What, if any, steps do you take to minimize the potential of client personal computers being subject to e-discovery during potential lawsuits when their personal home computers are used for work?
What I have so far:
Don't allow remote access with personal devices.
Only allow web-based email access (through OWA).
Allow web-based VPN access to files and email w/out remote desktop or citrix support.
Allow full-blown VPN access.
- Doesn't seem practical.
- Nothing beyond cookies is stored on the local client machine.
- Access to files via Web-based VPN means they're downloadable to client machine.
- Just like the computer is sitting on the network. (From an e-discovery perspective is there a difference between web-based VPN and client or firewall-based VPN?)
Our users are understandably blinky about their personal computers being subject to e-discovery. Has anyone had to go through e-discovery because of a lawsuit? What policies do you have in place regarding this?
Edited to add
Not using their personal home computers for work is not really feasible. There are instances when they don't anticipate being sick, therefore do not lug home a work computer, and need to work from home through the vpn.