RE: Home laptops on a corporate network

["steven hess" <shess () tampabay rr com>]

I do not know if this would count as "file access" - but a different way to
approach security is to only let them run a remote application on a computer
inside the LAN. 

One possibility - a KVM over IP type of box. Another is the CITRIX type of
access. Note that the file never leaves the location, but by remotely
controlling the application AS IF they were at the home base, they could
perform some kinds of work. The would be able to access the application over
a SSL connection, view and manipulate the files, but could be prevented from
downloading data. 

Just a thought. 

Steven Hess
Chief Engineer 
WFTT -TV


-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of Kurt Buff
Sent: Tuesday, May 08, 2007 12:58 PM
To: Adam Rosen
Cc: security-basics () securityfocus com
Subject: Re: Home laptops on a corporate network

They're bound by HIPAA, and still want this? The approach that you
haven't thought of is to talk with their corporate counsel, and ask
him to read HIPAA, and advise your clients about liability.

Tell them to put down the crack pipe and step away. This is completely
against the intent and letter of HIPAA.

Insanity.

The company where I work now doesn't need HIPAA compliance, and it's
strictly against company policy to connect personal devices to the
corporate network.

Just for fun, I'll mention 3 OSS NAC packages, but I still don't think
it's a good idea.

http://ungoliant.sf.net

http://netreg.sf.net

http://freenac.net

Kurt

On 5/8/07, Adam Rosen <ajrosen () buffdata com> wrote:
> Hi all -
>
> I have a client who wants to allow employees to use their own laptops on
> the corp. wireless network so that they can access files on the server.
> I gave them a run-down of options (allow usual file sharing [bad idea],
> MS VPN quarantine [complex scripting], SharePoint services [not bad, but
> no printer access] and third party quarantine options).
>
> Aside from any other ideas someone may have, it seems to me that the
> third party compliance software/appliance, while probably being the most
> versatile is pretty costly. I found a couple starting at about $20K.
> Does anybody know of any devices that are significantly cheaper and can
> allow my client to do what they want? I should mention that they are
> bound by HIPAA regulations here. Or any approaches I haven't thought of?
>
> Thanks for the input.
>
> Adam
>
> Adam J. Rosen
> President
> Buffalo Data Solutions
> 716-913-6312
> ajrosen () buffdata com
> http://www.buffdata.com

Attachment: smime.p7s
Description: