We have concerns about our staff using wireless hotspots to connect to our LAN. We use a VPN to connect to our network and they can then transfer data using a proprietary application. What little web browsing they do is directed to our proxy server and hence requires the VPN to be established first.
So my question is this: How do we best secure the laptop from the time they start it to the time they make the VPN connection?
They could be connected to an open, unsecured network for many minutes before starting the VPN.
Our concern is not so much sniffing of data (as data will only be sent over the VPN), but that someone could connect to the laptop and compromise it prior to the VPN connection.
Personal firewalls are an option, but they need to be effective without input from the user (and preferably centrally managed).
I'd be interested to know how others have approached this problem and what solutions they have found.
An implied part of this question that I didn't really ask is: Do you consider Windows firewall to be robust enough, with suitable policies, to block inbound access, or do you turn to third party solutions?