Home laptops on a corporate network

[Tsu]

SSL VPN Appliance like the one from Watchguard.
http://www.watchguard.com/products/fb-ssl.asp

Very easy to setup, easy to use, LDAP integration... good stuff. I've
implemented several of them for clients.

On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> Hi all -
>
> I have a client who wants to allow employees to use their own laptops on
> the corp. wireless network so that they can access files on the server.
> I gave them a run-down of options (allow usual file sharing [bad idea],
> MS VPN quarantine [complex scripting], SharePoint services [not bad, but
> no printer access] and third party quarantine options).
>
> Aside from any other ideas someone may have, it seems to me that the
> third party compliance software/appliance, while probably being the most
> versatile is pretty costly. I found a couple starting at about $20K.
> Does anybody know of any devices that are significantly cheaper and can
> allow my client to do what they want? I should mention that they are
> bound by HIPAA regulations here. Or any approaches I haven't thought of?
>
> Thanks for the input.
>
> Adam
>
> Adam J. Rosen
> President
> Buffalo Data Solutions
> 716-913-6312
> ***@buffdata.com
> http://www.buffdata.com
>
>
>



--
tsudohnimh
www.knowthenetwork.com

[c***@hotmail.com]

I'd recommend NOT doing this. Especially if you are trying comply with HIPAA. Keep in mind that you will have little to no management capability over these personal laptops, which means you have no ability to verify patch level and AV update on these machines that may have EPHI on them. Not to mention the fact that these employees are probably taking them home and plugging them into their home networks, where they (or their kids) are running bearshare, gnutella, grokster, bitorrent, and surfing to unfiltered web sites. Not only does this mean that they are potentially exposing critical data in this manner, it also means they are bringing potentially infested computers into the soft chewy center of your network.

Whenever you have an employee with a laptop, you create a liability to your network, allowing them to use personal laptops presents an even bigger liability. IMHO, this level of risk is unacceptable, especially from a HIPAA compliance standpoint.

[Petter Bruland]

Totally agree, not recommended.

Earlier we had some posts about patch management, and from what I
gathered, you could get some control by using PatchLink. Although, that
does not protect you 100%, you could place the VPN users on their own
VLAN where you can restrict the amount of access to internal
servers/services.

I've seen a different "solution" (not sure how much of a solution that
is) where the firewall is a high end Sonicwall, like the 4060 etc, and
the VPN clients were terminated to their own LAN segment. Then the
Sonicwall would use it's Security Services (Content filter, gateway AV,
Client AV enforcement, anti-spy ware, intrusion prevention) to filter
traffic between the VPN users and the rest of the network.

Also I'm not too familiar with the restrictions of HIPAA and SOX, so the
above might not event be "allowed" according to HIPAA/SOX.

I think this is a very common scenario, so any feedback (NOT FLAMING) is
appreciated.

-Petter

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of ***@hotmail.com
Sent: Tuesday, May 08, 2007 10:12 AM
To: security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network

I'd recommend NOT doing this. Especially if you are trying comply with
HIPAA. Keep in mind that you will have little to no management
capability over these personal laptops, which means you have no ability
to verify patch level and AV update on these machines that may have EPHI
on them. Not to mention the fact that these employees are probably
taking them home and plugging them into their home networks, where they
(or their kids) are running bearshare, gnutella, grokster, bitorrent,
and surfing to unfiltered web sites. Not only does this mean that they
are potentially exposing critical data in this manner, it also means
they are bringing potentially infested computers into the soft chewy
center of your network.


Whenever you have an employee with a laptop, you create a liability to
your network, allowing them to use personal laptops presents an even
bigger liability. IMHO, this level of risk is unacceptable, especially
from a HIPAA compliance standpoint.

[g***@tmo.blackberry.net]

One of the advantages of using SMS for patch management is you can force a patch scan and push as soon as they connect to the network (vpn, dial up, or regular). SMS is a pain to configure for patch management, but it's worth it.

Geoff
Sent from my BlackBerry wireless handheld.

-----Original Message-----
From: "Petter Bruland" <***@fcglv.com>
Date: Tue, 8 May 2007 10:51:40
To:<***@hotmail.com>, <security-***@securityfocus.com>
Subject: RE: Home laptops on a corporate network

Totally agree, not recommended.

Earlier we had some posts about patch management, and from what I
gathered, you could get some control by using PatchLink. Although, that
does not protect you 100%, you could place the VPN users on their own
VLAN where you can restrict the amount of access to internal
servers/services.

I've seen a different "solution" (not sure how much of a solution that
is) where the firewall is a high end Sonicwall, like the 4060 etc, and
the VPN clients were terminated to their own LAN segment. Then the
Sonicwall would use it's Security Services (Content filter, gateway AV,
Client AV enforcement, anti-spy ware, intrusion prevention) to filter
traffic between the VPN users and the rest of the network.

Also I'm not too familiar with the restrictions of HIPAA and SOX, so the
above might not event be "allowed" according to HIPAA/SOX.

I think this is a very common scenario, so any feedback (NOT FLAMING) is
appreciated.

-Petter

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of ***@hotmail.com
Sent: Tuesday, May 08, 2007 10:12 AM
To: security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network

I'd recommend NOT doing this. Especially if you are trying comply with
HIPAA. Keep in mind that you will have little to no management
capability over these personal laptops, which means you have no ability
to verify patch level and AV update on these machines that may have EPHI
on them. Not to mention the fact that these employees are probably
taking them home and plugging them into their home networks, where they
(or their kids) are running bearshare, gnutella, grokster, bitorrent,
and surfing to unfiltered web sites. Not only does this mean that they
are potentially exposing critical data in this manner, it also means
they are bringing potentially infested computers into the soft chewy
center of your network.


Whenever you have an employee with a laptop, you create a liability to
your network, allowing them to use personal laptops presents an even
bigger liability. IMHO, this level of risk is unacceptable, especially
from

[Christopher Kelley]

Keep in mind the original question.... We are talking about PERSONAL laptops
here. Doing all of these things to non-company assets is unfeasable. Not to
mention, you would be liable if a patch rendered the system (or any part of
it) unuseable, or if the employee was no longer able to install things to
the system, or whatever. This could be reduced by an agressive AUP/EULA, but
in the end the risk is most definately NOT worth the reward.

You need to think about all the things that this laptop would encounter, and
how you would safeguard the EPHI that is on the system. It is just not
possible with a non-company asset.

Heck, it is hard enough with a _company_ owned asset.

Trust me on this, your client and your client's IT people will be very
thankful in the long run if you squash this right now.


From: ***@tmo.blackberry.net
Reply-To: ***@tmo.blackberry.net
To: "Petter Bruland" <***@fcglv.com>, ***@securityfocus.com,
***@hotmail.com, security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network
Date: Tue, 8 May 2007 23:42:17 +0000
MIME-Version: 1.0
Received: from smtp05.bis.na.blackberry.com ([216.9.248.52]) by
bay0-mc5-f2.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Tue, 8
May 2007 16:42:24 -0700
X-Message-Info:
oG9qAjD2BNG0yVlB517PPNHCtMVimjpzoMreuYyIO2oP8zkmi6D3iEQ4Sb8YSCTqzgGU4VnnNk4=
References: <***@securityfocus.com>
<***@fpgm01.fpglv.ads>
Sensitivity: Normal
Return-Path: ***@tmo.blackberry.net
X-OriginalArrivalTime: 08 May 2007 23:42:24.0079 (UTC)
FILETIME=[872F3DF0:01C791CA]

One of the advantages of using SMS for patch management is you can force a
patch scan and push as soon as they connect to the network (vpn, dial up, or
regular). SMS is a pain to configure for patch management, but it's worth
it.

Geoff
Sent from my BlackBerry wireless handheld.

-----Original Message-----
From: "Petter Bruland" <***@fcglv.com>
Date: Tue, 8 May 2007 10:51:40
To:<***@hotmail.com>, <security-***@securityfocus.com>
Subject: RE: Home laptops on a corporate network

Totally agree, not recommended.

Earlier we had some posts about patch management, and from what I
gathered, you could get some control by using PatchLink. Although, that
does not protect you 100%, you could place the VPN users on their own
VLAN where you can restrict the amount of access to internal
servers/services.

I've seen a different "solution" (not sure how much of a solution that
is) where the firewall is a high end Sonicwall, like the 4060 etc, and
the VPN clients were terminated to their own LAN segment. Then the
Sonicwall would use it's Security Services (Content filter, gateway AV,
Client AV enforcement, anti-spy ware, intrusion prevention) to filter
traffic between the VPN users and the rest of the network.

Also I'm not too familiar with the restrictions of HIPAA and SOX, so the
above might not event be "allowed" according to HIPAA/SOX.

I think this is a very common scenario, so any feedback (NOT FLAMING) is
appreciated.

-Petter

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of ***@hotmail.com
Sent: Tuesday, May 08, 2007 10:12 AM
To: security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network

I'd recommend NOT doing this. Especially if you are trying comply with
HIPAA. Keep in mind that you will have little to no management
capability over these personal laptops, which means you have no ability
to verify patch level and AV update on these machines that may have EPHI
on them. Not to mention the fact that these employees are probably
taking them home and plugging them into their home networks, where they
(or their kids) are running bearshare, gnutella, grokster, bitorrent,
and surfing to unfiltered web sites. Not only does this mean that they
are potentially exposing critical data in this manner, it also means
they are bringing potentially infested computers into the soft chewy
center of your network.


