Employees using company accounts on personal devices

Posted by TheDongles@reddit | sysadmin | View on Reddit | 11 comments

So I’m banging my head against the wall trying to figure out if I’m wearing my tinfoil hat without realizing it. I’ve had multiple employees recently tell me they access their work email, slack, and one drive/dropbox accounts on their personal pcs. These folks have company issued laptops, and I’ve seen their personal devices, they are often 5-6 year old HP pavilions. I can’t figure out why they want to do this, but this seems like a big security issue. Some of these folks work in accounting, or have access to PII/sensitive data. However I’m not sure how to even attempt to enforce this. We use a hosted exchange for email, slack for messaging, and Dropbox for shared docs. From what I can see these is not much I can do in terms of access controls in any of these. Thoughts?

Reply to Post

11 Comments

[-]

itguy9013@reddit

First, what does your policy say? Do you have an Acceptable Use Policy that says that users can't access systems on personal devices? Without that (and the accompanying executive buy-in) it doesn't matter. Second, you need to have some way to control users access to the apps in question. The answer today is typically forcing everything through an Identity Provider (like Okra or Azure AD) and then using controls within that IdP to control the devices that are able to access it.

[-]

TheDongles@reddit (OP)

Great question, I’ll get back to you once we have an acceptable use policy 😂😂 we’ve spent the majority of this past year putting policies in place we probably should have had for at least 10 years. We’re a 12 year old company that grew pretty fast and the ma and pa shop sort of vibe has just recently been challenged. I’m going to work on putting this together, I think our management would have buy in on this pretty easily, it’s really a lot of them not knowing what we are missing. Interesting, I did not think of that! We do have an Azure AD, I’ll have to dig into that to see what I can do. Thanks!

[-]

JrSys4dmin@reddit

Take a look into the conditional access policies within the Entra (Azure AD) portal. You're looking for a "grant" condition to restrict access to only compliant devices.  You'll also want to setup a compliance policy and also restrict how devices can enroll in Intune.   This article is a great start: [Require compliant, hybrid joined devices, or MFA - Microsoft Entra ID | Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-compliant-device)

[-]

zeliLoveScience@reddit

Which is sadly a premium only feature, it might not be available. But yeah, easiest way is to move everything into Office/Microsoft 365. Slack to Teams, dropbox to SharePoint or Azure Files, On-prem Exchange to Exchange Online. Buy appropriate licence to have the security features, including Defender for Endpoint or Defender for Business and Intune, define the policies what makes a device compliant, eg EntraID joined, Defender and firewall is active, only company approved applications are present, etc. Then make the said conditional access and say, only compliant devices are allowed to access certain resources. And MFA, MFA for everything and everywhere, preferably the first party MS App. Dependent on the size and expected growth of the company and assuming they wouldn't need and on-prem infrastracture otherwise, Microsodt 365 is a good way to go about it. Find an MS partner and they'll be more than happy to help.

[-]

TheDongles@reddit (OP)

Why preferably the first party MS Authenticator? Other than its recent change to be the default for new users I have not had a lot of experience with it. I’ve had murky results with getting users to be compliant with a personal device.

[-]

JwCS8pjrh3QBWfL@reddit

Push notifications with number matching, passwordless authentication. The ultimate for authentication is just doing security keys like a yubikey, but having to source and maintain those is its own issue.

[-]

TheDongles@reddit (OP)

So it appears they did include an acceptable use policy in our employee handbook that is on its first edition, and 6 months old. It’s incredibly vague and doesn’t cover this. Turns out they actually put in a lot of vague entries regarding IT policies, many of which don’t even apply to us. I think they may have copy and pasted another companies handbook for about of these 🤦

[-]

Nightflier101BL@reddit

AUP policies first that are strictly enforced first. In my case, separate VRF for BYOD and personal devices, DNS server dedicated inside that VRF. Terminate at the firewall with strict policies out to the internet only. Another VRF for use/access to internal resources with a company issued devices only. This is a current pain-point for me and it’s a project Im currently fine-tuning. My setup includes a number of VRFs for different purposes, all terminating in a zone on the firewall. Data, services, DMZ, etc. The wireless networks need some fine tuning. Cleaning up a big mess left behind by previous engineers. This is a school district which makes this all that much more important.

[-]

Employees using company accounts on personal devices

Reply to Post

11 Comments

itguy9013@reddit

TheDongles@reddit (OP)

JrSys4dmin@reddit

zeliLoveScience@reddit

TheDongles@reddit (OP)

JwCS8pjrh3QBWfL@reddit

TheDongles@reddit (OP)

Nightflier101BL@reddit

Eviscerated_Banana@reddit

_BoNgRiPPeR_420@reddit

AppIdentityGuy@reddit