Re: Best Practice Internet Access Policy for Company Visitors

Re: Best Practice Internet Access Policy for Company Visitors

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Re: Best Practice Internet Access Policy for Company Visitors PA Bear 07-25-2007
Posted by PA Bear on July 25, 2007, 11:13 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Forwarded to Security and IE Security newsgroups via crosspost.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.org

Marcus wrote:
> I realise this is probably not the right place to ask this , however Im
> trying to find out what the best practice is to allow company visitors to
> gain access to the internet.
>
> Currently we have wired ADSL/SDSL and we have a Wireless network (WPA-PSK
> [TKIP]). The subject has come up on how I should manage Internet access
> for
> visitors. So I was wondering what the best practice is for this ?
>
> Options :-
>
> 1) Give them wireless access (but that would mean giving them our Wireless
> key)
> 2) Give them wired access that would mean they require a lead, and are
> connected to our main switches and would be assigned ip etc..
> 3) Provide them with a laptop and a visitor login
> 4) Internet access is not an option
>
> Any Advice or point in the direction appreciated
>
> Many Thanks
>
> Marcus


Posted by Steve Riley [MSFT] on July 25, 2007, 3:15 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I like #4 -- if visitors don't require Internet access when in your office,
don't provide it.

But if they do, then my preference is to use a separate wireless network.
Position this outside your firewall so that it's connected only to the
Internet. And don't worry about putting any WEP or WPA(2) on it. Treat it
like a public network at a café or hotel, and make sure your visitors know
this.

Steve Riley
steve.riley@microsoft.com
http://blogs.technet.com/steriley


> Forwarded to Security and IE Security newsgroups via crosspost.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE, OE, Security, Shell/User)
> AumHa VSOP & Admin; DTS-L.org
>
> Marcus wrote:
>> I realise this is probably not the right place to ask this , however Im
>> trying to find out what the best practice is to allow company visitors to
>> gain access to the internet.
>>
>> Currently we have wired ADSL/SDSL and we have a Wireless network (WPA-PSK
>> [TKIP]). The subject has come up on how I should manage Internet access
>> for
>> visitors. So I was wondering what the best practice is for this ?
>>
>> Options :-
>>
>> 1) Give them wireless access (but that would mean giving them our
>> Wireless
>> key)
>> 2) Give them wired access that would mean they require a lead, and are
>> connected to our main switches and would be assigned ip etc..
>> 3) Provide them with a laptop and a visitor login
>> 4) Internet access is not an option
>>
>> Any Advice or point in the direction appreciated
>>
>> Many Thanks
>>
>> Marcus
>

Posted by S. Pidgorny on July 26, 2007, 4:02 am
If you were  Registered and logged in, you could reply and use other advanced thread options
The public access network is quite easy to set up with any modern wireless
infrastructure - use separate SSID with no security, place on a separate
VLAN, route outside of the corporate network. All same access points and
controllers are used.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *


>I like #4 -- if visitors don't require Internet access when in your office,
>don't provide it.
>
> But if they do, then my preference is to use a separate wireless network.
> Position this outside your firewall so that it's connected only to the
> Internet. And don't worry about putting any WEP or WPA(2) on it. Treat it
> like a public network at a café or hotel, and make sure your visitors know
> this.
>
> Steve Riley
> steve.riley@microsoft.com
> http://blogs.technet.com/steriley
>
>
>> Forwarded to Security and IE Security newsgroups via crosspost.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-Windows (IE, OE, Security, Shell/User)
>> AumHa VSOP & Admin; DTS-L.org
>>
>> Marcus wrote:
>>> I realise this is probably not the right place to ask this , however Im
>>> trying to find out what the best practice is to allow company visitors
>>> to
>>> gain access to the internet.
>>>
>>> Currently we have wired ADSL/SDSL and we have a Wireless network
>>> (WPA-PSK
>>> [TKIP]). The subject has come up on how I should manage Internet access
>>> for
>>> visitors. So I was wondering what the best practice is for this ?
>>>
>>> Options :-
>>>
>>> 1) Give them wireless access (but that would mean giving them our
>>> Wireless
>>> key)
>>> 2) Give them wired access that would mean they require a lead, and are
>>> connected to our main switches and would be assigned ip etc..
>>> 3) Provide them with a laptop and a visitor login
>>> 4) Internet access is not an option
>>>
>>> Any Advice or point in the direction appreciated
>>>
>>> Many Thanks
>>>
>>> Marcus
>>



Posted by James Matthews on July 25, 2007, 4:46 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I Would recommend hiding the SSID broadcast

--

http://www.goldwatches.com/Watches.asp?Brand=55
> Forwarded to Security and IE Security newsgroups via crosspost.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE, OE, Security, Shell/User)
> AumHa VSOP & Admin; DTS-L.org
>
> Marcus wrote:
>> I realise this is probably not the right place to ask this , however Im
>> trying to find out what the best practice is to allow company visitors to
>> gain access to the internet.
>>
>> Currently we have wired ADSL/SDSL and we have a Wireless network (WPA-PSK
>> [TKIP]). The subject has come up on how I should manage Internet access
>> for
>> visitors. So I was wondering what the best practice is for this ?
>>
>> Options :-
>>
>> 1) Give them wireless access (but that would mean giving them our
>> Wireless
>> key)
>> 2) Give them wired access that would mean they require a lead, and are
>> connected to our main switches and would be assigned ip etc..
>> 3) Provide them with a laptop and a visitor login
>> 4) Internet access is not an option
>>
>> Any Advice or point in the direction appreciated
>>
>> Many Thanks
>>
>> Marcus
>


Posted by Malke on July 25, 2007, 7:43 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
James Matthews wrote:
> I Would recommend hiding the SSID broadcast
>

That isn't a good security solution since the idea is to protect the
company network. The OP's #4 option as expanded upon by Steve Riley is
the best answer.


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Similar ThreadsPosted
Allowing outside users access to company Intranet (anonymous) January 16, 2007, 10:39 am
Best Practices Group Policy Internet Explorer August 10, 2005, 4:26 pm
Remote Access Policy and Dial-in Tab December 5, 2005, 1:00 pm
MS Active sync and Internet access July 2, 2005, 3:25 pm
Allowing Internet Access to Programs. September 2, 2005, 9:44 pm
Internet access without entering the password September 7, 2005, 2:28 pm
Re: Disable Internet access and USB ports October 26, 2005, 9:35 pm
How to deny access to some internet sites November 10, 2005, 8:40 am
RE: Disable Internet access and USB ports February 25, 2006, 10:05 am
Internet Access fails after VPN established May 20, 2008, 7:04 am

The site map in XML format XML site map

Contact Us | Privacy Policy