Whenever you have an employee with a laptop, you create a liability to
your network, allowing them to use personal laptops presents an even
bigger liability. IMHO, this level of risk is unacceptable, especially
from a HIPAA compliance standpoint.

_________________________________________________________________
Like the way Microsoft Office Outlook works? You’ll love Windows Live
Hotmail.
http://imagine-windowslive.com/hotmail/?locale=en-us&ocid=TXT_TAGHM_migration_HM_mini_outlook_0507

[Adam Rosen]

I think a properly secured (i.e. no access to local drives) Terminal
Server is the way to go with this if they are wanting this ability.

Adam

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of Christopher Kelley
Sent: Wednesday, May 09, 2007 8:58 AM
To: ***@tmo.blackberry.net; ***@fcglv.com;
***@securityfocus.com; security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network

Keep in mind the original question.... We are talking about PERSONAL
laptops here. Doing all of these things to non-company assets is
unfeasable. Not to mention, you would be liable if a patch rendered the
system (or any part of
it) unuseable, or if the employee was no longer able to install things
to the system, or whatever. This could be reduced by an agressive
AUP/EULA, but in the end the risk is most definately NOT worth the
reward.

You need to think about all the things that this laptop would encounter,
and how you would safeguard the EPHI that is on the system. It is just
not possible with a non-company asset.

Heck, it is hard enough with a _company_ owned asset.

Trust me on this, your client and your client's IT people will be very
thankful in the long run if you squash this right now.


From: ***@tmo.blackberry.net
Reply-To: ***@tmo.blackberry.net
To: "Petter Bruland" <***@fcglv.com>, ***@securityfocus.com,

***@hotmail.com, security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network
Date: Tue, 8 May 2007 23:42:17 +0000
MIME-Version: 1.0
Received: from smtp05.bis.na.blackberry.com ([216.9.248.52]) by
bay0-mc5-f2.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Tue,
8
May 2007 16:42:24 -0700
X-Message-Info:
oG9qAjD2BNG0yVlB517PPNHCtMVimjpzoMreuYyIO2oP8zkmi6D3iEQ4Sb8YSCTqzgGU4Vnn
Nk4=
References: <***@securityfocus.com>
<***@fpgm01.fpglv.ads>
Sensitivity: Normal
Return-Path: ***@tmo.blackberry.net
X-OriginalArrivalTime: 08 May 2007 23:42:24.0079 (UTC)
FILETIME=[872F3DF0:01C791CA]

One of the advantages of using SMS for patch management is you can force
a
patch scan and push as soon as they connect to the network (vpn, dial
up, or
regular). SMS is a pain to configure for patch management, but it's
worth
it.

Geoff
Sent from my BlackBerry wireless handheld.

-----Original Message-----
From: "Petter Bruland" <***@fcglv.com>
Date: Tue, 8 May 2007 10:51:40
To:<***@hotmail.com>, <security-***@securityfocus.com>
Subject: RE: Home laptops on a corporate network

Totally agree, not recommended.

Earlier we had some posts about patch management, and from what I
gathered, you could get some control by using PatchLink. Although, that
does not protect you 100%, you could place the VPN users on their own
VLAN where you can restrict the amount of access to internal
servers/services.

I've seen a different "solution" (not sure how much of a solution that
is) where the firewall is a high end Sonicwall, like the 4060 etc, and
the VPN clients were terminated to their own LAN segment. Then the
Sonicwall would use it's Security Services (Content filter, gateway AV,
Client AV enforcement, anti-spy ware, intrusion prevention) to filter
traffic between the VPN users and the rest of the network.

Also I'm not too familiar with the restrictions of HIPAA and SOX, so the
above might not event be "allowed" according to HIPAA/SOX.

I think this is a very common scenario, so any feedback (NOT FLAMING) is
appreciated.

-Petter

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of ***@hotmail.com
Sent: Tuesday, May 08, 2007 10:12 AM
To: security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network

I'd recommend NOT doing this. Especially if you are trying comply with
HIPAA. Keep in mind that you will have little to no management
capability over these personal laptops, which means you have no ability
to verify patch level and AV update on these machines that may have EPHI
on them. Not to mention the fact that these employees are probably
taking them home and plugging them into their home networks, where they
(or their kids) are running bearshare, gnutella, grokster, bitorrent,
and surfing to unfiltered web sites. Not only does this mean that they
are potentially exposing critical data in this manner, it also means
they are bringing potentially infested computers into the soft chewy
center of your network.


Whenever you have an employee with a laptop, you create a liability to
your network, allowing them to use personal laptops presents an even
bigger liability. IMHO, this level of risk is unacceptable, especially
from a HIPAA compliance standpoint.

_________________________________________________________________
Like the way Microsoft Office Outlook works? You'll love Windows Live
Hotmail.
http://imagine-windowslive.com/hotmail/?locale=en-us&ocid=TXT_TAGHM_migr
ation_HM_mini_outlook_0507

[Adam Rosen]

We were thinking of this approach (with an Astaro gateway instead of a
SonicWall) but that doesn't prevent data leakage due to software on the
endpoint. And it also doesn't stop Trojans or other things that will
delete files.

BTW - thanks all for the feedback so far.

Adam

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of Petter Bruland
Sent: Tuesday, May 08, 2007 1:52 PM
To: ***@hotmail.com; security-***@securityfocus.com
Subject: RE: Home laptops on a corporate network

Totally agree, not recommended.

Earlier we had some posts about patch management, and from what I
gathered, you could get some control by using PatchLink. Although, that
does not protect you 100%, you could place the VPN users on their own
VLAN where you can restrict the amount of access to internal
servers/services.

I've seen a different "solution" (not sure how much of a solution that
is) where the firewall is a high end Sonicwall, like the 4060 etc, and
the VPN clients were terminated to their own LAN segment. Then the
Sonicwall would use it's Security Services (Content filter, gateway AV,
Client AV enforcement, anti-spy ware, intrusion prevention) to filter
traffic between the VPN users and the rest of the network.

Also I'm not too familiar with the restrictions of HIPAA and SOX, so the
above might not event be "allowed" according to HIPAA/SOX.

I think this is a very common scenario, so any feedback (NOT FLAMING) is
appreciated.

-Petter

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of ***@hotmail.com
Sent: Tuesday, May 08, 2007 10:12 AM
To: security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network

I'd recommend NOT doing this. Especially if you are trying comply with
HIPAA. Keep in mind that you will have little to no management
capability over these personal laptops, which means you have no ability
to verify patch level and AV update on these machines that may have EPHI
on them. Not to mention the fact that these employees are probably
taking them home and plugging them into their home networks, where they
(or their kids) are running bearshare, gnutella, grokster, bitorrent,
and surfing to unfiltered web sites. Not only does this mean that they
are potentially exposing critical data in this manner, it also means
they are bringing potentially infested computers into the soft chewy
center of your network.


Whenever you have an employee with a laptop, you create a liability to
your network, allowing them to use personal laptops presents an even
bigger liability. IMHO, this level of risk is unacceptable, especially
from a HIPAA compliance standpoint.

[Nick Duda]

Using a product like Cisco Clean Access (CAS/CAM) allows you to control
patch level and antivirus before a system is allowed access to your
network. It can drop them into a remediation vlan with a remediation
server to they can "fix" the problem right away.

CCA client runs on the laptop and when connected to the network (in a
default unsecure vlan) talks to the CAS, gets its policy and starts its
thing. No computer cant get on the VPN or WiFi here unless it has what
we require installed for patches and av (software and dats). It can be
run in-band and out-of-band (dynamically change vlan on interfaces).

Because its client / server based, it allows for a boatload of other
custom scans and searches. If you tell it to look for certain
files/services (bearshare, bitorrent..etc) and if present deny
access...etc.

It's a pretty sweet appliance, but with a price tag. Can't imagine
running a VPN/Wifi in corporate without it.

The fact of most businesses is that ease of use usually overrules
security (in not all cases). If the CEO of a company demands that home
laptops are to be used, find a solution that allows it. This is one.




-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of ***@hotmail.com
Sent: Tuesday, May 08, 2007 1:12 PM
To: security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network

I'd recommend NOT doing this. Especially if you are trying comply with
HIPAA. Keep in mind that you will have little to no management
capability over these personal laptops, which means you have no ability
to verify patch level and AV update on these machines that may have EPHI
on them. Not to mention the fact that these employees are probably
taking them home and plugging them into their home networks, where they
(or their kids) are running bearshare, gnutella, grokster, bitorrent,
and surfing to unfiltered web sites. Not only does this mean that they
are potentially exposing critical data in this manner, it also means
they are bringing potentially infested computers into the soft chewy
center of your network.

Whenever you have an employee with a laptop, you create a liability to
your network, allowing them to use personal laptops presents an even
bigger liability. IMHO, this level of risk is unacceptable, especially
from a HIPAA compliance standpoint.
---------------------
Confidentiality note
The information in this email and any attachment may contain confidential and proprietary information of VistaPrint and/or its affiliates and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you are hereby notified that any review, reliance or distribution by others or forwarding without express permission is strictly prohibited and may cause liability. In case you have received this message due to an error in transmission, please notify the sender immediately and delete this email and any attachment from your system.
---------------------

[g***@tmo.blackberry.net]

It's dangerous, but not impossible to guard these systems. Step one is making sure they're joined to the domain. Step two is making sure the group policies on these systems are very strict (I'd advise putting them in their own ou for this reason). Step three would be to have a remote management solution in place.

