8

There have been a few people at my office that have requested the installation of DropBox on their computers to synchronize files so they can work on them at home. I have always been wary about cloud computing, mainly because we are a Canadian company and enjoy the privacy and being outside the reach of the Patriot Act.

The policy before I started was that employees with company issued notebooks could be issued a VPN account, and everyone else had to have a remote desktop connection. The theory behind this logic (as I understand it) was that we had the potential to lock down the notebooks whereas the employees home computers were outside of our grasp. We had no ability to ensure they weren't running as administrator all the time / were running AV so they were a higher risk at being infected with malware and could compromise network security.

With the increase in people wanting DropBox I'm curious as to whether or not this policy is too restrictive and overly paranoid. Is it generally safe to provide VPN access to an employee without knowing what their computing environment looks like?

Improve this question
4
  • 1
    This is the exact same policy we have. If it doesn't belong to us, it doesn't connect, except Terminal Services (and even that is locked down tight).
    – Chris S
    Commented Apr 12, 2012 at 17:02
  • Technically speaking. The only thing anyone could get is access the user's VPN account password. What they access would be protected in theory, since the VPN connection would be encrypted.
    – Ramhound
    Commented Apr 13, 2012 at 13:13
  • But with that password, they could put their computer (or the compromised users computer) on my network and theoretically conduct MITM attacks, no? Not to mention get access to any resource behind the perimeter firewall.
    – DKNUCKLES
    Commented Apr 13, 2012 at 14:20
  • If they just want "Dropbox", you could use some "cloud" (actually web file management) solution on premise. This basically gives them what they want (access to files from home) but the files stay on the company servers. But still the problem that company data will be stored on virus infested, unpatched systems stays the same.
    – Josef
    Commented Oct 13, 2015 at 8:41

4 Answers 4

Reset to default
6

I don't consider your policy overly restrictive or paranoid at all. It's right to consider VPN client computers to be less trusted than your on-premise LAN-attached computers. It's a sound practice to have firewalls or other control devices in place to limit the traffic allowed to move to/from that semi-trusted VPN security zone into more trusted areas of the network. VPN access from domain-joined, company-owned computers is, to my mind, more trustworthy than VPN access from home computers. Depending on the authentication mechanisms used by the company-owned computers, however, I might be inclined to limit their access as I would home computers. If simply swiping a company-owned laptop grants VPN access without additional authentication, for example, I'd be locking-down the network access of company-owned computers from the VPN, too.

The root issue you're getting at, though, is a policy issue and not a technical one. Whether or not employees should be permitted to replicate company data into non-company owned data storage mechanisms is a policy decision your management needs to make. It's not always a truism that a non-company owned data storage repository is less secure but it's almost always something that the company has no ability to easily audit the security of. Taking security on faith w/o auditing is a bad idea.

Improve this answer
3

Another option would be to use a VPN that has an integrated NAC capability including client-side scanning.

A client-side agent would be able to check the security posture of the personally-owned devices and give some level of assurance about the risk of attaching to the network. You could either use a web-based on-access scanner (which has limitations due to user context) or, since they are connecting in for work, you could require them to download and install a software agent in order to have connection privileges.

Improve this answer
6
  • 2
    NAC on untrusted devices is a joke. You can't trust an untrusted device to tell you about itself. Scanning an device for vulnerabilities externally only tells you what it is exposing to the world-- nothing about what's inside it (think honeypots or vulnerable machines behind host-based firewalls).
    – Evan Anderson
    Commented Apr 12, 2012 at 22:09
  • 2
    @EvanAnderson What you say is not looking at things from a risk-management point of view. If financial or business reasons dictate that unmanaged devices sometimes need to connect to your network, you can't just throw up your hands and say "NAC is a joke". You need to minimize the risks they present, and NAC is one mechanism for doing so. You mention "untrusted devices", but even machines you own and manage aren't completely trusted, right? Even machines you own can be infected or used maliciously. I think NAC can be valuable as one element of minimizing risk of untrusted devices.
    – Mark Beadles
    Commented Apr 13, 2012 at 0:04
  • 1
    NAC only has value because it isn't widely deployed. Just like Trojan horses on Macs, if a target gets big enough it will be attacked. Personally I don't see NAC as having value on any device that doesn't have hardware-based countermeasures against running arbitrary code, and as console systems have shown, even then that's typically not enough. Incorporating a false sense of security into a risk management strategy is, to me, just security theatre.
    – Evan Anderson
    Commented Apr 13, 2012 at 0:58
  • 1
    @EvanAnderson If you are interpreting my answer as saying "NAC will solve all your problems" you're getting me wrong. As I stated quite clearly, it's an option. As for your "joke"/"false sense of security"/"security theatre" comments, I have so say I'm surprised at your vehemence. I'm relatively new to this particular site and if that is a common way to respond to answers made in good faith, I may visit here less.
    – Mark Beadles
    Commented Apr 13, 2012 at 1:22
  • 2
    @EvanAnderson I wish things were always that simple. If IT/security always had the final say on who connects to the network, then we could always choose the path of least risk. But we also have to be prepared to be overruled by the business - and when we are, we should offer solutions to help protect the environment as much as we can when that happens. If DNUCKLES has the authority to say "no" to those users, great. But if he doesn't, then he's got to do something.
    – Mark Beadles
    Commented Apr 13, 2012 at 16:26
2

It seems to me the issue is how valuable the data is to your business. If you are comfortable storing it on unsecured computers on home networks with unknown security controls or if data disclosure doesn't put the business at too high a risk, then there is no need for restrictions.

Improve this answer
2
  • This is an interesting answer, and items which I have considered. Unfortunately it seems as though there is no simple solution to this issue (at least as far as I can see). If an employee wants the information on their computer at home then there's nothing stopping them from putting the information on a USB key and taking it to and from, unfortunately. I feel as though there's no perfect solution, just one that's less flawed than another. I think I'd prefer a VPN over the USB key.
    – DKNUCKLES
    Commented Apr 12, 2012 at 15:30
  • 2
    It does speak to the need for good policies and for management to understand the risks regardless of what controls you choose to put in place.
    – uSlackr
    Commented Apr 12, 2012 at 16:36
0

Check Dropbox terms of servicee. It used to be rather open about who could access(their staff, government agencies, etc). They also had a breach where ANY password would allow access.

I believe the use of VPN and/or Remote desktop makes sense. You can then at least manage what data is stored where.

We have also used SharePoint with SSL (HTTPS) to allow users to reach internal documents and then be able to check in and check out and maintain versioning.

Your concern over home hardware is reasonable in my opinion.

We also deployed CrushFTP that allowed HTTPS for access to specific folders. Users would then have access to files and we could share with clients and partners. Took some managemnt but was well received and gave more control.

Improve this answer
2
  • Thank you for your feedback. As far as I'm concerned DropBox is out of the question - they also had an issue where they said that staff could only see the files metadata and that ended up being false. My only issue with sharepoint is the cost associated with it.
    – DKNUCKLES
    Commented Apr 12, 2012 at 15:31
  • If you're suggesting allowing user-owned devices to have access to an external-facing Sharepoint site or FTP server, then we're still left with the same problem the OP is asking about - is it really safe to entrust this data to devices the company cannot control?
    – Iszi
    Commented Apr 12, 2012 at 17:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .