If she thought that security checks at the door are inconvenient, do we just leave the fire exit door open ? If she hasn't requested that the Wifi gets upgraded then her excuse that the Wifi isn't reliable enough holds no water. Not letting a private computer on the company network is one of the most fundamental jobs for IT security.

The more often I read this answer the worse it gets. There is some dangerous advice in there. You have recent breaches of security being made public because of neglect and people not doing what they're supposed to. IT security is one of the most important things for any company bigger than a couple hundred employees. It can not work unless everyone takes it seriously. If that board member know anything about security she would understand that she's making it worse.

There have been enough board scandals in corporate history to make it clear that "board member => give whatever they want" is not always right, or best advised, even if they demand it. Ultimately a board member and you both owe a duty to the company, and if you feel their actions are problematic, then you need a way forward that reconciles that with your + her needs, not one that just shuts eyes to the problems it might cause. Simple examples - will her laptop have the same lockdown/security/logs as the in house system+PCs (probably not)? Are the issues a real concern (ask another senior p

person)? Generally, even a board member is answerable to, and expected to comply with, policies. A finance director is trusted but a good one has someone else sign off certain payments. A technical director should appreciate and support system policies more not less than others. If she has a genuine issue, treat it as such and resolve the issue - but resolve it in a way you are comfortable with.

@xyious i don't know networks at all. but i'm pretty sure i don't say anywhere for OP to "do whatever the board member says". i do suggest the OP re-examine the picture, because what has been asked shows a lot of holes - the most urgent being a board member is unsatisfied with the response times of the OPs team.

@Stilez really depends on "right". It is the OPs decision if the possibility of losing their job is worth fighting with a board member. If the board member wants to be part of the network admin - and can make herself part of the network admin then i'm unsure what the OP is fighting, and for whom. But again, i don't tell the OP to "do whatever is asked" in my answer. But the OP should be aware of the seniority of a board member, and the direct and indirect power they can wield within a company.

If I were a manager and one of my security direct reports gave network admin rights to someone I would fire them.

@xyious ok? i don't know networks at all, but the board member has overruled whatever your reports, you, or your manager has said. there are no laws against giving network access admin rights (i assume...), so if someone pays you to do it, you... do it. or they'll pay someone else. it's v. different from being paid to, say, "fudge the accounting ledger" because that is illegal.

If they want to overrule my reports they need to talk to my manager who needs to talk to me, and I'll make it known that it's a hilariously bad idea... and make sure that I tell my manager to tell the board member that it's a terrible idea.... Either way there's a chain of command for a reason. I would expect the manager of the security team to outright refuse the request by the board member, which is why I assume the board member doesn't ask the manager....

Sorry, but -1 for almost everything about this answer. A "highly accomplished person" isn't necessarily competent in every field. I'm "highly accomplished" in computing, but that doesn't mean I'm qualified to, for example, fly a 747. Nor are the CEOs or board members of most airlines. One of the biggest problems today in both industry and government is management who don't understand information security. People who know just enough about networking to be dangerous are the last people in the world who you want setting network policy.

@bharal Also, your assumption that granting her admin rights is not illegal is not necessarily true. I've worked in places where it definitely would have been illegal to do that. There's a very real chance that it would, in fact, be illegal if your company deals with any sort of sensitive data at all.

An Active Directory domain can be configured to allow personal devices on the network in such a way where it will only allow devices that meet certain security requirements. In other works, it’s not a big deal, and could easily be accomplished in a way that is secure. The board members request can be granted without giving them Administrator access

This answer is utterly awful, for reasons others have already described pretty well.

@bharal The company has 6 “boardmembers”, each (partially) responsible for a different part of the company, 50 employees and over 50 visitors a day. She is aware of the changes as these can be followed using our internal blog The changes are like “more access to C:/” , “unblock Task Manager”, “unblock websites”, “get access to the corporation wifi (device based, faster) instead of guest wifi “ Only she demands these changes. The rest is OK with the limitations. Even if the CEO would ask this I would say “safety before comfort”.

@bharal The WiFi will be looked after. Has to do with QOS in combination with ISP. Unfortunately I’m depending on people (externals) who have a tight schedule. I noticed that her productivity and quality lowers when she has a lot on her mind. Also, I would clash with her because she has no knowledge of company security. She simply does not understand why we have two networks.

@bharal About the team, we are working part-time. Generaly speaking, one teammember works per two days. Also a lot of work is carried out at home as we can change a lot of stuff without physically being there. We put our changes in a blog so it is visible for everyone of the board. Many thanks for your advice. I will work out these ideas and build a solution

Imagine that we replace "network operator" with "finance personnel", and that this board member was using her personal bank account for company transactions, and that instead of admin access she was asking for the passcodes to the corporate account so she could handle company transactions without having to go through the usual corporate procurement system. It doesn't matter how "competent" and "accomplished" she might be, this would still be grossly inappropriate (and anybody competent should know that). Some rules exist for good reason.

This person owns the company <= Not necessarily true, in fact likely to to not be true. Board members are often hired or volunteer positions, not necessarily owners.

@cale_b boardmembers own equity in the company. That's how they're kept aligned with the company vision - if not themselves directly, then the fund/firm that has funded the company to such an extent that it could demand a board seat. I'm not aware of board membership being probono, i'm not sure that even makes sense (why would the member care how the company fared?)

@bharal - I've seen many, many boards that were either entirely paid positions without any stake in the company (mostly for-profit companies), and I have seen probono / volunteer as well (mostly not-for-profit companies). Not everyone is motivated only by monetary compensation.

@cale_b nonproits work in their own little world. Won't argue with you as to what you saw - I don't doubt it. But if you're interested, here's some research saying that board members should only have equity compensation hbr.org/2017/05/board-directors-should-be-paid-only-in-equit‌​y. I agree with this viewpoint, it's savage to have decision makers removed from the effects of the decision.

@bharal - great article. Thanks for discussing, and for sharing that article!

@bharal But "should" and "do" are different things. If I'm reading Table 2 of the linked EJF paper correctly, 62% of S&P500s reported a director ownership requirement, which implies that the other 38% did not.