attackers gaining access to the data or systems of other 'guests' but aside from that you don't want to be looking at it too closely - otherwise it could be assumed you are trating it like your corporate network and your responsibilities may be much higher. Definitely worth getting all guests to sign an Acceptable Use policy.

For auditors, they often require access both to your systems and to their own, but general unrestricted access to the internet is usually not a requirement, which means you can provide a much simpler solution - often just a VPN endpoint which will only allow connection to their remote access solution. Then if they want internet connectivity they can connect through their own corporate proxy. This protects you to a great extent, and means they can still be monitored by their own systems. It can take a little time to set up, but having worked in a large number of organisations in an IT audit role, this was often the simplest/cheapest. (okay, sometimes the simplest solution was for the auditors to have a GPRS card in the laptop, but it was never cheapest:-)

Both solutions have as light a requirement as possible in terms of ongoing monitoring and management.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.