This is a question born more from the user perspective but I'm wondering how it fits into a proper user creation and management policy. As a consultant I tend to work with various different clients and one issue that keeps coming up concerns getting access to their systems. While each client has its own procedures and some move faster than others, one issue that keeps coming up concerns the initial account creation and VPN access requiring me to physically go on site. In order to properly create my account and/or (re)set the initial password my device has to be within a corporate network.

My understanding of this so far is that VPN access won't be an option until after a first login and that IT is not able or more likely allowed to do this initial login for me. Some IT teams will do this anyway but I suspect it's probably not ISO 27001 compliant.

My questions on this are essentially:

  • What are the reasons a user would have to be inside a corporate network before being able to access it remotely?
  • Is this an inherent limitation/feature of Active Directory or would this be tied to the type of VPN solution a company runs?
  • Does this offer any benefits from a security perspective?
  • Is there some sort of legal or security certification requirement that governs this?
  • Are there viable/secure workarounds?
  • Apologies if this is too long / unclear / improperly tagged. Not sure how to put this in a more concise manner as I haven't really figured out what the key issue is (AD, a class of VPN tools, ISO policies). Finding that out is I guess the motivation for this question in the first place. :)
    – Lilienthal
    Jun 3 '20 at 9:07
  • Half of this question is an AD technical question and not so much a security question. ISO 27k doesn't apply since it only requires policies to be in place, and if the policy is to log in for the user, then that's ok. So, there is a chance that this whole thing might be better answered on ServerFault if reduced to the AD portion.
    – schroeder
    Jun 3 '20 at 9:59
  • @schroeder Yeah, was kind of my fear since I just don't really know what the chief culprit is: the AD or just the way some VPNs work. I guess that's basically the first question here, would that be on topic here? And should I boil it down to just that? If part / all of the answer is "that's how AD works" then any detailed examination of that probably belongs in Server Fault.
    – Lilienthal
    Jun 3 '20 at 10:08
  • 1
    It's not the VPN that's the dependency, but the authentication, and that's from AD in this case. Perhaps leave this up for a while in case there are other elements to consider, but I really think this is a pure AD question.
    – schroeder
    Jun 3 '20 at 10:13
  • 1
    @TomK. Physically bringing your device (either company or client laptop) on-site so that it is connected to the on premise network. On two occasions I was told to just go sit in the lobby or on a bench outside the office, connect to the wifi, login and leave. :)
    – Lilienthal
    Jun 3 '20 at 13:11

As someone who writes these kind of policies I'm always interested in how admins manage to circumvent the organizational controls that I want to implement.

Why would an on-site visit be required?
If someone new starts working for an organization - no matter if it's a consultant or an employee - it's really complicated to authenticate an account creation request. Sure, there are certificates and public keys and whatnot, but a lot of admins that do day-to-day IT service work struggle with putting a lot of trust in these means of authentication. Besides the lack of expertise, there might be a lack of technical capabilities to make use of these means. On top of that there might be some risk of private key compromise or well executed social engineering.

So what's an easy and cheap way to make sure you are giving access to the right person? Make them come on-site, identify and authenticate them. Afterwards, check their device into the directory service. There's little to no additional cost for you as a company, and risk of impersonation can be reduced by a lot.

My guess is, that you are working with companies that have a policy that is set up like this, but they also employ admins who are too lazy or have other controls implemented that make it unnecessary to actually - for instance - verify your identity document(s).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.