Reply to: Multiple Contractors one Remote Access Account

[Fronttoback]

I think you will find the OP has a working from home arrangement and is thinking of outsourcing some work without telling the end client.

[DaveB]

It is not very clear but I assume you have VPN access into the clients site for some sort of support reason? If this is the case you could have a generic VPN but as other people said you need some way of auditing access. The standard way of doing this would be to have some sort of jump server that only has access over the VPN and you would need user specific account on the jump server to get access over the VPN.

From the way it was described I'm guessing it s multiple VPN's, one per client, owned and administered at the client side. Hence the need to get accounts created for each client / contractor combination.

[davetza]

It is not very clear but I assume you have VPN access into the clients site for some sort of support reason? If this is the case you could have a generic VPN but as other people said you need some way of auditing access. The standard way of doing this would be to have some sort of jump server that only has access over the VPN and you would need user specific account on the jump server to get access over the VPN.

[MrMarkyMark]

agree with the idea of using one id is professional suicide.

A lot of people think the same about only having one ID on here







ww

[vetran]

there are tools out there that manage this sort of thing.

I think Teamviewer does.

Get 13 id's set up and then send them a report.Or sell it to them.

If its a VPN then one assumes you are using a key file? Get 13 files created and get them loaded to each VPN server.

agree with the idea of using one id is professional suicide.

[SueEllen]

Surely this sort of thing would also invalidates the Ltd Cos PI insurance

Not necessarily.

It depends what the action causing the problem is e.g. accidental data breach compared to fraud.

One if the issues not mentioned is if an employee deliberately makes a data breach you cannot take disciplinary action against them or sack them as you have no proof which employee did it. If you did take action against an employee you suspected you would find yourself facing expensive employment tribunal costs for discrimination.

[MrMarkyMark]

Surely this sort of thing would also invalidates the Ltd Cos PI insurance









Tt

[mudskipper]

Who says?

Most companies' IT policies.

[northernladuk]

Yes I wouldn't be happy too, the login it's personal and can't be shared for security reasons.

Who says?

[Bee]

Good grief - I wouldn't be happy sharing a login, that's a recipe for a ruined reputation.

Yes I wouldn't be happy too, the login it's personal and can't be shared for security reasons.

[gables]

The LA I worked at would insist that you use named accounts. It may seem like an overhead but it is a valid one.

[SueEllen]

You aren't serious are you?

If one of your employees decides to release information into the public domain or steal it to sell, how are you going to know which individual did it?

Legally while you as a business are responsible for the data breach, the individual person is responsible for a criminal act.

[MrMarkyMark]

Finally, if you ring a client and they are any good, they WILL laugh at you and think you are a bunch of cowboys.

This +1.

[cojak]

Good grief - I wouldn't be happy sharing a login, that's a recipe for a ruined reputation.

[stek]

And what chance have you got of controlling it your end if you don't even know if you are 12 or 13?