Personally I would recommend SMS for managing remote systems. It's a beast and you need to keep your eye on it, but it'll tell you everything you want to know but were afraid to ask (including patches applied and missing). You can also use SMS for software deployment.

It takes a lot of work to secure off site systems, but it can be done. Just need to really work on setting up your GPs right and remote system management. Personally, I would allocate only corporate provided laptops for this task since you can control the imaging and there's no question as to who is the owner of the system.

Also, disable the local system administrator account on these machines (if a domain admin can't work on it remotely then the machine should be treated as broken or compromised and have to be brought in for reimaging). Make sure they can't boot from anything but the hdd and that the bios is password protected (important note: using the same password on every system is a very bad idea). Use a different password per system and keep that information in a central db (you could use the systems serial as the pk) for the help desk/noc people to see. I would also recommend setting the startup password (if the laptop allows it - my thinkpad does), but make it a semi easy password (last name of assigned owner maybe, but that's up to you) so the user doesn't write it down on a postit note and stick it to the keyboard.

Geoff

Sent from my BlackBerry wireless handheld.

-----Original Message-----
From: ***@hotmail.com
Date: 8 May 2007 17:11:32
To:security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network

I'd recommend NOT doing this. Especially if you are trying comply with HIPAA. Keep in mind that you will have little to no management capability over these personal laptops, which means you have no ability to verify patch level and AV update on these machines that may have EPHI on them. Not to mention the fact that these employees are probably taking them home and plugging them into their home networks, where they (or their kids) are running bearshare, gnutella, grokster, bitorrent, and surfing to unfiltered web sites. Not only does this mean that they are potentially exposing critical data in this manner, it also means they are bringing potentially infested computers into the soft chewy center of your network.


Whenever you have an employee with a laptop, you create a liability to your network, allowing them to use personal laptops presents an even bigger liability. IMHO, this level of risk is unacceptable, especially from a HIPAA compliance standpoint.

[Ansgar -59cobalt- Wiechers]

On 2007-05-08 ***@hotmail.com wrote:
> I'd recommend NOT doing this. Especially if you are trying comply with
> HIPAA. Keep in mind that you will have little to no management
> capability over these personal laptops, which means you have no ability
> to verify patch level and AV update on these machines that may have EPHI
> on them. Not to mention the fact that these employees are probably
> taking them home and plugging them into their home networks, where they
> (or their kids) are running bearshare, gnutella, grokster, bitorrent,
> and surfing to unfiltered web sites. Not only does this mean that they
> are potentially exposing critical data in this manner, it also means
> they are bringing potentially infested computers into the soft chewy
> center of your network.
>
> Whenever you have an employee with a laptop, you create a liability to
> your network, allowing them to use personal laptops presents an even
> bigger liability. IMHO, this level of risk is unacceptable, especially
> from a HIPAA compliance standpoint.

I wholeheartedly second that recommendation. Allowing corporate data on
private computers (or private computers on a corporate network) is a
bad, BAD practice. Never EVER do that. You really want to do the exact
opposite: establish a policy that *prohibit* employees from transferring
corporate data to private computers, and have it signed by each
employee.

Regards
Ansgar Wiechers
--
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq

[Yousef Syed]

Just wondering...
But is it possible to setup a locked-down VMWare image for external
laptop users to use if they really-really need access your corporate
network. (a small subsection of the network inside its own DMZ
specifically designed to share data)


Personally, I can't think of a reason why an external laptop (or USB
drive for that matter) would need access to the internal corporate
network anyway. They can be provided with separate access to get onto
the internet from a segmented system that has no access to the
Internal system.

ys


On 08/05/07, Ansgar -59cobalt- Wiechers <***@planetcobalt.net> wrote:
> On 2007-05-08 ***@hotmail.com wrote:
> > I'd recommend NOT doing this. Especially if you are trying comply with
> > HIPAA. Keep in mind that you will have little to no management
> > capability over these personal laptops, which means you have no ability
> > to verify patch level and AV update on these machines that may have EPHI
> > on them. Not to mention the fact that these employees are probably
> > taking them home and plugging them into their home networks, where they
> > (or their kids) are running bearshare, gnutella, grokster, bitorrent,
> > and surfing to unfiltered web sites. Not only does this mean that they
> > are potentially exposing critical data in this manner, it also means
> > they are bringing potentially infested computers into the soft chewy
> > center of your network.
> >
> > Whenever you have an employee with a laptop, you create a liability to
> > your network, allowing them to use personal laptops presents an even
> > bigger liability. IMHO, this level of risk is unacceptable, especially
> > from a HIPAA compliance standpoint.
>
> I wholeheartedly second that recommendation. Allowing corporate data on
> private computers (or private computers on a corporate network) is a
> bad, BAD practice. Never EVER do that. You really want to do the exact
> opposite: establish a policy that *prohibit* employees from transferring
> corporate data to private computers, and have it signed by each
> employee.
>
> Regards
> Ansgar Wiechers
> --
> "All vulnerabilities deserve a public fear period prior to patches
> becoming available."
> --Jason Coombs on Bugtraq
>



--
Yousef Syed
"To ask a question is to show ignorance; not to ask a question, means
you remain ignorant" - Japanese Proverb

[Adam Rosen]

The reason is that the office has a lot of fee-for-service employees,
and they don't want to pay for a lab big enough for these people to come
in and do paperwork, so they want them to be able to use their own
laptops to get their work done.

Adam

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of Yousef Syed
Sent: Tuesday, May 08, 2007 7:35 PM
To: security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network

Just wondering...
But is it possible to setup a locked-down VMWare image for external
laptop users to use if they really-really need access your corporate
network. (a small subsection of the network inside its own DMZ
specifically designed to share data)


Personally, I can't think of a reason why an external laptop (or USB
drive for that matter) would need access to the internal corporate
network anyway. They can be provided with separate access to get onto
the internet from a segmented system that has no access to the Internal
system.

ys


On 08/05/07, Ansgar -59cobalt- Wiechers <***@planetcobalt.net>
wrote:
> On 2007-05-08 ***@hotmail.com wrote:
> > I'd recommend NOT doing this. Especially if you are trying comply
> > with HIPAA. Keep in mind that you will have little to no management
> > capability over these personal laptops, which means you have no
> > ability to verify patch level and AV update on these machines that
> > may have EPHI on them. Not to mention the fact that these employees
> > are probably taking them home and plugging them into their home
> > networks, where they (or their kids) are running bearshare,
> > gnutella, grokster, bitorrent, and surfing to unfiltered web sites.
> > Not only does this mean that they are potentially exposing critical
> > data in this manner, it also means they are bringing potentially
> > infested computers into the soft chewy center of your network.
> >
> > Whenever you have an employee with a laptop, you create a liability
> > to your network, allowing them to use personal laptops presents an
> > even bigger liability. IMHO, this level of risk is unacceptable,
> > especially from a HIPAA compliance standpoint.
>
> I wholeheartedly second that recommendation. Allowing corporate data
> on private computers (or private computers on a corporate network) is
> a bad, BAD practice. Never EVER do that. You really want to do the
> exact
> opposite: establish a policy that *prohibit* employees from
> transferring corporate data to private computers, and have it signed
> by each employee.
>
> Regards
> Ansgar Wiechers
> --
> "All vulnerabilities deserve a public fear period prior to patches
> becoming available."
> --Jason Coombs on Bugtraq
>



--
Yousef Syed
"To ask a question is to show ignorance; not to ask a question, means
you remain ignorant" - Japanese Proverb

[g***@tmo.blackberry.net]

Can't your boss afford a bunch of old p2's? Its not like he needs to run out and grab all new p4's for temps. Get a bunch of p2 throw w2k on them (I'm sure the licenses are cheap now). Problem solved.

Geoff

Sent from my BlackBerry wireless handheld.

-----Original Message-----
From: "Adam Rosen" <***@buffdata.com>
Date: Wed, 9 May 2007 12:55:44
To:<security-***@securityfocus.com>
Subject: RE: Home laptops on a corporate network

The reason is that the office has a lot of fee-for-service employees,
and they don't want to pay for a lab big enough for these people to come
in and do paperwork, so they want them to be able to use their own
laptops to get their work done.

