I was afraid someone was going to say that. We already have people out in the field who connect via VPN and can then go crazy on our internal network. Of course not all of them are authorized for VPN. For these people, they are limited to doing some very simple tasks on the webserver with a webform.