Home / server / Questions / 68250
Accepted
Brandon
Asked: 2009-09-24 19:02:05 +0800 CST

Remote Access Without Explicit Permission: Convenience or Liability?

  • 772

For outsourced professional IT remote support, one habit most new technicians get into is the "instead of getting the user to start up remote support each time, I'll go ahead and install LogMeIn / GoToMyPC / Remote Desktop / whatever so that if they call again, I can just jump on and help them".

This of course opens up a potential liability because a client PC on a network that we don't own is being accessed without a user explicitly providing permission by clicking a "Yes, allow technician to control my PC" option.

I realize the rules totally change when you're an IT admin over a network that you "own", but this is outsourced IT support. Just curious what others' policies are. Is this an acceptable practice for convenience and I'm turning into one of those "security is more important than anything" people, or is this really a liability?

privacy

2 Answers

  1. I suppose it's really going to come down to the type of business, and to whom you're outsourcing.

    • How much do you trust said outsourcing group/technician?
    • How urgent is it for them to be able to fix anything RIGHT NOW without user intervention?
    • How important are the workstations they will have access to?
    • What else can they potentially do in the way of Bad Things™ either intentionally or unintentionally whilst performing support?
    • Have you outsourced all of IT, or just desktop support?
      • ie, are they also handling server support for you?
    • How much would it cost to "de-outsource" and bring support in-house?

    Personally, I'd not allow them to pre-install any management tools unless they're doing all of my IT work.

    • 1
  2. Best Answer

    We handle this by requiring the end-user to exlicitly authorize a session via a dialog box with our remote control software. There are a few other policies regarding this that are signed off on and made available to end users and IT folks.

    You are really putting yourself in a bad position if you don't do that. Users may have sensitive information, and putting technicians in positions where they can impersonate users is a really, really bad idea.

    • 0