7.3 Access controls

Just because something's on your server doesn't mean you want the whole world to see it. You may have files that tech support people should be able to see but that customers shouldn't or programs that only certain people should be able to run. (You don't want random strangers updating your phone list, much less writing purchase requisitions.) You probably don't want search engines wasting your resources by trying to run your CGI scripts.

You can restrict or allow access to your pages in a bewildering variety of ways. You can do it based on the IP address it comes from (or portion thereof, such as the subnet or just the domain). If only your on-site users need access to the company-provided pizza-order page, you can allow access only to those with internal IP addresses.

You can require that people get to a page only via another page (even on another site) using the REFERER [sic] header; that they be running a particular browser; that they validate user name and password against your SYSUAF; or that they validate against some external file that's just for that project or that directory (or just that they know the specific password for that file and that directory). You can even do combinations: any on-site user can look at the building plans but off-site users have to authenticate with user name and password to do it.

All that said, if you have stuff on a computer that would put the company...