Adam

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of Yousef Syed
Sent: Tuesday, May 08, 2007 7:35 PM
To: security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network

Just wondering...
But is it possible to setup a locked-down VMWare image for external
laptop users to use if they really-really need access your corporate
network. (a small subsection of the network inside its own DMZ
specifically designed to share data)


Personally, I can't think of a reason why an external laptop (or USB
drive for that matter) would need access to the internal corporate
network anyway. They can be provided with separate access to get onto
the internet from a segmented system that has no access to the Internal
system.

ys


On 08/05/07, Ansgar -59cobalt- Wiechers <***@planetcobalt.net>
wrote:
> On 2007-05-08 ***@hotmail.com wrote:
> > I'd recommend NOT doing this. Especially if you are trying comply
> > with HIPAA. Keep in mind that you will have little to no management
> > capability over these personal laptops, which means you have no
> > ability to verify patch level and AV update on these machines that
> > may have EPHI on them. Not to mention the fact that these employees
> > are probably taking them home and plugging them into their home
> > networks, where they (or their kids) are running bearshare,
> > gnutella, grokster, bitorrent, and surfing to unfiltered web sites.
> > Not only does this mean that they are potentially exposing critical
> > data in this manner, it also means they are bringing potentially
> > infested computers into the soft chewy center of your network.
> >
> > Whenever you have an employee with a laptop, you create a liability
> > to your network, allowing them to use personal laptops presents an
> > even bigger liability. IMHO, this level of risk is unacceptable,
> > especially from a HIPAA compliance standpoint.
>
> I wholeheartedly second that recommendation. Allowing corporate data
> on private computers (or private computers on a corporate network) is
> a bad, BAD practice. Never EVER do that. You really want to do the
> exact
> opposite: establish a policy that *prohibit* employees from
> transferring corporate data to private computers, and have it signed
> by each employee.
>
> Regards
> Ansgar Wiechers
> --
> "All vulnerabilities deserve a public fear period prior to patches
> becoming available."
> --Jason Coombs on Bugtraq
>



--
Yousef Syed
"To ask a question is to show ignorance; not to ask a ques

[Petter Bruland]

Sounds like a good idea, but there are security vulnerabilities with
VMWare. Not sure if any current malware/spy ware/virus takes advantage
of these flaws though.
Also how the OS within the VMWare image is configured has a great deal
to do with how secure it is.

Sounds like it would be hard to maintain these VMs and make sure that
they are *clean*.

One way that sounds easier to configure and maintain, is setting up a
VLAN X where the VPN clients connect, then only allow RDC via port XXXX
to VLAN Y where they can access either a Terminal Server or their office
PC.
And have some nice filtering setup between the VLANs, such as a
Sonicwall, Cisco, Barracuda etc.


A lot of good ideas and questions has been posted here, but nobody has
mentioned anything about two factor authentication or password
management in combination with remote access.

Assuming you have a pretty good setup, where the clients are checked
before entering the network as well as filters to prevents all sorts of
*bad* things from happening. With weak passwords or a poor password
policy, you could have users accessing the network who should not be
there.

Seems that if you're HIPAA/SOC, you should not have remote access :-(


-Petter





-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of Yousef Syed
Sent: Tuesday, May 08, 2007 4:35 PM
To: security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network

Just wondering...
But is it possible to setup a locked-down VMWare image for external
laptop users to use if they really-really need access your corporate
network. (a small subsection of the network inside its own DMZ
specifically designed to share data)


Personally, I can't think of a reason why an external laptop (or USB
drive for that matter) would need access to the internal corporate
network anyway. They can be provided with separate access to get onto
the internet from a segmented system that has no access to the Internal
system.

ys


On 08/05/07, Ansgar -59cobalt- Wiechers <***@planetcobalt.net>
wrote:
> On 2007-05-08 ***@hotmail.com wrote:
> > I'd recommend NOT doing this. Especially if you are trying comply
> > with HIPAA. Keep in mind that you will have little to no management
> > capability over these personal laptops, which means you have no
> > ability to verify patch level and AV update on these machines that
> > may have EPHI on them. Not to mention the fact that these employees
> > are probably taking them home and plugging them into their home
> > networks, where they (or their kids) are running bearshare,
> > gnutella, grokster, bitorrent, and surfing to unfiltered web sites.
> > Not only does this mean that they are potentially exposing critical
> > data in this manner, it also means they are bringing potentially
> > infested computers into the soft chewy center of your network.
> >
> > Whenever you have an employee with a laptop, you create a liability
> > to your network, allowing them to use personal laptops presents an
> > even bigger liability. IMHO, this level of risk is unacceptable,
> > especially from a HIPAA compliance standpoint.
>
> I wholeheartedly second that recommendation. Allowing corporate data
> on private computers (or private computers on a corporate network) is
> a bad, BAD practice. Never EVER do that. You really want to do the
> exact
> opposite: establish a policy that *prohibit* employees from
> transferring corporate data to private computers, and have it signed
> by each employee.
>
> Regards
> Ansgar Wiechers
> --
> "All vulnerabilities deserve a public fear period prior to patches
> becoming available."
> --Jason Coombs on Bugtraq
>



--
Yousef Syed
"To ask a question is to show ignorance; not to ask a question, means
you remain ignorant" - Japanese Proverb

[Crawley, Jim]

Personally I think you're better off going with a solution such
as Citrix with Secure Gateway. That way the person will only have a
http/ssl connection to the secure gateway server, don't allow mapping of
local drives, force everything to be off the server. The people who
bring their laptops in can be put on a separate VLAN with the only
communication allowed to the corporate network via the Secure Gateway
box.

I've been pushing hard for something like this for people who
want to work from home in my current company. Currently it's just the
Cisco VPN client giving them full access to our global network which
imho is shocking. I think I'm finally making some leeway in to
convincing people to allow me to set this up at least for our office and
I'm expecting to get the go-ahead in the not too distant future.


-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of Petter Bruland
Sent: Thursday, 10 May 2007 6:07 AM
To: Yousef Syed; security-***@securityfocus.com
Subject: RE: Home laptops on a corporate network


Sounds like a good idea, but there are security vulnerabilities with
VMWare. Not sure if any current malware/spy ware/virus takes advantage
of these flaws though.
Also how the OS within the VMWare image is configured has a great deal
to do with how secure it is.

Sounds like it would be hard to maintain these VMs and make sure that
they are *clean*.

One way that sounds easier to configure and maintain, is setting up a
VLAN X where the VPN clients connect, then only allow RDC via port XXXX
to VLAN Y where they can access either a Terminal Server or their office
PC.
And have some nice filtering setup between the VLANs, such as a
Sonicwall, Cisco, Barracuda etc.


A lot of good ideas and questions has been posted here, but nobody has
mentioned anything about two factor authentication or password
management in combination with remote access.

Assuming you have a pretty good setup, where the clients are checked
before entering the network as well as filters to prevents all sorts of
*bad* things from happening. With weak passwords or a poor password
policy, you could have users accessing the network who should not be
there.

Seems that if you're HIPAA/SOC, you should not have remote access :-(


-Petter





-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of Yousef Syed
Sent: Tuesday, May 08, 2007 4:35 PM
To: security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network

Just wondering...
But is it possible to setup a locked-down VMWare image for external
laptop users to use if they really-really need access your corporate
network. (a small subsection of the network inside its own DMZ
specifically designed to share data)


Personally, I can't think of a reason why an external laptop (or USB
drive for that matter) would need access to the internal corporate
network anyway. They can be provided with separate access to get onto
the internet from a segmented system that has no access to the Internal
system.

ys


On 08/05/07, Ansgar -59cobalt- Wiechers <***@planetcobalt.net>
wrote:
> On 2007-05-08 ***@hotmail.com wrote:
> > I'd recommend NOT doing this. Especially if you are trying comply
> > with HIPAA. Keep in mind that you will have little to no management
> > capability over these personal laptops, which means you have no
> > ability to verify patch level and AV update on these machines that
> > may have EPHI on them. Not to mention the fact that these employees
> > are probably taking them home and plugging them into their home
> > networks, where they (or their kids) are running bearshare,
> > gnutella, grokster, bitorrent, and surfing to unfiltered web sites.
> > Not only does this mean that they are potentially exposing critical
> > data in this manner, it also means they are bringing potentially
> > infested computers into the soft chewy center of your network.
> >
> > Whenever you have an employee with a laptop, you create a liability
> > to your network, allowing them to use personal laptops presents an
> > even bigger liability. IMHO, this level of risk is unacceptable,
> > especially from a HIPAA compliance standpoint.
>
> I wholeheartedly second that recommendation. Allowing corporate data
> on private computers (or private computers on a corporate network) is
> a bad, BAD practice. Never EVER do that. You really want to do the
> exact
> opposite: establish a policy that *prohibit* employees from
> transferring corporate data to private computers, and have it signed
> by each employee.
>
> Regards
> Ansgar Wiechers
> --
> "All vulnerabilities deserve a public fear period prior to patches
> becoming available."
> --Jason Coombs on Bugtraq
>



--
Yousef Syed
"To ask a question is to show ignorance; not to ask a question, means
you remain ignorant" - Japanese Proverb

[Rob Creely]

>Hi all -
>
>I have a client who wants to allow employees to use their own laptops on
>the corp. wireless network so that they can access files on the server.
>I gave them a run-down of options (allow usual file sharing [bad idea],
>MS VPN quarantine [complex scripting], SharePoint services [not bad, but
>no printer access] and third party quarantine options).
>
>Aside from any other ideas someone may have, it seems to me that the
>third party compliance software/appliance, while probably being the most
>versatile is pretty costly. I found a couple starting at about $20K.
>Does anybody know of any devices that are significantly cheaper and can
>allow my client to do what they want? I should mention that they are
>bound by HIPAA regulations here. Or any approaches I haven't thought of?
>
>Thanks for the input.
>
>Adam
>
>Adam J. Rosen
>President
>Buffalo Data Solutions
>716-913-6312
>***@buffdata.com
>http://www.buffdata.com

Hi,

Given the limited details on what such a system needs to be able to
provide user's of "home" laptops, I would go for a totally complete
and seperate network from the corporate wireless LAN with pinholes to
a Citrix/MS Terminal Services server in a DMZ which would provide the
"services" needed by "home" laptops.

