Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to disable prarallel network connections on workstation, when workstation is connected to corporate LAN?

I want to avoid users bypassing Internet access policies by concurently connect to LAN and 3G/Hotspot.

We have many developers and they have local administrator rights on workstations. Developers should be able to connect virutual networks (VMware/VirutalPC/Hyper-V/VirutalBox). Other users should be able to use only one network connection concurently.

share|improve this question
    
As already answered, if they have local administrator rights, you have no choice but to trust them. Also: if people are trying to bypass your internet access policies, you should ask yourself why and perhaps reconsider whether those policies are reasonable or not. –  Harry Johnston Apr 2 '12 at 1:01

2 Answers 2

domain and server isolation would help with this( but not eliminate the problem). Additionally don't give them admin rights over their workstations. Only give them admin rights to development vms on their machines. You can also use applocker or bit-9 to futher restrict what applications can be used or installed.

share|improve this answer
    
Revoking local administrator access will be hard. They create applications using different technologies, so they need different tools. Historically all business units were creating and supporting application development enviremoments for certain projects (buying hardware, installing and configuring hardware), IT department supplied workstations only with basic business applications and developers installed IDEs, application servers needed libraries. Our IT is not ready to install, configure and support all these applications to over 1000 developers. –  sumar Mar 28 '12 at 21:57
    
Domain and server isolation in interesting concept, but as I understant, it doesn't solve my concern. It could help us to isolate corporate applications from 3rd party computers. What I really afraid is situation, when someone connected to corporate network from computer meeting policy requirements and configuration starts new connection bypassing all internet access policies. If they are smart enough, they could share access to corporate network by starting NAT/VPN and allowing unauthorized 3rd parties to connect to corporate network. –  sumar Mar 28 '12 at 22:04
    
So as far as the admin rights go, that's a much more involved process but without it, there is very little you can do to resolve the problem by definition. Domain and server isolation will stop any traffic that does not come from domain members regardless of origin, however since they have admin rights they can still add drivers for devices that wouldn't normally be network devices (like mounting vhds for storage on USB drives) as well as change the policies to allow additional connections. –  Jim B Mar 29 '12 at 3:25
    
You should also realize that nowadays I can fit an internet connection in a thumbdrive. Without domain and server isolation, and privilege control, I don't need to share your connection, and worry about traffic auditing, I can plug my USB cell modem in and send your info to dropbox. –  Jim B Mar 29 '12 at 3:31
    
I fully understand, that people can fit internet connection in a thumbdrive (I called it 3G modem). And that is the reason, why I asked this question. –  sumar Mar 29 '12 at 8:21

If you have no control over the remote device, then no, you cannot make it do anything. Unless they're dumb enough to bridge their second connection to your network, you're not going to see any kind of information that might indicate what's going as they are likely to NAT the connection anyway if they were to abuse it in such a way.

So... create a POLICY... and if find that they violate it you walk them out the door.

You could take other approaches... 802.1X, etc, but that still doesn't give controlling authority of the remote device that you're trusting onto your network.

share|improve this answer
    
I have some control over these devices - they are members of Active Directory. Policy (rules) is defined in Information Security Policy and approved by management. But it doesn't prevent mailcious users to violate it. And I'm looking for a prevention solution. 801.1X (and other NAC policies) are good for adding protection layer from 3rd party and noncompliant devices. Maybe there are custom SHV to NAP, which could check, if workstation has multiple active connections. Enforcing policy and rules is hard in large organization if people doesn't care about information security. –  sumar Mar 28 '12 at 22:20
1  
Yes... NAP potentially, or maybe even some kind of device that monitors for unexpected active IP addresses on a subset of inventoried machines? –  SpacemanSpiff Mar 28 '12 at 22:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.