3

We are in the process of implementing a Bring Your Own Device policy to allow our many employees to use their personal laptops and desktops (Windows platform) to VPN into our company's network. These employees will then remote desktop into their PC's located in our internal network.

Since we are PCI compliant this brings up various security concers:

  1. Can we wipe a device that VPN's in to our network remotely upon termination or other event? (legally? what software does this?)
  2. Can we make sure only to wipe files/data that came from the company?
  3. Can we ensure that the remote PC/Laptop is virus free?
  4. Can we ensure that the remote PC/Laptop has the most recent windows updates, java, flash?
  5. Is there a way to drop a certificate for VPN that will expire, making it no longer usable by that machine? (Currently, it looks like our CiscoAnyConnect software is dropping a cert that doesn't expire or self destruct)
  6. What would we need to ensure our PCI compliance?
  • Perhaps you should engage some vendors and ask them, as they'll be the best ones to provide you with these answers. – DKNUCKLES Apr 15 '14 at 15:39
  • I've engaged a few vendors regarding this already. Unfortunately, most solutions, f.e. IBM's, will only check to see if the PC's connecting via vpn are up to date and virus free. This is only one component of our need. – HAL Apr 15 '14 at 16:10
  • 1
    Are your users prepared to give up control of their personal devices to your team who would have ultimate control over them? – schroeder May 15 '14 at 21:37
  • Have you looked at BlackBerry and Samsung Knox? – schroeder May 15 '14 at 21:37
  • That is the sacrifice they will have to make if they want to use their own devices. I will look at Samsung Knox. Any idea what the blackberry solution is named? – HAL May 16 '14 at 12:55
1
  1. Not unless they join your domain and GP is enforced. Though you can't really enforce this. So people which are not on the domain you'll have no control of. I don't know of any software which does though.

  2. If they are on the domain, you'll need FULL permissions to your company data and you'll have to know every known hash of your company data. If they modify it then your hash will change, theoretically you can use byte signatures to get a x% match then delete it. Though if it's encrypted or compressed your byte signature is going to be screwed.

  3. Malware is constantly been developed so you can't rely on AVs and so on ensuring the PC is completely virus-free. For example: If I wrote some obfuscated malware right now and did a wwww.virustotal.com it would be clean as it's not known and won't match byte signatures yet. Many AVs vendors have a server/client AV which when detects a malware on client informs the server running the AV.

  4. Yeah, check out WMI QFE

  • 1/2. Not true. inSync software can wipe the content of a drive thats been pulled from any corporate server or information point. druva.com/insync/data-loss-prevention – HAL Apr 15 '14 at 17:32
  • 3. Yes, I'm aware that malware is being constantly developed. But I'd like the program or process to make a check before it allows VPN connections. – HAL Apr 15 '14 at 17:33
  • @HAL, you can write a program and tell your users that they have to run it, but your users can replace that program with one that always says 'the scan was clean' – atk Aug 14 '14 at 2:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.