As for NAC which was mentioned, it just seems to be the latest snake
oil being offered by security vendors to uninformed security
executives. I recenty easily bypassed a NAC on a Juniper box in under
30 minutes by changing a view registry keys on my Windows client. And
at Blackhat Europe researchers recently revealed a flaw in Cisco's
offereing in the NAC space:
http://www.net-security.org/article.php?id=1001 NAC probably has a
role in a multi-layer defense in depth network security policy.
However, that said, I would not rely on NAC solutions too heavily.

Just my 2 cents.........

Cheers.

--Rob

[Johnny Wong]

I have an idea and would like to throw it to the list. Maybe we could
create LiveCDs for these users. And the only way they can access to
the corporate network is through this CD. The CD will be customised
with the VPN client, office apps etc. That way, it is not possible
for information to leak from a more secure state to one which is unknown.

JW

At 07:34 AM 9/05/2007, Yousef Syed wrote:
>Just wondering...
>But is it possible to setup a locked-down VMWare image for external
>laptop users to use if they really-really need access your corporate
>network. (a small subsection of the network inside its own DMZ
>specifically designed to share data)
>
>
>Personally, I can't think of a reason why an external laptop (or USB
>drive for that matter) would need access to the internal corporate
>network anyway. They can be provided with separate access to get onto
>the internet from a segmented system that has no access to the
>Internal system.
>
>ys
>
>
>On 08/05/07, Ansgar -59cobalt- Wiechers <***@planetcobalt.net> wrote:
>>On 2007-05-08 ***@hotmail.com wrote:
>> > I'd recommend NOT doing this. Especially if you are trying comply with
>> > HIPAA. Keep in mind that you will have little to no management
>> > capability over these personal laptops, which means you have no ability
>> > to verify patch level and AV update on these machines that may have EPHI
>> > on them. Not to mention the fact that these employees are probably
>> > taking them home and plugging them into their home networks, where they
>> > (or their kids) are running bearshare, gnutella, grokster, bitorrent,
>> > and surfing to unfiltered web sites. Not only does this mean that they
>> > are potentially exposing critical data in this manner, it also means
>> > they are bringing potentially infested computers into the soft chewy
>> > center of your network.
>> >
>> > Whenever you have an employee with a laptop, you create a liability to
>> > your network, allowing them to use personal laptops presents an even
>> > bigger liability. IMHO, this level of risk is unacceptable, especially
>> > from a HIPAA compliance standpoint.
>>
>>I wholeheartedly second that recommendation. Allowing corporate data on
>>private computers (or private computers on a corporate network) is a
>>bad, BAD practice. Never EVER do that. You really want to do the exact
>>opposite: establish a policy that *prohibit* employees from transferring
>>corporate data to private computers, and have it signed by each
>>employee.
>>
>>Regards
>>Ansgar Wiechers
>>--
>>"All vulnerabilities deserve a public fear period prior to patches
>>becoming available."
>>--Jason Coombs on Bugtraq
>
>
>
>--
>Yousef Syed
>"To ask a question is to show ignorance; not to ask a question, means
>you remain ignorant" - Japanese Proverb

[m***@agilent.com]

This would potentially become a problem as the list of required applications grows...for small corporate environements microsoft office may be the only requirement. For R&D operations you need compliers, source control tools, remote management products, test harnesses ....the list goes on..

Thanks
mathew

-----Original Message-----
From: owner-***@y9mail.aus.agilent.com [mailto:owner-***@y9mail.aus.agilent.com] On Behalf Of Johnny Wong
Sent: Thursday, 10 May 2007 1:18 PM
To: security-***@securityfocus.com
Subject: [bugtraq] Re: Home laptops on a corporate network

I have an idea and would like to throw it to the list. Maybe we could
create LiveCDs for these users. And the only way they can access to
the corporate network is through this CD. The CD will be customised
with the VPN client, office apps etc. That way, it is not possible
for information to leak from a more secure state to one which is unknown.

JW

At 07:34 AM 9/05/2007, Yousef Syed wrote:
>Just wondering...
>But is it possible to setup a locked-down VMWare image for external
>laptop users to use if they really-really need access your corporate
>network. (a small subsection of the network inside its own DMZ
>specifically designed to share data)
>
>
>Personally, I can't think of a reason why an external laptop (or USB
>drive for that matter) would need access to the internal corporate
>network anyway. They can be provided with separate access to get onto
>the internet from a segmented system that has no access to the
>Internal system.
>
>ys
>
>
>On 08/05/07, Ansgar -59cobalt- Wiechers <***@planetcobalt.net> wrote:
>>On 2007-05-08 ***@hotmail.com wrote:
>> > I'd recommend NOT doing this. Especially if you are trying comply with
>> > HIPAA. Keep in mind that you will have little to no management
>> > capability over these personal laptops, which means you have no ability
>> > to verify patch level and AV update on these machines that may have EPHI
>> > on them. Not to mention the fact that these employees are probably
>> > taking them home and plugging them into their home networks, where they
>> > (or their kids) are running bearshare, gnutella, grokster, bitorrent,
>> > and surfing to unfiltered web sites. Not only does this mean that they
>> > are potentially exposing critical data in this manner, it also means
>> > they are bringing potentially infested computers into the soft chewy
>> > center of your network.
>> >
>> > Whenever you have an employee with a laptop, you create a liability to
>> > your network, allowing them to use personal laptops presents an even
>> > bigger liability. IMHO, this level of risk is unacceptable, especially
>> > from a HIPAA compliance standpoint.
>>
>>I wholeheartedly second that recommendation. Allowing corporate data on
>>private computers (or private computers on a corporate network) is a
>>bad, BAD practice. Never EVER do that. You really want to do the exact
>>opposite: establish a policy that *prohibit* employees from transferring
>>corporate data to private computers, and have it signed by each
>>employee.
>>
>>Regards
>>Ansgar Wiechers
>>--
>>"All vulnerabilities deserve a public fear period prior to patches
>>becoming available."
>>--Jason Coombs on Bugtraq
>
>
>
>--
>Yousef Syed
>"To ask a question is to show ignorance; not to ask a question, means
>you remain ignorant" - Japanese Proverb

[winsoc]

Citrix comes to mind here. Certainly you could use a LiveCD as mentioned by
JW, you could actually config the LiveCD to be nothing but a
ThinClient/FatClient with restricted access through this channel.

Regards
winsoc

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com] On
Behalf Of ***@agilent.com
Sent: 10 May 2007 05:11
To: ***@gmail.com; security-***@securityfocus.com
Subject: RE: [bugtraq] Re: Home laptops on a corporate network

This would potentially become a problem as the list of required applications
grows...for small corporate environements microsoft office may be the only
requirement. For R&D operations you need compliers, source control tools,
remote management products, test harnesses ....the list goes on..

Thanks
mathew

-----Original Message-----
From: owner-***@y9mail.aus.agilent.com
[mailto:owner-***@y9mail.aus.agilent.com] On Behalf Of Johnny Wong
Sent: Thursday, 10 May 2007 1:18 PM
To: security-***@securityfocus.com
Subject: [bugtraq] Re: Home laptops on a corporate network

I have an idea and would like to throw it to the list. Maybe we could
create LiveCDs for these users. And the only way they can access to
the corporate network is through this CD. The CD will be customised
with the VPN client, office apps etc. That way, it is not possible
for information to leak from a more secure state to one which is unknown.

JW

At 07:34 AM 9/05/2007, Yousef Syed wrote:
>Just wondering...
>But is it possible to setup a locked-down VMWare image for external
>laptop users to use if they really-really need access your corporate
>network. (a small subsection of the network inside its own DMZ
>specifically designed to share data)
>
>
>Personally, I can't think of a reason why an external laptop (or USB
>drive for that matter) would need access to the internal corporate
>network anyway. They can be provided with separate access to get onto
>the internet from a segmented system that has no access to the
>Internal system.
>
>ys
>
>
>On 08/05/07, Ansgar -59cobalt- Wiechers <***@planetcobalt.net> wrote:
>>On 2007-05-08 ***@hotmail.com wrote:
>> > I'd recommend NOT doing this. Especially if you are trying comply with
>> > HIPAA. Keep in mind that you will have little to no management
>> > capability over these personal laptops, which means you have no ability
>> > to verify patch level and AV update on these machines that may have
EPHI
>> > on them. Not to mention the fact that these employees are probably
>> > taking them home and plugging them into their home networks, where they
>> > (or their kids) are running bearshare, gnutella, grokster, bitorrent,
>> > and surfing to unfiltered web sites. Not only does this mean that they
>> > are potentially exposing critical data in this manner, it also means
>> > they are bringing potentially infested computers into the soft chewy
>> > center of your network.
>> >
>> > Whenever you have an employee with a laptop, you create a liability to
>> > your network, allowing them to use personal laptops presents an even
>> > bigger liability. IMHO, this level of risk is unacceptable, especially
>> > from a HIPAA compliance standpoint.
>>
>>I wholeheartedly second that recommendation. Allowing corporate data on
>>private computers (or private computers on a corporate network) is a
>>bad, BAD practice. Never EVER do that. You really want to do the exact
>>opposite: establish a policy that *prohibit* employees from transferring
>>corporate data to private computers, and have it signed by each
>>employee.
>>
>>Regards
>>Ansgar Wiechers
>>--
>>"All vulnerabilities deserve a public fear period prior to patches
>>becoming available."
>>--Jason Coombs on Bugtraq
>
>
>
>--
>Yousef Syed
>"To ask a question is to show ignorance; not to ask a question, means
>you remain ignorant" - Japanese Proverb

[Adam Rosen]

A vpn will allow authentication, but then they still are accessing file shares from a system that may be thouroughly infected. Then we have issues such as file corruption/deletion/infectionor data leakage due to keyloggers, trojans, and P2P apps. A VPN (ssl or otherwise) won't change this.

