Re: Vendor remote control for printer support

["Manjak, Martin" <mmanjak () ALBANY EDU>]

We got a similar request from a vendor for our POS server system.  We said 'NO."

My understanding is that they would use this to draw a lot of statistical data from the system, and that data doesn't 
belong to them.

We manage remote vendor access via vendor Active Directory accounts and security groups that are tied to specific VPN 
permissions.

Marty Manjak
ISO
University at Albany

The University at Albany will never ask you to reveal your password. Please ignore all such requests.
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Dean 
Williams
Sent: Thursday, March 15, 2012 4:41 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Vendor remote control for printer support

Is anyone allowing vendors to remote control your employees' computers with products such as LogMeIn?

A company from whom we lease printers has been getting departmental staff to let them control their computers with 
LogMeIn, for the purposes of installing printer drivers and configuring campus printers.  Giving strangers access to 
institutional computers that are likely to contain sensitive information makes me a little nervous.

Whether it's a printer vendor or an employee who wants to do it, though, the demand for remote control or remote 
desktop doesn't seem to be diminishing.  Has anyone found a secure and practical balance between the advantages of 
remote control, and the risks that come with it?   Any specific product experience, good or bad?

(We use SimpleHelp for IT staff to share clients' screens, but I see that as quite different from letting a vendor do 
so.)

Thanks for any insights you can share.

Best regards,
Dean


----------------------------
Dean Williams
Information Security Officer
Enterprise Technology Services
University of Vermont
Dean.Williams () uvm edu<mailto:Dean.Williams () uvm edu>
http://www.uvm.edu/it/