Comment Re:Oh yes. (Score 2) 151
I also used to work in a bank, and there was this opt-in network (you actually had to ask for it, and it of course put you on a "watch" list for performance and such) on a regular home-grade connection, called "red cable". It got you access to a nearly unrestricted NAT connection (separation for each floor, wireless network segments, and meeting rooms), and incidentally allowed IT folks to download packages and other cumbersome images that the regular proxy would not download/filter.
Meeting rooms also were wired in this fashion, in their own isolated VLANs so as to not infect guests with crap our execs would download.
On top of that we then could implement an HTTPS reverse proxy system (OpenBSD + nginx) to publish data used in meetings with outside people (vendors and such), with Kerberos password + client certificates for authentication, and very strict monitoring on said box to ensure no one accessed it out of planned timeframes.
Cons :
- The really cumbersome thing was, getting a restricted file (some legit packages like WireShark would get recognized as malware) on the main network, which also had its own restrictions of course, except for the IT admin floor.
- A little more maintenance trouble, and execs throwing a fit when this supposedly "non business critical" connection went down, and it turns out someone was using it for "very important downloads". I dropped enough hints here, three guesses as to what these were.
Pros :
- This allowed BYOD relatively seamlessly for the execs, so they didn't feel the need to ask for admin privileges on their main network workstations.
- And yes, some execs and IT goons would do insane torrenting and porn surfing on that network, and make a mess of it, but at least it was walled and easier to purge through fire when time called for it.
They want to be kings ? Let them be kings of a pile of dirt, play with mud like kids, and con them in believing dirt is the new gold.