Adam

-----Original Message-----
From: "Tsu" <***@gmail.com>
Sent: Tuesday, May 08, 2007 12:43 PM
To: "Adam Rosen" <***@buffdata.com>
Cc: "security-***@securityfocus.com" <security-***@securityfocus.com>
Subject: Re: Home laptops on a corporate network

SSL VPN Appliance like the one from Watchguard.
http://www.watchguard.com/products/fb-ssl.asp

Very easy to setup, easy to use, LDAP integration... good stuff. I've
implemented several of them for clients.

On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> Hi all -
>
> I have a client who wants to allow employees to use their own laptops on
> the corp. wireless network so that they can access files on the server.
> I gave them a run-down of options (allow usual file sharing [bad idea],
> MS VPN quarantine [complex scripting], SharePoint services [not bad, but
> no printer access] and third party quarantine options).
>
> Aside from any other ideas someone may have, it seems to me that the
> third party compliance software/appliance, while probably being the most
> versatile is pretty costly. I found a couple starting at about $20K.
> Does anybody know of any devices that are significantly cheaper and can
> allow my client to do what they want? I should mention that they are
> bound by HIPAA regulations here. Or any approaches I haven't thought of?
>
> Thanks for the input.
>
> Adam
>
> Adam J. Rosen
> President
> Buffalo Data Solutions
> 716-913-6312
> ***@buffdata.com
> http://www.buffdata.com
>
>
>



--
tsudohnimh
www.knowthenetwork.com

[Ryan Chow]

I'd give it the thumbs down. security is a big problem I feel. but I would
let your client know of the security threats that they will face first.
because liability is an important thing also. if they do insist on going on
with the project then it's a risk they are taking themselves.

----- Original Message -----
From: "Adam Rosen" <***@buffdata.com>
To: "Tsu" <***@gmail.com>
Cc: <security-***@securityfocus.com>
Sent: Wednesday, May 09, 2007 1:30 AM
Subject: RE: Home laptops on a corporate network


A vpn will allow authentication, but then they still are accessing file
shares from a system that may be thouroughly infected. Then we have issues
such as file corruption/deletion/infectionor data leakage due to keyloggers,
trojans, and P2P apps. A VPN (ssl or otherwise) won't change this.

Adam

-----Original Message-----
From: "Tsu" <***@gmail.com>
Sent: Tuesday, May 08, 2007 12:43 PM
To: "Adam Rosen" <***@buffdata.com>
Cc: "security-***@securityfocus.com" <security-***@securityfocus.com>
Subject: Re: Home laptops on a corporate network

SSL VPN Appliance like the one from Watchguard.
http://www.watchguard.com/products/fb-ssl.asp

Very easy to setup, easy to use, LDAP integration... good stuff. I've
implemented several of them for clients.

On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> Hi all -
>
> I have a client who wants to allow employees to use their own laptops on
> the corp. wireless network so that they can access files on the server.
> I gave them a run-down of options (allow usual file sharing [bad idea],
> MS VPN quarantine [complex scripting], SharePoint services [not bad, but
> no printer access] and third party quarantine options).
>
> Aside from any other ideas someone may have, it seems to me that the
> third party compliance software/appliance, while probably being the most
> versatile is pretty costly. I found a couple starting at about $20K.
> Does anybody know of any devices that are significantly cheaper and can
> allow my client to do what they want? I should mention that they are
> bound by HIPAA regulations here. Or any approaches I haven't thought of?
>
> Thanks for the input.
>
> Adam
>
> Adam J. Rosen
> President
> Buffalo Data Solutions
> 716-913-6312
> ***@buffdata.com
> http://www.buffdata.com
>
>
>



--
tsudohnimh
www.knowthenetwork.com

[Adam Rosen]

Hi all -

I have a client who wants to allow employees to use their own laptops on
the corp. wireless network so that they can access files on the server.
I gave them a run-down of options (allow usual file sharing [bad idea],
MS VPN quarantine [complex scripting], SharePoint services [not bad, but
no printer access] and third party quarantine options).

Aside from any other ideas someone may have, it seems to me that the
third party compliance software/appliance, while probably being the most
versatile is pretty costly. I found a couple starting at about $20K.
Does anybody know of any devices that are significantly cheaper and can
allow my client to do what they want? I should mention that they are
bound by HIPAA regulations here. Or any approaches I haven't thought of?

Thanks for the input.

Adam

Adam J. Rosen
President
Buffalo Data Solutions
716-913-6312
***@buffdata.com
http://www.buffdata.com

[Kurt Buff]

They're bound by HIPAA, and still want this? The approach that you
haven't thought of is to talk with their corporate counsel, and ask
him to read HIPAA, and advise your clients about liability.

Tell them to put down the crack pipe and step away. This is completely
against the intent and letter of HIPAA.

Insanity.

The company where I work now doesn't need HIPAA compliance, and it's
strictly against company policy to connect personal devices to the
corporate network.

Just for fun, I'll mention 3 OSS NAC packages, but I still don't think
it's a good idea.

http://ungoliant.sf.net

http://netreg.sf.net

http://freenac.net

Kurt

On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> Hi all -
>
> I have a client who wants to allow employees to use their own laptops on
> the corp. wireless network so that they can access files on the server.
> I gave them a run-down of options (allow usual file sharing [bad idea],
> MS VPN quarantine [complex scripting], SharePoint services [not bad, but
> no printer access] and third party quarantine options).
>
> Aside from any other ideas someone may have, it seems to me that the
> third party compliance software/appliance, while probably being the most
> versatile is pretty costly. I found a couple starting at about $20K.
> Does anybody know of any devices that are significantly cheaper and can
> allow my client to do what they want? I should mention that they are
> bound by HIPAA regulations here. Or any approaches I haven't thought of?
>
> Thanks for the input.
>
> Adam
>
> Adam J. Rosen
> President
> Buffalo Data Solutions
> 716-913-6312
> ***@buffdata.com
> http://www.buffdata.com
>
>
>

[steven hess]

I do not know if this would count as "file access" - but a different way to
approach security is to only let them run a remote application on a computer
inside the LAN.

One possibility - a KVM over IP type of box. Another is the CITRIX type of
access. Note that the file never leaves the location, but by remotely
controlling the application AS IF they were at the home base, they could
perform some kinds of work. The would be able to access the application over
a SSL connection, view and manipulate the files, but could be prevented from
downloading data.

Just a thought.

Steven Hess
Chief Engineer
WFTT -TV


-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com] On
Behalf Of Kurt Buff
Sent: Tuesday, May 08, 2007 12:58 PM
To: Adam Rosen
Cc: security-***@securityfocus.com
Subject: Re: Home laptops on a corporate network

They're bound by HIPAA, and still want this? The approach that you
haven't thought of is to talk with their corporate counsel, and ask
him to read HIPAA, and advise your clients about liability.

Tell them to put down the crack pipe and step away. This is completely
against the intent and letter of HIPAA.

Insanity.

The company where I work now doesn't need HIPAA compliance, and it's
strictly against company policy to connect personal devices to the
corporate network.

Just for fun, I'll mention 3 OSS NAC packages, but I still don't think
it's a good idea.

http://ungoliant.sf.net

http://netreg.sf.net

http://freenac.net

Kurt

On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> Hi all -
>
> I have a client who wants to allow employees to use their own laptops on
> the corp. wireless network so that they can access files on the server.
> I gave them a run-down of options (allow usual file sharing [bad idea],
> MS VPN quarantine [complex scripting], SharePoint services [not bad, but
> no printer access] and third party quarantine options).
>
> Aside from any other ideas someone may have, it seems to me that the
> third party compliance software/appliance, while probably being the most
> versatile is pretty costly. I found a couple starting at about $20K.
> Does anybody know of any devices that are significantly cheaper and can
> allow my client to do what they want? I should mention that they are
> bound by HIPAA regulations here. Or any approaches I haven't thought of?
>
> Thanks for the input.
>
> Adam
>
> Adam J. Rosen
> President
> Buffalo Data Solutions
> 716-913-6312
> ***@buffdata.com
> http://www.buffdata.com
>
>
>

[j***@EightInOnePet.com]

SSL-Explorer: http://www.sshtools.com/showSslExplorer.do

This is not an appliance, but rather software to create an SSL-VPN to
your files.

jmb

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of Adam Rosen
Sent: Tuesday, May 08, 2007 11:05 AM
To: security-***@securityfocus.com
Subject: Home laptops on a corporate network

Hi all -

I have a client who wants to allow employees to use their own laptops on
the corp. wireless network so that they can access files on the server.
I gave them a run-down of options (allow usual file sharing [bad idea],
MS VPN quarantine [complex scripting], SharePoint services [not bad, but
no printer access] and third party quarantine options).

Aside from any other ideas someone may have, it seems to me that the
third party compliance software/appliance, while probably being the most
versatile is pretty costly. I found a couple starting at about $20K.
Does anybody know of any devices that are significantly cheaper and can
allow my client to do what they want? I should mention that they are
bound by HIPAA regulations here. Or any approaches I haven't thought of?

Thanks for the input.

