5

We have concerns about our staff using wireless hotspots to connect to our LAN. We use a VPN to connect to our network and they can then transfer data using a proprietary application. What little web browsing they do is directed to our proxy server and hence requires the VPN to be established first.

So my question is this: How do we best secure the laptop from the time they start it to the time they make the VPN connection?
They could be connected to an open, unsecured network for many minutes before starting the VPN.

Our concern is not so much sniffing of data (as data will only be sent over the VPN), but that someone could connect to the laptop and compromise it prior to the VPN connection.

Personal firewalls are an option, but they need to be effective without input from the user (and preferably centrally managed).

I'd be interested to know how others have approached this problem and what solutions they have found.

Update:

An implied part of this question that I didn't really ask is: Do you consider Windows firewall to be robust enough, with suitable policies, to block inbound access, or do you turn to third party solutions?

Improve this question
2
  • Is this a company owned asset that they're connecting with or is it any type of client? What are you using for your VPN solution?
    – GregD
    Jun 1, 2009 at 16:57
  • Company owned assets only and Cisco VPN client.
    – Chris
    Jun 2, 2009 at 11:55

8 Answers 8

Reset to default
3

Securing a laptop for staff members and to connect via hotspots is very difficult task involving security at various levels and can be very costly in terms of the solutions.

If the data is of that importance in your network which is obvious you can try these things or implementations.

  1. Secure the physical drive by encrypting and locking down the system by not allowing any script to run or any program to be installed.
  2. Push tested security updates regularly.
  3. Keep the firewall rules hard and should be allowed to be disabled by users.
  4. encourage users or educate users ( MOST IMPORTANT ) to use or connect via secured networks only. Also educate them about the threats via emails or messages and so on.
  5. Disable local network using remote vpn policy ( have seen this in action almost everywhere ) so that data cannot be passed to any other network.
  6. If cost is not a problem and data is of utmost significance then the laptop should be made a thin client with above implementations and should use a citrix or xen presentation server to connect to a remote terminal and work under secure environment.
Improve this answer
2

You just have to configure a firewall on each laptop in order to block all network traffic (output as well as input), except the packet needed to mount and run the VPN connection.

On Windows, the firewall settings can be easily managed by setting GPO in Active Directory.

Improve this answer
2

I think to be more specific, you would only allow the primary wireless interface accept packets from "home" (your VPN server address pool), and deny all other incoming traffic. Then you would configure the firewall to allow all traffic to be allowed over the VPN device. It sounds like you already have the proper filtering covered at the VPN level.

Improve this answer
1

As said before - windows firewall managed by AD will do. Also, You would like to have local admin account password set to something strong. In my company we implemented a domain-wide utility that centraly manages local administrator passwords. And you also want to have all the security updates on them as well.

Improve this answer
1
  • 1
    Alexander, we do have strong passwords (and also rename the local admin account) and we update too - good points to raise though.
    – Chris
    May 31, 2009 at 17:37
1

If you are only concerned about incoming compromises until the VPN is connected, force the Windows Firewall to enabled, blocking all incoming traffic without exception. This will not prevent outbound traffic that initiates an inbound reply, but it will lock down any outside-initiated traffic until the VPN is connected, which seems to be your stated concern. Some of the other answers here take it one or more steps further if you need it.

Improve this answer
0

It's the usual compromise between convenience and security - you can never have both unfortunately.

I know this is not the answer you're after - but I think the most important thing here is to educate the users, and perhaps limit/restict who gets to use a laptop, and who doesn't.

I assume you already are locking down the laptop OS/software as much as possible, but obviously that doesn't mean it's secure (just that it's a little more secure).

Improve this answer
0

Take a look at a feature in Windows 2008 called Network Access Protection (NAP) It lets you set policies about the state of machines you will allow onto your VPN before they're given full access to your network. For example you can make sure the client computers AV is up-to-date or they're patched correctly. There is a whole bunch of policies you can setup for this. It also has the ability to quarantine the client so you can get these things fixed automatically before allowing them onto the network.

This doesn't exactly answer your question, as the computers are already on the VPN, but i think this is probably the best approach. i.e. connect them to an isolated network, ensure they pass the checks, then give them full-access.

Improve this answer
3
  • NAP certainly looks promising. I didn't mention in the question, but we're using XP, so it isn't an option for us (yet).
    – Chris
    May 31, 2009 at 23:27
  • XP with SP3 is supported!
    – Nick Kavadias
    Jun 1, 2009 at 0:36
  • I hadn't realized; good to know!
    – Chris
    Jun 1, 2009 at 12:07
0

Some VPN clients are capable of enforcing such a policy. The Check Point VPN client added this feature around 2000/2001.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .