Security
by stillatit
There are various ways to approach this problem, none of which you are really going to like. Some combination of these may work for you.
1. If you want to take the effort to show management that this is a real security issue, which may mean showing actual damage rather than a theoretical risk, do so. Having made management aware of the real risk, which you can liken to leaving a door key under the mat, have management (as opposed to MIS) hand down an official policy that anyone using dial-upmust first pull the network plug.
2. If your laptops are fast enough to not bog down, set your virus scan on the laptops for "scan anything I touch" mode, and lock down the configuration on the virus scan with a password. (Make this an official MIS policy, and set up all laptops this way.)
3. If your company uses a PBX, laptops can probably only plug in where someone has provided an analog extension. Eliminate all of these except in offices of people you can trust to use them securely. Alternately, make sure that no "free" lines are colocated with network connections.
4. Use private numbering on all of your internal networks. While this will not block virus entry, it will prevent accidental routing to the outside. You will need arouter with NAT to provide internet services to your inside users.
(continued in comment below)
by stillatit
5. Alternately, if you use real addresses for your internal network, and if you hand out static addresses to workstations, set the laptops to use DHCP, and hand out 192.168.x.y numbers to the laptops using DHCP. Add a second NIC or a second address to the existing NIC on your server with an appropriate address.
6. By the way, my company does not restrict the use of modems on inside laptops, but we do lock the virus scans on. The other thing we do is check the "use default gateway" box in thedial-up, so that the user tends to lose the network connection while dialed up.
7. Realize that the real security threat is not necessarily the modem so much as the laptop and what it may have picked up before it came in the door, and person running the laptop, who might download megabytes from your network to the laptop for legitimate reasons, and then lose the laptop. This is a different set of security problems you need to address.
Good luck.
by cpt cozmic
by cavedweller
by cpt cozmic
We would like the users to be able to use the modem when at home.
Thanks
Another approach is to configure all Laptops to enter the network from OUTSIDE a firewall.
I prefer to treat all laptops as untrusted systems. As mentioned by a previous poster the issue of what's on the laptop is at least as important as modem connections.
Certain files and services should probably not be available to these machines. Firewalling them seperately also allows for closer monitoring of the activity on these devices. (what files are downloaded from the network, etc.)
I would also suggest that all laptops have a correctly configured "personal firewall" that is periodically inspected by the sys admin to assure correct function. The log files created by these "baby" firewalls can be another tool for rooting improper use of these machines.
Al Franco, II
APF Creations
Pamplona, Spain
by cpt cozmic
by mikel~t
this is more of an observation....you say you don't want the laptops to be able to dial up to the internet at work because it is a security risk....but you do want them to be able to dial up to the internet when they are at home?????? Isn't the riskgreater at home when no one is around to see what they are doing?
Anyway, I would setup a system policy so that dial up networking is not accessible, but only after you have setup the necessary/allowable numbers they can dial...ie for a RAS server.
Full Armor is a good program that lets you manage computer service/component access.
Hope this helps.
Mike
by cpt cozmic
by cpt cozmic
This discussion is closed to new replies.
Sort by Trending