This is a question born more from the user perspective but I'm wondering how it fits into a proper user creation and management policy. As a consultant I tend to work with various different clients and one issue that keeps coming up concerns getting access to their systems. While each client has its own procedures and some move faster than others, one issue that keeps coming up concerns the initial account creation and VPN access requiring me to physically go on site. In order to properly create my account and/or (re)set the initial password my device has to be within a corporate network.
My understanding of this so far is that VPN access won't be an option until after a first login and that IT is not able or more likely allowed to do this initial login for me. Some IT teams will do this anyway but I suspect it's probably not ISO 27001 compliant.
My questions on this are essentially:
- What are the reasons a user would have to be inside a corporate network before being able to access it remotely?
- Is this an inherent limitation/feature of Active Directory or would this be tied to the type of VPN solution a company runs?
- Does this offer any benefits from a security perspective?
- Is there some sort of legal or security certification requirement that governs this?
- Are there viable/secure workarounds?