1

We have network which users (mostly management, it, and the presidents) use VPN to remote into their work desktops or to use their laptops from home.

After some users took it upon themselves to install their own remote access software, I suggested we write up a remote access policy that explains to the users what is acceptable and what is not, only use the software on OK'd systems, etc.

The bosses suggested that we just don't tell anyone about remote access - the less that know about it, the less of a problem it is .. I was just to block unauthorized remote access from the firewall (gotomypc etc.)

I feel that it is important to have policies for just about everything - but they disagree in this situation.

What do you think?

Improve this question
2
  • 1
    Tough (and good) question, but I fear it's off-topic.
    – EEAA
    Feb 17, 2012 at 4:22
  • @ErikA I thought it would be better here after posting it as well.
    – Jeff
    Feb 17, 2012 at 5:41

2 Answers 2

Reset to default
2

I think it is very important to have a policy. This will not only help protect your companies data, but also open the air for users to bring it up. I personally would much rather have a user approach me and ask about using GoToMeeting or Logmein, rather than finding out months after they started using it, or find out when something gets lost.

I've written lots of HIPAA security policies for my work, and the biggest take away I've received is that its all a trade off of the perceived cost/value of your risk/data versus the cost of implementing something to protect it. Writing the policy gets you to sit down and think about how important your data really is, and this dictates how secure and strict you must be with users.

Improve this answer
2

If remote access should not be allowed, having no policy will leave your bosses no base for disciplinary action if someone manage to circumvent your firewall and creates any kind of problem, because doing so wasn't forbidden.

How important that is in your situation is up to you and your bosses to decide.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .