DesktopSecurity:Who opened the back door

Not really sure what you mean by "desktop security".

Are you talking about locking down users abilty to installing programs?

Or are you talking about securing the local lan from the rest of the net.

Or are you talking about patching systems/destops with the most up-to date patches/hf's?

I take this stance:

1. No user is allowed to install *any* software/program on their system.

2. I employ egress filtering. (Not only do I
filter inbound connections but outbound as well)

3. When systems are built they always get the latest round of "applicable" pathes.
a. Virus protection dat updtates is set for automatic download from a local server -not remote
b. When a Major "Critical" update is made public it is deployed.

4. No Dial-up connections are allowed.

5. No receiving personal e-mail accounts.

and IT has to be very serious and attentive about it according to the needs of your particular situation. I would look at what cost there would be to 1) replace your data 2) do damage control, settle legal issues, pay for everyone's time etc. in theevent that you lost your records to a hostile entity and 3) look at how your network could be an illegal or undesireable resource to others. When a CEO understands this, the cost of hardware etc. suddenly looks like a bargain.

As far as desktop specifically I have no idea what your topography is... but whether you have client server, peer to peer etc. I would say that you need to figure out the risk first and go from there. If you don't have anything confidential, great back-ups, and don't have much in the way of exploitable resources like lots of disk space and high bandwidth then you shouldn't need to put as much money or time into it.