Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Cyber Security Awareness Month - Day 25 - Using Home Computers for Work

Published: 2010-10-25
Last Updated: 2010-10-25 16:36:00 UTC
by Kevin Shortt (Version: 1)
6 comment(s)

Today's CSAM topic is Using Home Computers for Work.  I will share with you a simple practice I've been using for quite some time that provides me a couple key protections from myself while keeping me and my employer safe from mingling home equipment with the corporate equipment.

It is common for many people to have company issued laptops, so the mileage may vary on my suggestion.  However, for those who do not use an issued laptop to access the company network and are left to using home equipment to accomplish work for your employer I highly suggest using a some sort of virutal machine software and utilize all access to the corporate network through the inside of that machine.   
 
My home setup for connecting to work consists of our family computer, an iMac (behind a firewall of course) with a VMWare Fusion machine consisting of a basic XP installation that has been fully patched, updated Anti-Virus and any basic software required for connectivity to the company resources. I.e. VPN software, SSH Clients, etc...  Once this VM has been setup, I save a snapshot of it.  When Patch Tuesday rolls by, I update everything and take another snapshot. Most anti-virus can be configured to update when it boots up, and at a minimum I update the image monthly, but sometimes more if I am ambitious.  When I need to use the home computer to connect to work, I fire up my VM and utilize the VM environment for all connectivity to work.  When I have completed my session for work, I power down the VM and rollback to my most recent snapshot.  This practice insures that my computer will not propogate any malware or viruses that my family or I happen to carelessly add to the home computer.  It keeps my risks low and my productivity higher because I always have a fresh installation.
 
I am not a lawyer nor play one on the Internet, but it could also be argued that since a concerted effort is maintained to keep work and home activities separate while using the same the hardware, all legal privacy issues could be bound to only the VM files and not my entire computer. Again, consult your lawyer before believing this to be true.
 
I've only touched upon some of the connectivity risks associated with using home computers for work.  There are many more things to consider.  So please, share with us what you do to reduce or minimize any risks associated with using home computers for work.
 
--
Kevin Shortt
ISC Handler on Duty
 
6 comment(s)
Diary Archives