I'm helping to administer a LAMP web server for a charity which runs CiviCRM on Joomla. This system is going to be accessed over the Internet by many volunteers from devices I have no control over.. Are there any professional tried-and-tested suggestions for hardening given such a scenario?
For example, one way could be through a VPN and a spreadsheet that lists users & devices with access together with their "security readiness state":
- Access granted (i.e. group membership)
- Access needed (i.e. gently making people justify being admin..)
- Device name
- Device location
- Device OS
- Device security software in use
- Link to device-specific security checklist
- Date security checklist last ran
- Device VPN key thumbprint
The spreadsheet could be viewable organisation-wide, thus encouraging transparency and accountability, hopefully giving me leverage in getting users to at least adopt the standards of their peers. To do this I would be interested in ways of auditing a device's security posture. If it could be audited and enforced by the VPN (quarantine & remediation) that'd be even better.