1

We have a cloud-based B2B solution that is meant to help them collate and manage their operational data. One of clients wants to ensure that their employees can only access their data from devices within their own premises. To allow this we are considering collecting IP information alongside their regular login details and only allow access to the IP addresses from a pre-defined range provided by the client. However, some people in the team raised concerns regarding the legality of using IP addresses this way in countries such as Germany.

However, As per what I read online though the limitation is basically on collecting IP data to create individual user profiles and our approach should be fine as it is IP information provided by their employer to access an organisational database. Can someone please confirm if this is the right understanding or if there might be legal limitations?

migrated from security.stackexchange.com Sep 21 '17 at 13:35

This question came from our site for information security professionals.

0

The problem restated:- Control Access to a cloud based B2B application for an enterprise such that users of the enterprise can only access the B2B application from the enterprise network.

Possible solution:- Create an access control list on the Cloud application to permit only the source network of the Enterprise to access the application. The users can then be fine grained controlled using Username/Password or 2FA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.