experts: how secure is my network?

Tech Republic is running a series on VPN this month.
Just search on VPN, and you will get 35+ articles to review.

To test your present security, go to this site, and run the test.
http://grc.com/lt/howtouse.htm

I don't know how good a job their test does, but it is a start.

Chas

Try using Steve Gibson's remote scanning site (www.grc.com). This can tell you some vulnerable services. In your scenario, if you don't have any incoming traffic (to a web server, email server), you're "reasonably" secure since there's no machinesthat can be exploited directly, other than your firewall or DSL adapter (if it's configurable). Just make sure you set up your firewall properly and have the latest firmware, if possible.

I say "reasonably" because there's still the chance that someone will download a trojan horse program or virus, so your next step would be some antivirus scanning software for the user machines. The usuals are probably the easiest - Norton, McAfee, Trend Micro.

To really get an indication of what's going on, make friends with software such as NMAP and Nessus, both free scanning software apps that can tell you a lot of what's happening within your network. The results are far too vast to discuss here, but research the outputs of your scans to decide whether they are good or bad for your network.

Hope that helps -

Just for a start, try:

http://grc.com/intro.htm

Well, try starting at @Stake:
http://www.atstake.com/services/education/index.html
They have all kinds of documents to read about network security. These are also the guys who made L0phtCrack, so they know a thing or two about Windows security.
Also, if you want a free scanner you can use to test your security, try the Cerberus Internet Scanner:
http://www.cerberus-infosec.co.uk/cis.shtml

hope this helps

Hello!

You can use LeakTest from GRC.com, and Symantec have quite a nice system security tester at www.symantec.com. This tests your whole PC for intrusion detection, virus scanning capabilities etc. You would want to pick a representative machine to run each test on.

If you buy a product that allows you to set up a VPN, then the security risks are really at the user side, with (a) a vulnerability on the user's machine allowing a malicious external entity to gain access to the machine andthus to the VPN, and (b) your company user being insufficiently diligent in protecting their PC and their means of access to it. I hear stories of SecurID tags stored in laptop bags, with PINs taped to the machine...

Whatever you do, make sure your company buys into the procedural requirements to maintain security.

Try this:

http://www.qualys.com

Thanks,
-Rookie

There are alot of free scanners out there that can pinpoint system weaknesses, my favorite is Nessus if you have linux experience. This software stays updated pretty well. Another free tool I like is SARA which can also provide some desent reportsfor you, including ways to eliminate the risks. As far as VPN's go I would recommend using an IPSEC implementation as opposed to PPTP or L2TP, and make sure that the encrytion key lengths are of sufficient strength so that they can not be easily broken. Password complexity also becomes more of an issue with remote access. Make sure they are alphanumeric 6 character minimum, expire every so often and make sure some accounting system will allow you to audit that access point. Just a few ideas, hope they help.

This question was closed by the author