Ok, so we've seen the questions about allowing developers different amounts of latitude when locking down or deploying machines, but what about their internet access? Do you allow unlimited NATing of their workstations? Do they have to at least run through a proxy to log their access? Do they run through a proxy that filters the content that is returned to them? Or do you simply restrict their access as needed?
My personal opinion is to run them through a proxy with no limits on the sites visited, but filter the content as it's delivered to prevent malicious code from crossing into the "inside". Useful data - ISO images, programs, etc. are not limited, but are scanned.
What is the best resolution to this? Am I wrong? Should developers just have whatever access they want at any time?
For the record, I am a Generalist. That is, I am both the proxy admin and the resident ERP developer where I work. And yes, my access is logged and filtered, although I can go anywhere I please. I've seen both sides of this issue, but I have yet to hear a good reason why letting people run wild with your internet resources is a good thing. And not everyone has enormous amounts of bandwidth - my work still uses a T1 to connect, and it can fill up very, very quickly.
(Sigh) Yet Another Edit:
Ok, easy there, put down the pitchforks and torches...I mention "restrict" and everyone suddenly sees the world in black/white, not a slight shade of gray. This isn't a question of either/or, it's a question of how much, as in how far is acceptable to everyone involved?
So, after some time to stew about this question, it's clear that the crux of this is a cultural issue, not a technical one. I'm not a big fan of having to filter everything - I'd much rather get people what they need when they need it - but I just remembered that there are little things that can get in the way of this.
- HIPPA rules are not terribly keen about exposing sensitive data. Openning up tunnels and the like create potential exposure vectors for data leaks.
- There are some places with rules so draconian that just the attempt to open a tunnel would result in immediate termination without question. I'm not a big fan of this either - it's a mean-spirited mentality - but these places exist.
This was, by far, the most hated question I think I've ever seen.
It touched so many raw nerves that people may be needing novocaine for a few weeks to get over this.
The question's intent was innocent enough - to find out if this is a common practice - and as it turns out, it's a practice that's hated. I'll be sure to not mention such things in polite company. :)