We have corporate network where remote workers connect via encrypted latops (Windows 7) using VPN (Cisco AnyConnect client), log into the Windows domain and access their network shares, Outlook e-mail, MS Office applications and the sales database. For security reasons laptops are configured so that files cannot be saved locally (on drive C:) and USB ports are disabled. So people can work only when logged on the corporate network and then save their files on their network shares. In terms of threats we assume that users are honest and do not try to abuse their physical access to laptops.
Problem: We have a small department that organises conferences and events. For the organisers this configuration often presents problems - e.g. lecturers come with their USB sticks for presentations, or need access to internet. Every time there is a glitch with the VPN connection from where they are located (e.g. cannot connect to VPN, or connection is very slow) the organisers suffer embarrassing difficulties using their laptops with lecturers and audience waiting. When it happens this costs in time, reputation and probably more. This has lead to the following solution:
Solution: We have set up the 4 laptops of the conference department in such a way that they dual-boot between two windows 7 installations each from its own fully encrypted hard drive. Installation 1 is the same as before and provides access to corporate network. Installation 2 has Windows configured to be used on local machine only - without access to corporate network. The conference organisers can use this installation as they would want but without autorun and without privileges to install programs locally. They can use wifi in conference centers and hotels and the built in mobile 3G connection. Antivirus software is updated regularly. Configuration of Installation 2, if needed, is done via the local administrator account by the network specialist at the company base. If the users of these laptops need to exchange document files with their corporate network (or their own accounts there) they use e-mail. Every 4 to 6 months their Installation 2 is overwritten / re-imaged by the network specialist, to deal with any potential problems.
Could this setup be considered reasonably safe, given that the conference organisers are responsible people? Are there better solutions that would allow the organisers to both access the corporate network (with re-booting) and to use laptops for conference presentations as described?