3 ms·

Please note that hosting a publicly accessible server in your room at home is specifically prohibited by some employers in heavily regulated industries, and if

Please note that hosting a publicly accessible server in your room at home is specifically prohibited by some employers in heavily regulated industries, and if found, this may result in a large fine (enough to cover the company security re-audit cost) and termination. They even prohibit having a public IP on the router, having IPv6 support, having firmware other than the manufacturer-supplied one, and even having access to the router (i.e., it's the manufacturer and the ISP who should be responsible for security updates, for ensuring that there is absolutely no way for attackers to enter the home network by means of routing, and for the fact that you cannot screw that up). Having a server for your own use from within the home network is fine.

theideaofcoffee 3y ago
Won't someone think of the employers.
Gelob 3y ago
What are you talking about
hooverd 3y ago
Which industries?
dharmab 3y ago
I work for an employer subject to ITAR and have never heard of this requirement.
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
nicolaslem 3y ago
I don't know about the prohibited part but that's exactly how LinkedIn got hacked. See https://darknetdiaries.com/transcript/86/ https://darknetdiaries.com/transcript/86/ for details.
falqun 3y ago
Could you give a hint to the employer or the industries you talk about? Surely if an employer wants to very very securely lock down the workspace they would just tell employees to come to office and design that like a fortress, right? I mean I know companies that have metal condensed onto the windows to prohibit mobile reception, but why regulate your home like that?
ludjer 3y ago
You do know a router requires a public IP to even work you cannot not have a public IP. Either the people who rite those rules have no idea about computers or you miss read something.
lmm 3y ago
[flagged]
ndriscoll 3y ago
I've never heard of this in financial services or network infrastructure. It doesn't even sound sensical; if your employer wants a secure LAN, they need to provide a device that treats your home network as a WAN (sort of like a travel router), and your work computer should be configured to only connect to that device. Otherwise you're probably on a network with e.g. TVs, which are definitely malicious.
- patrakov 3y ago
  I never said that this makes sense or that it was enforceable - yet this is what you get when your company is infected by checklist-based compliance people and if an important customer regularly sends these checklists as a condition of continuing the contract. I am not permitted to name this former employer because this would allow hackers to create targeted phishing emails and social engineering attacks against other people working there.
  - ndriscoll 3y ago
    Compliance with what? I've never heard of this as part of FedRAMP, PCI, SOC2, or FINRA requirements. Another user hasn't heard of it in an ITAR restricted context. I don't see how you could ever pass an audit if employees' personal devices are in-scope. You could never check all of the other boxes you need. The router public IP requirement in particular is an impossible one. You don't control what address your ISP gives you. No checklist is going to have an item for some random unaffiliated third party. They might be stupid, but not that stupid.
    - patrakov 3y ago
      I have never asked where these requirements come from. Possibly, they are just the whims of that customer. To me, they seem to be written as a windy way to require connecting through a mobile hotspot managed by the operator.
icedchai 3y ago
1) I somehow doubt this is true. 2) If it was, it would not be possible to enforce. People are adding and removing stuff on their home network all the time. What if your roommate's machine gets compromised? 3) Wouldn't it be simpler for them to send out a VPN appliance and treat the home network as untrusted?
danans 3y ago
Organizations should treat all physical networks, including the ones in their own offices, as untrusted. If they are trusting an internal network these days, they are doing something wrong.
jve 3y ago
Others already expressed surprise on what you wrote and none has confirmed... But here is some fun fact: when I was working at poultry plant (well, chickens laid eggs) I had a clause within contract that I cannot have my own chickens... I guess because of increased risk to introduce diseases for the plant chickens?!

theideaofcoffee 3y ago

Won't someone think of the employers.

Gelob 3y ago

What are you talking about

hooverd 3y ago

Which industries?

dharmab 3y ago

I work for an employer subject to ITAR and have never heard of this requirement.

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

nicolaslem 3y ago

I don't know about the prohibited part but that's exactly how LinkedIn got hacked. See https://darknetdiaries.com/transcript/86/ https://darknetdiaries.com/transcript/86/ for details.

falqun 3y ago

Could you give a hint to the employer or the industries you talk about? Surely if an employer wants to very very securely lock down the workspace they would just tell employees to come to office and design that like a fortress, right? I mean I know companies that have metal condensed onto the windows to prohibit mobile reception, but why regulate your home like that?

ludjer 3y ago

You do know a router requires a public IP to even work you cannot not have a public IP. Either the people who rite those rules have no idea about computers or you miss read something.

lmm 3y ago

[flagged]

ndriscoll 3y ago

I've never heard of this in financial services or network infrastructure. It doesn't even sound sensical; if your employer wants a secure LAN, they need to provide a device that treats your home network as a WAN (sort of like a travel router), and your work computer should be configured to only connect to that device. Otherwise you're probably on a network with e.g. TVs, which are definitely malicious.

patrakov 3y ago
I never said that this makes sense or that it was enforceable - yet this is what you get when your company is infected by checklist-based compliance people and if an important customer regularly sends these checklists as a condition of continuing the contract. I am not permitted to name this former employer because this would allow hackers to create targeted phishing emails and social engineering attacks against other people working there.
- ndriscoll 3y ago
  Compliance with what? I've never heard of this as part of FedRAMP, PCI, SOC2, or FINRA requirements. Another user hasn't heard of it in an ITAR restricted context. I don't see how you could ever pass an audit if employees' personal devices are in-scope. You could never check all of the other boxes you need. The router public IP requirement in particular is an impossible one. You don't control what address your ISP gives you. No checklist is going to have an item for some random unaffiliated third party. They might be stupid, but not that stupid.
  - patrakov 3y ago
    I have never asked where these requirements come from. Possibly, they are just the whims of that customer. To me, they seem to be written as a windy way to require connecting through a mobile hotspot managed by the operator.

icedchai 3y ago

1) I somehow doubt this is true. 2) If it was, it would not be possible to enforce. People are adding and removing stuff on their home network all the time. What if your roommate's machine gets compromised? 3) Wouldn't it be simpler for them to send out a VPN appliance and treat the home network as untrusted?

danans 3y ago

Organizations should treat all physical networks, including the ones in their own offices, as untrusted. If they are trusting an internal network these days, they are doing something wrong.

jve 3y ago

Others already expressed surprise on what you wrote and none has confirmed... But here is some fun fact: when I was working at poultry plant (well, chickens laid eggs) I had a clause within contract that I cannot have my own chickens... I guess because of increased risk to introduce diseases for the plant chickens?!