Hacker News Reader

Comment by patrakov | Hacker News Reader

Please note that hosting a publicly accessible server in your room at home is specifically prohibited by some employers in heavily regulated industries, and if found, this may result in a large fine (enough to cover the company security re-audit cost) and termination. They even prohibit having a public IP on the router, having IPv6 support, having firmware other than the manufacturer-supplied one, and even having access to the router (i.e., it's the manufacturer and the ISP who should be responsible for security updates, for ensuring that there is absolutely no way for attackers to enter the home network by means of routing, and for the fact that you cannot screw that up).

Having a server for your own use from within the home network is fine.

View on HN

Could you give a hint to the employer or the industries you talk about? Surely if an employer wants to very very securely lock down the workspace they would just tell employees to come to office and design that like a fortress, right? I mean I know companies that have metal condensed onto the windows to prohibit mobile reception, but why regulate your home like that?

I've never heard of this in financial services or network infrastructure. It doesn't even sound sensical; if your employer wants a secure LAN, they need to provide a device that treats your home network as a WAN (sort of like a travel router), and your work computer should be configured to only connect to that device. Otherwise you're probably on a network with e.g. TVs, which are definitely malicious.

I never said that this makes sense or that it was enforceable - yet this is what you get when your company is infected by checklist-based compliance people and if an important customer regularly sends these checklists as a condition of continuing the contract.

I am not permitted to name this former employer because this would allow hackers to create targeted phishing emails and social engineering attacks against other people working there.

Compliance with what? I've never heard of this as part of FedRAMP, PCI, SOC2, or FINRA requirements. Another user hasn't heard of it in an ITAR restricted context. I don't see how you could ever pass an audit if employees' personal devices are in-scope. You could never check all of the other boxes you need.

The router public IP requirement in particular is an impossible one. You don't control what address your ISP gives you. No checklist is going to have an item for some random unaffiliated third party. They might be stupid, but not that stupid.

I have never asked where these requirements come from. Possibly, they are just the whims of that customer. To me, they seem to be written as a windy way to require connecting through a mobile hotspot managed by the operator.

I work for an employer subject to ITAR and have never heard of this requirement.

1) I somehow doubt this is true. 2) If it was, it would not be possible to enforce. People are adding and removing stuff on their home network all the time. What if your roommate's machine gets compromised? 3) Wouldn't it be simpler for them to send out a VPN appliance and treat the home network as untrusted?

Won't someone think of the employers.

I don't know about the prohibited part but that's exactly how LinkedIn got hacked.

See https://darknetdiaries.com/transcript/86/ for details.

Others already expressed surprise on what you wrote and none has confirmed...

But here is some fun fact: when I was working at poultry plant (well, chickens laid eggs) I had a clause within contract that I cannot have my own chickens... I guess because of increased risk to introduce diseases for the plant chickens?!

You do know a router requires a public IP to even work you cannot not have a public IP. Either the people who rite those rules have no idea about computers or you miss read something.

Organizations should treat all physical networks, including the ones in their own offices, as untrusted. If they are trusting an internal network these days, they are doing something wrong.

What are you talking about

Which industries?

Reply on news.ycombinator.com