Opinion on remote contro from personal device

Posted by itmgr2024@reddit | sysadmin | View on Reddit | 26 comments

In general what’s your opinion on the practical risks of allowing users to remote control GPU desktops in the office from a personal device using a software like logmein or other. Assuming you could use things like AD/entra password, MFA, mac address restriction, no saved credentials. I understand that there’s the greater possibility of the personal machine getting compromised and lacking company security products. Given that how hardcore would you be on this topic, would you fight to shut off personal computer access for everyone and issue dozens of new devices mainly for remote control? Thanks.

Reply to Post

26 Comments

[-]

CeBlu3@reddit

agree - give them a company laptop, or maybe VDI

[-]

itmgr2024@reddit (OP)

do you think VDI from a personal device is safer than remote control from a personal device?

[-]

CeBlu3@reddit

Hmmm… I would really need to look into it, that’s why I said ‘maybe’ tbh. When I say VDI I really mean a cloud desktop, whatever Microsoft and AWS call them these days. When I first looked at them, I thought they were a decent option. But use case is somewhat limited. For example, if your use case is engineering who need to run simulations and just want to check on the status from home occasionally, VDI is probably not the right answer.

[-]

Next_Information_933@reddit

No fucking way.

[-]

hihcadore@reddit

Wouldn’t do it. You can authenticate with as many forms of MFA as you’d like, but if the host is compromised, the owner doesn’t have control of their system. I’d prefer the business buy refurbished 400 dollar laptops over letting users use their own personal devices like that.

[-]

itmgr2024@reddit (OP)

Thanks for your reply. Would you say that the remote control is inherently less safe than a company VDI like Horizon from a personal device or the same?

[-]

hihcadore@reddit

You’ve got to be really careful and know what you’re doing. I think if you have to ask the question, it’s not something you want to mess with. Here’s a good blog you might like to read [1pass article on BOYD and VDI](https://blog.1password.com/can-vdi-secure-byod/)

[-]

sryan2k1@reddit

VDI for BYOD is extremely popular, this is no different.

[-]

hihcadore@reddit

It’s a solution, but not one I like. Users are logging in with an unmanaged device. Even with a perfect setup, you’re not getting the same protection you would from a managed device with an enterprise EDR solution, or all that other protections that come into play. You’re opening yourself up to screen-capturing, key logging, credential theft, session hijacking. You can mitigate some of the threats by restricting the clipboard, limiting usb / file redirection, and VDI isolation but still it’s pretty cheap to just buy users a laptop. Then, you’re also going to be on the hook providing support to non-company managed assets. I mean yea my org did it for years. And hated it the whole time. But I get it it’s a solution for some.

[-]

hihcadore@reddit

I agree is a solution. I wouldn’t if I could help it. I hate it when a company pays someone a 45k a year salary but won’t buy them a 600 dollar Dell laptop every five years.

[-]

itmgr2024@reddit (OP)

Do you think BYOD for VDI is safe?

[-]

sryan2k1@reddit

Done correctly the risk is acceptable to most.

[-]

Absolute_Bob@reddit

"to remote control GPU desktops in the office" Huh? Remote access from personal devices will always be a risk, but products like Citrix can reduce it significantly. Strong MFA is absolutely mandatory.

[-]

itmgr2024@reddit (OP)

Desktops in the cubicle or server room that have GPUs in them for CAD applications. Something our standard issue laptops don’t.

[-]

rcp9ty@reddit

Let me chime in here as a system administrator who spent 10+ years of his career with engineers who need dedicated graphics cards and had entire offices working remotely with CAD systems in house. I know how some engineers can be big pita and want their own systems to work at home. This is a huge security risk and if your companies insurance finds out that you're allowing personal devices on your network they might kill the policy or jack it up or just say sorry when your network is compromised by their devices being allowed on the network. Do yourself a favor and get some cheap desktops for them to use at home with two display ports or three if they are whiney engineering types. Put the enterprise grade security on it, monitor it's updates, put remote control software on it so you can control it from the office. If they complain about switching cables from their own setup you can buy display port or HDMI switchers for a couple bucks where they just push buttons to change the inputs. The biggest problem with having them use personal devices connected to the network is their ability to copy work files to their personal devices. This could be engineering templates it could be personal side work that they're using company resources for it could be client lists so that way they can open up their own firm and steal those clients from your company. Having your own security software on a cheap desktop allows you to monitor when a user copies an entire directory. Last year before an employee quit they copied an entire network drive to an external hard drive. If it was a personal device without our corporate security software on it we wouldn't have a clue but because it was a company device we had entire logs of their activities. They went from quitting to being fired and their wife who worked for the company was fired and all of their benefits that they would have got if they quit we're eliminated and they were told that the company lawyers had already been made aware of their activities should they decide to fight the decisions made. Not to mention the lawyers reached out to the next company that the person went to work for and gave them a couple of documents. Bottom line company data is very expensive and desktops can be bought very cheap. My personal favorite resource for desktops and laptops for engineers at home is Dell refurbished. They are all ISF certified to run cad.

[-]

itmgr2024@reddit (OP)

Thank you for the insight. Do you feel just as strongly if it is just remote screen sharing rather than VPN/being on the network. With clipboard and file transfer dosabled. Do you mind me asking you which software you used to track the file copies? on a side note it feels like trying to stop people from copying files is an uphill battle now unless you rigiorously block every kind of cloud storage app.

[-]

Absolute_Bob@reddit

Ah....

[-]

Common-Carp@reddit

I thought this post was an AI hallucination, tbh.

[-]

sryan2k1@reddit

Typically powerful works stations for CAD or similar and want to leverage the (typically) Quadro in it.

[-]

Absolute_Bob@reddit

Yeah, I've just never heard the term "GPU desktops" since literally every functioning desktop I've ever seen has a GPU in it. Not necessarily a discrete performance GPU, but they all have one so it's an odd term to use. Engineering/CAD/Graphic Design workstations is a better term IMO.

[-]

itmgr2024@reddit (OP)

Almost all the other desktops at my company are the book sized micro PCs with only integrated graphics.

[-]

Absolute_Bob@reddit

Well I guess to be fair some/all of those are probably using APU's...but anyway no biggie I was just confused by the terminology.

[-]

sryan2k1@reddit

No issues here. We add their work desktop to Horizon along side the VDI pools. They have to MFA into horizon just like they were using a VDI desktop. We have drive mapping and clipboard redirection disabled if you're using your own machine. I'd never use something like logmein for this. It's not meant for it and performance is garbage.

[-]

itmgr2024@reddit (OP)

Thanks for your reply. Yes we are going to use something else. That’s one of my thoughts, is it less secure than Horizon VDI’s if you can lock it down well enough, disable clipboard and file transfer, etc.

[-]

fr33bird317@reddit

[-]

itmgr2024@reddit (OP)

insightful