Re: Need opinions - Work from home/security issues.

[Sandy Harris <sharris -at- DKL -dot- COM>]

sbuttice -at- TRANSPORT -dot- BOMBARDIER -dot- COM wrote:

> We have suggested the following solution:
>
> ... work from home ...
>
> ... HR is worried about security, ...

What do your security people say?

> ... I'm too polite to say what I think of this excuse,

It's not /just/ an excuse. It is a real concern.

> we believe the real reason is a Big Brother issue. They want to see us
here, at
> the office, no matter what.

That may be true as well.

There are solutions for this sort of security problem. None of them are
just
plug-and-play. You need at least: a clear statement of corporate policy,
skilled
analysis of the technical requirements, careful setup, skilled
administration,
end-user training, ...

Basically, its a policy decision. If the company want to support a
secure
work-at-home option, they can, at least for some definitions of
"secure".
It almost certainly won't be cheap, though.

Among the issues you'd need policy on, and tools to implement the policy
for, are:
        transport of data to/from the company, on disk or by wire
        storage on home machine
        family members, roomates etc. using machine
        (Would management buy machines, as they'd have to for in-house
        employees & send them home to solve this?)
        connection to company machines
(Mail me if you need consultants for a thorough analysis.)

Some of the tools you might use include:

PGP, which can encrypt email or files or, I think, whole disks. Latest
version also has an IPSEC (see below) component. http://www.pgp.com

Also consider the open source Gnu Privacy Guard (GPG) equivalent.
http://www.d.shuttle.de/isil/gnupg/

SSH, secure shell, which provides encrypted remote logins.
http://www.ssh.fi or http://www.ipsec.com

IPSEC, Internet Protocol SECurity which encrypts at the network packet
level, so everything passing between two machines can be secured. Linux
version is at:

http://www.xs4all.nl/~freeswan

I wrote its manuals. Comment solicited.

Many firewall products have an IPSEC component. Many support SSH too.
Ask your security or network wizards.

Several Windows IPSEC clients are available now, see compatibility.html
file in FreeS/WAN docs. Windows 2000 is supposed to have IPSEC built in.

 From ??? -at- ??? Sun Jan 00 00:00:00 0000=