Adam

Adam J. Rosen
President
Buffalo Data Solutions
716-913-6312
***@buffdata.com
http://www.buffdata.com

[Vince Hall]

Sharepoint 2007 could be a solution depending on what files need to
accessed.

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com] On
Behalf Of Adam Rosen
Sent: Tuesday, May 08, 2007 10:05 AM
To: security-***@securityfocus.com
Subject: Home laptops on a corporate network

Hi all -

I have a client who wants to allow employees to use their own laptops on
the corp. wireless network so that they can access files on the server.
I gave them a run-down of options (allow usual file sharing [bad idea],
MS VPN quarantine [complex scripting], SharePoint services [not bad, but
no printer access] and third party quarantine options).

Aside from any other ideas someone may have, it seems to me that the
third party compliance software/appliance, while probably being the most
versatile is pretty costly. I found a couple starting at about $20K.
Does anybody know of any devices that are significantly cheaper and can
allow my client to do what they want? I should mention that they are
bound by HIPAA regulations here. Or any approaches I haven't thought of?

Thanks for the input.

Adam

Adam J. Rosen
President
Buffalo Data Solutions
716-913-6312
***@buffdata.com
http://www.buffdata.com

[Adam Rosen]

Somehow I forgot to add Terminal Services to the list of options, but I think the cost on that would be prohibitive. However, it does solve the problems.

Adam

-----Original Message-----
From: "Kurt Buff" <***@gmail.com>
Sent: Tuesday, May 08, 2007 12:57 PM
To: "Adam Rosen" <***@buffdata.com>
Cc: "security-***@securityfocus.com" <security-***@securityfocus.com>
Subject: Re: Home laptops on a corporate network

They're bound by HIPAA, and still want this? The approach that you
haven't thought of is to talk with their corporate counsel, and ask
him to read HIPAA, and advise your clients about liability.

Tell them to put down the crack pipe and step away. This is completely
against the intent and letter of HIPAA.

Insanity.

The company where I work now doesn't need HIPAA compliance, and it's
strictly against company policy to connect personal devices to the
corporate network.

Just for fun, I'll mention 3 OSS NAC packages, but I still don't think
it's a good idea.

http://ungoliant.sf.net

http://netreg.sf.net

http://freenac.net

Kurt

On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> Hi all -
>
> I have a client who wants to allow employees to use their own laptops on
> the corp. wireless network so that they can access files on the server.
> I gave them a run-down of options (allow usual file sharing [bad idea],
> MS VPN quarantine [complex scripting], SharePoint services [not bad, but
> no printer access] and third party quarantine options).
>
> Aside from any other ideas someone may have, it seems to me that the
> third party compliance software/appliance, while probably being the most
> versatile is pretty costly. I found a couple starting at about $20K.
> Does anybody know of any devices that are significantly cheaper and can
> allow my client to do what they want? I should mention that they are
> bound by HIPAA regulations here. Or any approaches I haven't thought of?
>
> Thanks for the input.
>
> Adam
>
> Adam J. Rosen
> President
> Buffalo Data Solutions
> 716-913-6312
> ***@buffdata.com
> http://www.buffdata.com
>
>
>

[Kurt Buff]

On 5/9/07, Stanley Tomkiewicz <***@db.com> wrote:
>
> Looking at the email trails (maybe I am coming in late) it seems clear to me
> that a corporate policy first needs to be documented. The need for
> determining the nuts & bolts first is clear after which products can be
> looked into to see what fits into their policy.
>
> Stanley Tomkiewicz

Indeed. However, in this case HIPAA is likely to override what they'd
*like* their corporate policy to be. It's a useful exercise, though.

[Kurt Buff]

Uh, not really. Well, not unless you do something like this:

a) Laptops in firewalled subnet, only allowed access to Internet, no
VPN to production subnets.

b) TS machine in separate subnet, not exposed to world. Port 3389 (and
ONLY port 3389) exposed to laptops in firewalled subnet. TS machine
otherwise has access to resources on production subnet(s).

Even then I'd cringe, because data leakage is still an issue.



On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> Somehow I forgot to add Terminal Services to the list of options, but I think the cost on that would be prohibitive. However, it does solve the problems.
>
> Adam
>
> -----Original Message-----
> From: "Kurt Buff" <***@gmail.com>
> Sent: Tuesday, May 08, 2007 12:57 PM
> To: "Adam Rosen" <***@buffdata.com>
> Cc: "security-***@securityfocus.com" <security-***@securityfocus.com>
> Subject: Re: Home laptops on a corporate network
>
> They're bound by HIPAA, and still want this? The approach that you
> haven't thought of is to talk with their corporate counsel, and ask
> him to read HIPAA, and advise your clients about liability.
>
> Tell them to put down the crack pipe and step away. This is completely
> against the intent and letter of HIPAA.
>
> Insanity.
>
> The company where I work now doesn't need HIPAA compliance, and it's
> strictly against company policy to connect personal devices to the
> corporate network.
>
> Just for fun, I'll mention 3 OSS NAC packages, but I still don't think
> it's a good idea.
>
> http://ungoliant.sf.net
>
> http://netreg.sf.net
>
> http://freenac.net
>
> Kurt
>
> On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> > Hi all -
> >
> > I have a client who wants to allow employees to use their own laptops on
> > the corp. wireless network so that they can access files on the server.
> > I gave them a run-down of options (allow usual file sharing [bad idea],
> > MS VPN quarantine [complex scripting], SharePoint services [not bad, but
> > no printer access] and third party quarantine options).
> >
> > Aside from any other ideas someone may have, it seems to me that the
> > third party compliance software/appliance, while probably being the most
> > versatile is pretty costly. I found a couple starting at about $20K.
> > Does anybody know of any devices that are significantly cheaper and can
> > allow my client to do what they want? I should mention that they are
> > bound by HIPAA regulations here. Or any approaches I haven't thought of?
> >
> > Thanks for the input.
> >
> > Adam
> >
> > Adam J. Rosen
> > President
> > Buffalo Data Solutions
> > 716-913-6312
> > ***@buffdata.com
> > http://www.buffdata.com
> >
> >
> >
>

[Al Saenz]

Hi Adam,

How many remote clients connections will be required for your customer?

Thanks
Al

-----Original Message-----
From: ***@securityfocus.com
[mailto:***@securityfocus.com]On Behalf Of Adam Rosen
Sent: Tuesday, May 08, 2007 1:31 PM
To: Tsu
Cc: security-***@securityfocus.com
Subject: RE: Home laptops on a corporate network


A vpn will allow authentication, but then they still are accessing file shares from a system that may be thouroughly infected. Then we have issues such as file corruption/deletion/infectionor data leakage due to keyloggers, trojans, and P2P apps. A VPN (ssl or otherwise) won't change this.

Adam

-----Original Message-----
From: "Tsu" <***@gmail.com>
Sent: Tuesday, May 08, 2007 12:43 PM
To: "Adam Rosen" <***@buffdata.com>
Cc: "security-***@securityfocus.com" <security-***@securityfocus.com>
Subject: Re: Home laptops on a corporate network

SSL VPN Appliance like the one from Watchguard.
http://www.watchguard.com/products/fb-ssl.asp

Very easy to setup, easy to use, LDAP integration... good stuff. I've
implemented several of them for clients.

On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> Hi all -
>
> I have a client who wants to allow employees to use their own laptops on
> the corp. wireless network so that they can access files on the server.
> I gave them a run-down of options (allow usual file sharing [bad idea],
> MS VPN quarantine [complex scripting], SharePoint services [not bad, but
> no printer access] and third party quarantine options).
>
> Aside from any other ideas someone may have, it seems to me that the
> third party compliance software/appliance, while probably being the most
> versatile is pretty costly. I found a couple starting at about $20K.
> Does anybody know of any devices that are significantly cheaper and can
> allow my client to do what they want? I should mention that they are
> bound by HIPAA regulations here. Or any approaches I haven't thought of?
>
> Thanks for the input.
>
> Adam
>
> Adam J. Rosen
> President
> Buffalo Data Solutions
> 716-913-6312
> ***@buffdata.com
> http://www.buffdata.com
>
>
>



--
tsudohnimh
www.knowthenetwork.com

[Adam Rosen]

3 to 5 simultaneous users, but an unknown number of unique users (which is something that will need to be nailed down in order to license some per user license solution).

Adam

-----Original Message-----
From: "Al Saenz" <***@Found-Tech.com>
Sent: Tuesday, May 08, 2007 3:44 PM
To: "Adam Rosen" <***@buffdata.com>, "Tsu" <***@gmail.com>
Cc: "security-***@securityfocus.com" <security-***@securityfocus.com>
Subject: RE: Home laptops on a corporate network

Hi Adam,

How many remote clients connections will be required for your customer?

Thanks
Al

-----Original Message-----
From: ***@securityfocus.com
[mailto:***@securityfocus.com]On Behalf Of Adam Rosen
Sent: Tuesday, May 08, 2007 1:31 PM
To: Tsu
Cc: security-***@securityfocus.com
Subject: RE: Home laptops on a corporate network


A vpn will allow authentication, but then they still are accessing file shares from a system that may be thouroughly infected. Then we have issues such as file corruption/deletion/infectionor data leakage due to keyloggers, trojans, and P2P apps. A VPN (ssl or otherwise) won't change this.

