RE: restricting mobile users internet access

["Murda Mcloud" <murdamcloud () bigpond com>]

Pwd restrict access to the BIOS and don't allow to boot from cd?

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of Chad Loder
Sent: Thursday, January 17, 2008 9:54 AM
To: sarcasmo2005 () gmail com
Cc: security-basics () securityfocus com
Subject: Re: restricting mobile users internet access

On Wed Jan 16/2008 @  9:01:P -0000 asdasd, sarcasmo2005 () gmail com wrote:
> I've been asked to seek out if it's possible to implement an internet
policy, which restricts staff using corporate notebooks to accessing the
internet only via corporate internet proxies. 
> The mobile users have Cisco IPsec and Sonicwall SSL VPN clients installed
on the notebooks. While it's straighforward to enforce an VPN (or active
directory) policy to enforce mobile users to use the corporate proxies, the
problem I'm facing is   when a member of staff is in an airport (or is using
a hotel internet connection) they need to be able to get to the inital
account setup pages (i.e where the internet provider asks you to login or
pay for time use). This makes the internet restriction policy tricky. The
mobile users in question can often travel to any region in the world.
> I guess you could use a product such as 'i-pass' but from what I can see
with i-pass you still have to be able to hit the ISPs account setup page, or
you could have a hotel that doesn't support i-pass. 
> If staff can disable the proxy and go straight to the internet, then it's
gone against work to enforce corporate proxy use.
> I would be very grateful if anyone has had this issue before and could
share how they approached it. I'm sure I'm not the only person that's had
this question posed to them before ??
> thanks in advance

I'm reading your question and alarm bells are going off in my head.

What is the risk that you are trying to address here?

Could any possible solution prevent your corporate roadwarriors
from, say, booting a LiveCD on their laptops and accessing the
Internet that way?