3 ms·
I've never heard of this in financial services or network infrastructure. It doesn't even sound sensical; if your employer wants a secure LAN, they need to prov
by ndriscoll 3y ago
I've never heard of this in financial services or network infrastructure. It doesn't even sound sensical; if your employer wants a secure LAN, they need to provide a device that treats your home network as a WAN (sort of like a travel router), and your work computer should be configured to only connect to that device. Otherwise you're probably on a network with e.g. TVs, which are definitely malicious.
- patrakov 3y agoI never said that this makes sense or that it was enforceable - yet this is what you get when your company is infected by checklist-based compliance people and if an important customer regularly sends these checklists as a condition of continuing the contract. I am not permitted to name this former employer because this would allow hackers to create targeted phishing emails and social engineering attacks against other people working there.
- ndriscoll 3y agoCompliance with what? I've never heard of this as part of FedRAMP, PCI, SOC2, or FINRA requirements. Another user hasn't heard of it in an ITAR restricted context. I don't see how you could ever pass an audit if employees' personal devices are in-scope. You could never check all of the other boxes you need. The router public IP requirement in particular is an impossible one. You don't control what address your ISP gives you. No checklist is going to have an item for some random unaffiliated third party. They might be stupid, but not that stupid.
- patrakov 3y agoI have never asked where these requirements come from. Possibly, they are just the whims of that customer. To me, they seem to be written as a windy way to require connecting through a mobile hotspot managed by the operator.