0

I have a personal device through which I access the employer's network through a VPN. I can connect and disconnect from the VPN when I choose. I did not know the employer had installed Sophos Endpoint Agent on my computer.

While I was disconnected from the VPN, I was browsing and got the network restricted site notification. I saw the Sophos popup, looked in my programs, and found the program there. Sure enough, in the log it says it blocked access and reported it to IT.

What, if anything should I do? I don't know if I will get in trouble for this or if I even did anything wrong. I'm not in IT. Should I contact IT and self report and explain that I was not working and not connected to the VPN? We don't have in-house IT, they are a vendor. I can disconnect from the VPN but I can't uninstall or disable the endpoint security with the administrator credentials.

Improve this question
0

2 Answers 2

Reset to default
1

They have no business monitoring your personal device off-hours. So you need to contact them to get this software off your personal device.

There is no reason you should get in trouble (unless what you did was illegal in your country) but you have plenty of reason to be upset with them for over-reaching with their installs and preventing personal use of your device.

They might have informed you about this install, but as you can see, it's affecting the use of your personal device, so at the very least, it needs re-configuring.

Improve this answer
1
  • 1
    And that's one of the reasons why it is recommended to use a dedicated device for work and another device for personal use.
    – gaazkam
    Commented Jun 22, 2023 at 6:45
1

Your company surely has some kind of policy regarding the use of personal devices to connect to enterprise resources? If you are allowed to connect to those resources via your personal device I feel like they are in all right to install an endpoint agent as well, IF they have defined it in the company policy. And they should of course make sure you know about this, and inform you what they did when installing the VPN and endpoint agent.

Without knowing the policy it is difficult to say if you have done anything wrong, but just from a "general" viewpoint, as long as you didn't try to access something illegal you should be fine.

If this is one of their requirements for having access to enterprise resources and you don't accept it, just have them remove all their software and if need be, use a different computer for business.

If you manage to get a virus on to your computer, and then access your company network through the VPN you are more then likely increasing the risk of a breach. Say that a keylogger finds it way to your computer via your personal email, the next time you connect to the VPN all those credentials will go to the attacker as well. It is just logical (and necessary) for the company to protect its assets, especially with remote work getting more and more common.

Improve this answer
6
  • There's a big difference between having a corporate-compliant antivirus on your computer and having a clean system before being allowed access to the VPN. For personal devices, they need not be compliant 24/7 when not connecting for work purposes. An endpoint agent should check the device to see if it meets policy before connecting. It shouldn't block websites that are banned by corporate policy when not connecting to corporate assets. What the OP is describing is corporate policy being enforced during personal use. That's a problem, not "par for the course".
    – schroeder ♦
    Commented Jun 22, 2023 at 17:26
  • And suggesting to "use a different computer for business" is not feasible. Not everyone has extra computing devices hanging around that can be used for work purposes and controlled by corporate policy. In this case, the employer should provide equipment. It shouldn't be up to the individual to have a device that the employer can control. The level of control described by the OP is an over-reach. Either the endpoint agent needs to be reconfigured, or the employer needs to rethink their policies and BYOD strategy.
    – schroeder ♦
    Commented Jun 22, 2023 at 17:31
  • I understand your point, but all this depends on the company policy. If the policy states that one requirement for using a personal device for accessing company resources is that the agent gets installed, it is a case of either accept or deny that requirement. All of this is speculative of course since we don't know the policy, if OP must or gets to use his own device and so on. Maybe I wasn't clear about "use a different computer for business", I didn't mean that OP should go buy another computer. It should of course be provided by the company if they want OP to be able to do remote work.
    – Razze
    Commented Jun 26, 2023 at 7:01
  • No, you've missed my point entirely. Policy saying that an agent needs to be installed is one thing. the agent preventing legitimate use of a personal device is a completely different issue. Your conclusion: this is normal. It is not.
    – schroeder ♦
    Commented Jun 26, 2023 at 7:34
  • Well, since none of us have any idea if it could be considered as "legitimate use", I don't see how you could make that conclusion. It could be the local news site, it could also be the "sexy singles in your area" site demanding a credit card for starting a conversation with a lovely lady around the corner. So yes, I absolutely consider that this might be normal. If it is unacceptable, have them remove it and don't use that device for work.
    – Razze
    Commented Jun 26, 2023 at 8:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .