We are in the process of implementing a Bring Your Own Device policy to allow our many employees to use their personal laptops and desktops (Windows platform) to VPN into our company's network. These employees will then remote desktop into their PC's located in our internal network.
Since we are PCI compliant this brings up various security concers:
- Can we wipe a device that VPN's in to our network remotely upon termination or other event? (legally? what software does this?)
- Can we make sure only to wipe files/data that came from the company?
- Can we ensure that the remote PC/Laptop is virus free?
- Can we ensure that the remote PC/Laptop has the most recent windows updates, java, flash?
- Is there a way to drop a certificate for VPN that will expire, making it no longer usable by that machine? (Currently, it looks like our CiscoAnyConnect software is dropping a cert that doesn't expire or self destruct)
- What would we need to ensure our PCI compliance?