TechRepublic - Stick a dagger through my heart!

Why are they EVIL in your opinion. I would like to understand this. I saw a commercial for them and was thinking they had to be breaking every Info Sec rule in and out of the book.

To prevent users from installing [i]GoToMyPC[/i] on their computers, the user has to be a restricted user, which, in many cases, isn't the best scenario. In many companies (including mine), there's good reason to give most users administrative privileges, in which case, they can install this software, via the Internet, onto their computers so they can access it from the outside.

If any of my users are approved for outside access, and many are, I want them to go through the established VPN, not some third party software that circumvents the process of approving and defining those users, and configuring the VPN accordingly. Moreover, these users can then access their HOME computers from work, doing day-trading in the stock market, surfing for porn, or whatever else they might do from home, all bypassing any company safeguards or policies.

There is a way to block [i]GoToMyPC[/i] in a router, but those [b]EVIL people[/b] at [i]GoToMyPC[/i] can, and do, change IP addresses at will, thereby circumventing any router block a company might define. Every time I see a way to block them, I see something else they do to get around it.

The bottom line is that the company, not the users -- [b]and especially not any third-party company like [i]GoToMyPC[/i][/b] -- should decide who has remote access to and from the company computers; and [i]GoToMyPC[/i] is designed to do just that.

It's kinda' like the radar detector of remote access software, and I'm the highway patrolman trying to keep them from speeding on my little corner of the information superhighway.

I either did not get that advert or didn't see it.

Glad you said something- New thing to block for.

Our end users also have admin privelege. We like it when we facilitate people in the successful completion of their jobs. But we're a HIPPA shop- we can't have that rouge running about.

Thanks for the heads up. I know what I will be doing tomorrow.

that?s how you slow someone down without de-motivation. Injury and insult maybe but the spirit remains intact.

Group policy can be used extremely effectively meaning that only the Administrator needs full administrator privates. But this is dependent on having the [b]time[/b] and skill to set it up properly (tailoring exact permissions and policies to groups and individual users).

Whist there is no shortage of skills from people here on TR, who has the time to properly set up GP? So it?s easier to give people local admin permissions and get on with more important work.

As for end users, after one week of counselling and they still want a laptop I inform them of my company's policy that they are free to buy their own and rent it back to the company. I also show them a few 5 or 6K ($AU) models (laptops) approved by the company if I need further dissuade them.

Most people around here who have been issued with a desktop are happy with it as they generally need the extra grunt. Try pointing out the benefits of a desktop, such as it makes it difficult to take work home. If that doesn?t work you could always threaten, coerce or beat them to death with the KB.

Hi,

I'm not saying that the 'GotoMyPC' is the best service as I haven't used them.

However, they do offer an easy to use remote service, from which I gather is pretty secure too.

The company must have something going for it, being CITRIX owned.

"Citrix GoToMyPC is the leading provider of computer remote access for individuals, small- and medium-sized businesses and enterprises." Quote from website.

Ryan

.....with group policies. However, I believe some offices (including mine) are unique in that the users are professionals in their own right (in their chosen field), and must have a lot of flexibility to expand and explore a lot of things.

Our office is very open concerning technology, and it hinders business if we tie people's hands. Group policies could certainly be defined, but we don't want to be constantly adding and changing those policies. For the most part, it works very well, as everyone is responsible enough to manage it. There's that one person out of ten, however, that might take advantage and stretch the limits. We don't want to limit the abilities of the nine, so to speak, in order to reign in the one. When you support a group of professionals, such as lawyers, insurance agents, architects, engineers, accountants, realtors, etc., they don't want to be limited in what they can and cannot do, and in most cases, rightfully so.

and how did you know I was getting ready to beotch about the gotomypc type sites that punch a major hole through the security?

Mind you, I didn't know that TR had made a deal with the devil, but I think some tweeks to the firewall to block that site are in full order.

The connection goes through their server. Just block all traffic to and from that address.

You MAY need to install this and run it with a network analyzer to be sure where you are connecting too, to know where to block.

If you DECIDE to stand in the middle of the road, you have put yourself at risk, GREATLY increasing the chances of a "disaster".

Many IT personel don't know a lot about security, yet you would hand over that responsiblitiy to an end user to make without the knowledge of the IT staff?

Nothing short of insane if not controlled by SOMEONE that runs the network, and this service is DESIGNED and marketed to the zero level end user that doesn't have a clue about Anti-virus and firewalls. No exception to THIS. Insane.

And then we act surprised when we see the number of compromised systems has gone up....

Most of the, ha ha, "older" guys and gals at our company are very responsible about security. It's the new 20 something hires we have problems with and GotomyPC.

As you say Tigger Bad ju-ju Very Bad.

We had 3 new hires right from college decide they wanted to have remote access and didn't like the hoops they had to jump through and install Gotomy PC. We only found out because one of the idiots happened to not be in one day and couldn't get to his desktop [is was turned off] and called us wondering why. We wondered how he was remoting in when he's not authorized to.

Its BAD software for a business to have their users use it. We ended up making a corporate policy [fireable offense] baring the use of GotomyPC on any company computer to get the new hires to get the hint. Do not use this.

Okay, I'll concede that there are probably ways to block the [i]GoToMyPC[/i] service, but it's not exactly cut-and-dry, and I still maintain that a consequence of the service, whether that be intentional or unintentional, is to circumvent security policies established at many companies.

A couple of interesting articles:

http://www.networkworld.com/columnists/2002/1028letters.html

http://searchsecurity.techtarget.com/ateQuestionNResponse/0,289625,sid14_gci861795,00.html

Edited to add the following:

I will add this. Citrix will actually [b]HELP[/b] a company block users from accessing the [i]GoToMyPC[/i] service, but there's a catch. You'd have to [b]BUY[/b] the corporate edition of the service. It sounds like coercion to me.

http://www.citrix.com/English/ps2/products/qa.asp?contentID=13994&faqID=14185&title=GoToMyPC+Corporate+Technology+Overview

However, sometimes you can't get around to giving users admin rights (arcview comes to mind). There are software packages that will not run unless the user is admin and there are certain politics involved with some users.

The problem, over all, is that sometimes we have to break the rules in order to give our users the ability to work.

... as much as possible, i'm not familiar with arcview. but through the use of Group Policies and NTFS permissions you should be able to obtain a runnable environment with a standard user account. the last place i worked the did that and the people's machines who had admin rights for them "political" or "ability to work" reasons were all infected with spyware and the such, which with them have admin rights some malware could run on the system with the elevated admin priviledges. i dont even run as an admin i have a standard user account that i use then when i need to install software i do a run as, and same thing when i need to make configuration changes. there has only ever been one time where i needed to set someone up as an admin, i believe it was with UPS worldship on the server machine which was in shipping, and that was because the program spread out across so much of the system that it just wasn't worth it to get it all down, but i restricted what they could do on that machine they couldn't install any other software.

I have it blocked with Websense. If they want to go to their PC, they can drive there. TR needs to have ads that promote security. That ad belongs on AOL.

Miscellaneous people rule! B-) We'll let you go this time. :^0

I wholly concur, Max.

But I hate to think I would do the same thing. When it comes to business, I have extremely high ethics and standards, bugt I still like the green stuff. That's a damn fine line we have to learn to walk.