2

I have someone who is having their non profit small company receive a financial audit. They are prepared for it but the financial auditors have asked to also do part of it remotely and would like to use screen sharing. They can say no, however, they feel if they say no, lol, then they will think they have something to hide, which they do not.

However, they don't like the idea of just allowing access without putting some security measure into place. I am a database person. I do not know how to advise him. I would welcome any advice. I was considering having him use encryption on files that do not have to be accessed, but that might not look good. And I am not sure if there is a way of tracking what they will be doing because I don't know the software they will be using.

  • What's the purpose of the audit? Is it strictly financial audit or is there security component as well? This sounds like a rather odd request. Many properly run finance systems is not going to be accessible through screen sharing, because they run in headless server (no GUI) or they run deep inside internal company networks without direct access to internet. – Lie Ryan Jun 13 '16 at 2:35
  • @kms Can't you simply put a copy of all the audit documents in a separate machine/VM and give them full aceess to it? – Sravan Jun 13 '16 at 4:02
  • at least use a one-session pw and hire a lifeguard to watch the pool while they swim. – dandavis Jun 13 '16 at 8:44
2

For best security, you can use a screen sharing program that does not give the auditor control over mouse and keyboard. You can talk with them over the phone/VoIP/video chat and have them instruct your staff on what to do. Make sure the staff is properly briefed to know what can be disclosed to the auditor and what requires further authorizations (e.g. data that contains personally identifiable information).

Some video chat software has screen sharing component, e.g. Google Hangout, Skype.

  • 1
    This would mitigate the threat of auditors accessing documents they should not be. It does not mitigate the threat of leaking the data to an unauthorised person (over auditor's shoulder). Maybe unlikely scenario, but it is the company's private data, not public. When auditors show up at the door you can verify their identity (before letting them view the data that they have right to access). When you allow remote access, even if you control the mouse and keyboard, you don't know who's looking. – techraf Jun 13 '16 at 5:36
  • @techraf it is very difficult to overcome the situation that you are talking about. The only thing that can mitigate this is that you do a facial recognition of the auditor. Ask them to keep the webcam on and if you detect more than one people, immediately disconnect the session. – Limit Jun 13 '16 at 8:11
  • Even in that scenario, you can't override a situation where the auditor has a screen recording tool running on his machine. – Limit Jun 13 '16 at 8:11
  • Yes. That's why I commented so that OP can take an informed decision. The question was "how to secure", you answered that with a reasonable measure. My comment does not fit as a standalone answer, but I thought it was important to stress your "best security" means "best for a particular threat". – techraf Jun 13 '16 at 8:27
  • @techraf: yes, that's a fair point, "best security" here means best in the context that remote access is a given. – Lie Ryan Jun 13 '16 at 9:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.