I recently helped a new person at our company. We use N-Able to connect to machines, which has prompt/notification turned off by default. I've never considered it extensively, though it crossed my mind in passing. Either way, this particular user was very disquieted by the fact that there was no notification at all, but it also seemed as though she expected to be able to deny me access to her system.

N-Able connection options, pretty robust, and can do what she's asking: N-Able Direct Connect Options

Further, she said she was told by IT at her previous company that unprompted connections are illegal, and that to comply with some standard (like HIPAA, but not HIPAA, she didn't know what standard, obviously) it was required to at least let users know. I know that I would never tell a user something like that unless I were absolutely sure it was true, so that gave me pause.

This is a corporate system which is subject to monitoring, and has the appropriate disclosures at login to tell the users this; though I'm not even sure this is required by law, more of a formality and good practice as I understand.

Am I way off? I've been doing this for a long time, and have worked in extremely stringent, high security environments, and I've never had to have a prompt to get permission to connect, but have worked where there was a notification that I was on. In the Marine Corps, we had a pop-up to let users know, but I never had to get a click from the user to allow me to connect. Sure, verbal or email permission is always granted prior to connecting, but anything more seems excessive.

Are there any standards that I am unaware of that outline base user rights? Do I need to update my policy?

  • I believe that to be protected under the Computer Fraud and Abuse act, notification that you're accessing a protected system is required, or at least would provide a stronger for a "knowning violation". You mentioned HIPPA, so you must be US based. I don't know of any law that would require an employee, using company provided equipment to be notified of monitoring though. My guess is it's largely a CYA notice, and your new employee is blowing some smoke. – Steve Sether Jun 11 '15 at 20:23
  • You are correct, I'm in the US. I'm vaguely familiar with the Computer Fraud and Abuse act, but will look it over again. From what I understand, it deals in depth with "unauthorized access" to systems, but I figured my authorization comes from the inherent corporate ownership of the system and my role in that corporation. I always thought it applied more to hacking, like someone outside of a corporation accessing a corporate system, but that may not be the case. Thanks, I'll look at that first! – MagnaVis Jun 11 '15 at 20:36
  • Well, even so it's just a way to ensure any attacker would be able to be prosecuted under the CFA. It really deals with "unauthorized access", which could cover a corporate user. It's not "illegal" to not post the notice of course, it just means you might not be covered by it. – Steve Sether Jun 11 '15 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.