Adam

-----Original Message-----
From: "Tsu" <***@gmail.com>
Sent: Tuesday, May 08, 2007 12:43 PM
To: "Adam Rosen" <***@buffdata.com>
Cc: "security-***@securityfocus.com" <security-***@securityfocus.com>
Subject: Re: Home laptops on a corporate network

SSL VPN Appliance like the one from Watchguard.
http://www.watchguard.com/products/fb-ssl.asp

Very easy to setup, easy to use, LDAP integration... good stuff. I've
implemented several of them for clients.

On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> Hi all -
>
> I have a client who wants to allow employees to use their own laptops on
> the corp. wireless network so that they can access files on the server.
> I gave them a run-down of options (allow usual file sharing [bad idea],
> MS VPN quarantine [complex scripting], SharePoint services [not bad, but
> no printer access] and third party quarantine options).
>
> Aside from any other ideas someone may have, it seems to me that the
> third party compliance software/appliance, while probably being the most
> versatile is pretty costly. I found a couple starting at about $20K.
> Does anybody know of any devices that are significantly cheaper and can
> allow my client to do what they want? I should mention that they are
> bound by HIPAA regulations here. Or any approaches I haven't thought of?
>
> Thanks for the input.
>
> Adam
>
> Adam J. Rosen
> President
> Buffalo Data Solutions
> 716-913-6312
> ***@buffdata.com
> http://www.buffdata.com
>
>
>



--
tsudohnimh
www.knowthenetwork.com

[Adam Rosen]

where would there be data leakage with TS and proper firewalls and policies to prevent sharing of client hard drives?

Adam

-----Original Message-----
From: "Kurt Buff" <***@gmail.com>
Sent: Tuesday, May 08, 2007 3:03 PM
To: "Adam Rosen" <***@buffdata.com>
Cc: "security-***@securityfocus.com" <security-***@securityfocus.com>
Subject: Re: Home laptops on a corporate network

Uh, not really. Well, not unless you do something like this:

a) Laptops in firewalled subnet, only allowed access to Internet, no
VPN to production subnets.

b) TS machine in separate subnet, not exposed to world. Port 3389 (and
ONLY port 3389) exposed to laptops in firewalled subnet. TS machine
otherwise has access to resources on production subnet(s).

Even then I'd cringe, because data leakage is still an issue.



On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> Somehow I forgot to add Terminal Services to the list of options, but I think the cost on that would be prohibitive. However, it does solve the problems.
>
> Adam
>
> -----Original Message-----
> From: "Kurt Buff" <***@gmail.com>
> Sent: Tuesday, May 08, 2007 12:57 PM
> To: "Adam Rosen" <***@buffdata.com>
> Cc: "security-***@securityfocus.com" <security-***@securityfocus.com>
> Subject: Re: Home laptops on a corporate network
>
> They're bound by HIPAA, and still want this? The approach that you
> haven't thought of is to talk with their corporate counsel, and ask
> him to read HIPAA, and advise your clients about liability.
>
> Tell them to put down the crack pipe and step away. This is completely
> against the intent and letter of HIPAA.
>
> Insanity.
>
> The company where I work now doesn't need HIPAA compliance, and it's
> strictly against company policy to connect personal devices to the
> corporate network.
>
> Just for fun, I'll mention 3 OSS NAC packages, but I still don't think
> it's a good idea.
>
> http://ungoliant.sf.net
>
> http://netreg.sf.net
>
> http://freenac.net
>
> Kurt
>
> On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> > Hi all -
> >
> > I have a client who wants to allow employees to use their own laptops on
> > the corp. wireless network so that they can access files on the server.
> > I gave them a run-down of options (allow usual file sharing [bad idea],
> > MS VPN quarantine [complex scripting], SharePoint services [not bad, but
> > no printer access] and third party quarantine options).
> >
> > Aside from any other ideas someone may have, it seems to me that the
> > third party compliance software/appliance, while probably being the most
> > versatile is pretty costly. I found a couple starting at about $20K.
> > Does anybody know of any devices that are significantly cheaper and can
> > allow my client to do what they want? I should mention that they are
> > bound by HIPAA regulations here. Or any approaches I haven't thought of?
> >
> > Thanks for the input.
> >
> > Adam
> >
> > Adam J. Rosen
> > President
> > Buffalo Data Solutions
> > 716-913-6312
> > ***@buffdata.com
> > http://www.buffdata.com
> >
> >
> >
>

[Kurt Buff]

Unless properly configured, data can be copied from the TS server to
the local hard drive.

Kurt

On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> where would there be data leakage with TS and proper firewalls and policies to prevent sharing of client hard drives?
>
> Adam
>
> -----Original Message-----
> From: "Kurt Buff" <***@gmail.com>
> Sent: Tuesday, May 08, 2007 3:03 PM
> To: "Adam Rosen" <***@buffdata.com>
> Cc: "security-***@securityfocus.com" <security-***@securityfocus.com>
> Subject: Re: Home laptops on a corporate network
>
> Uh, not really. Well, not unless you do something like this:
>
> a) Laptops in firewalled subnet, only allowed access to Internet, no
> VPN to production subnets.
>
> b) TS machine in separate subnet, not exposed to world. Port 3389 (and
> ONLY port 3389) exposed to laptops in firewalled subnet. TS machine
> otherwise has access to resources on production subnet(s).
>
> Even then I'd cringe, because data leakage is still an issue.
>
>
>
> On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> > Somehow I forgot to add Terminal Services to the list of options, but I think the cost on that would be prohibitive. However, it does solve the problems.
> >
> > Adam
> >
> > -----Original Message-----
> > From: "Kurt Buff" <***@gmail.com>
> > Sent: Tuesday, May 08, 2007 12:57 PM
> > To: "Adam Rosen" <***@buffdata.com>
> > Cc: "security-***@securityfocus.com" <security-***@securityfocus.com>
> > Subject: Re: Home laptops on a corporate network
> >
> > They're bound by HIPAA, and still want this? The approach that you
> > haven't thought of is to talk with their corporate counsel, and ask
> > him to read HIPAA, and advise your clients about liability.
> >
> > Tell them to put down the crack pipe and step away. This is completely
> > against the intent and letter of HIPAA.
> >
> > Insanity.
> >
> > The company where I work now doesn't need HIPAA compliance, and it's
> > strictly against company policy to connect personal devices to the
> > corporate network.
> >
> > Just for fun, I'll mention 3 OSS NAC packages, but I still don't think
> > it's a good idea.
> >
> > http://ungoliant.sf.net
> >
> > http://netreg.sf.net
> >
> > http://freenac.net
> >
> > Kurt
> >
> > On 5/8/07, Adam Rosen <***@buffdata.com> wrote:
> > > Hi all -
> > >
> > > I have a client who wants to allow employees to use their own laptops on
> > > the corp. wireless network so that they can access files on the server.
> > > I gave them a run-down of options (allow usual file sharing [bad idea],
> > > MS VPN quarantine [complex scripting], SharePoint services [not bad, but
> > > no printer access] and third party quarantine options).
> > >
> > > Aside from any other ideas someone may have, it seems to me that the
> > > third party compliance software/appliance, while probably being the most
> > > versatile is pretty costly. I found a couple starting at about $20K.
> > > Does anybody know of any devices that are significantly cheaper and can
> > > allow my client to do what they want? I should mention that they are
> > > bound by HIPAA regulations here. Or any approaches I haven't thought of?
> > >
> > > Thanks for the input.
> > >
> > > Adam
> > >
> > > Adam J. Rosen
> > > President
> > > Buffalo Data Solutions
> > > 716-913-6312
> > > ***@buffdata.com
> > > http://www.buffdata.com
> > >
> > >
> > >
> >
>

[a***@foo.com]

I think that this thread needs to be allowed to die with the consensus that this is a horrible idea (personal laptops in a HIPAA environment).

With all of the hoops one would have to jump through to make this work, maintain it, and remain compliant, it just cannot be worth the minuscule benefit they would get...

[k***@gmail.com]

If this scenario is an absolute must, even in the face of HIPAA (and if this were my data, I'd be highly concerned about this company...), then I do like having users VPN into an isolated network segment and then connect to a Terminal Server to do their work.

However, not to throw monkeywrenches in, but this solution still does nothing about keyloggers, screenscrapers, or even a full-blown screen capture program running to record all this data. Even just one frame of a doc open can be enough to spoil your HIPAA party depending on the data these users have access to. Really, there's nothing you can do about this other than disallowing their home systems.

You do have to pretend two things:
1) Assume you have the filthiest, most infected, worm-ridden home PC ever connecting to your network.
2) Assume one of these workers will be wanting to sell this data or maliciously gather and use it.

You can take action against 1, but you're not going to be able to audit 2 unless you own the devices they are allowed to use.

[Shawn]

I take it assigning the users who need to work from home company
owned/managed laptops, and then providing VPN access to these laptops,
is just not an option?

Setting up -somewhat- secure access to the corporate network from a
staffers home computer just seems like too much trouble and too much risk
for what you gain...it'd just be easier to buy/image/issue laptops.

On Fri, 11 May 2007, ***@gmail.com wrote:

> If this scenario is an absolute must, even in the face of HIPAA (and if this were my data, I'd be highly concerned about this company...), then I do like having users VPN into an isolated network segment and then connect to a Terminal Server to do their work.
>
> However, not to throw monkeywrenches in, but this solution still does nothing about keyloggers, screenscrapers, or even a full-blown screen capture program running to record all this data. Even just one frame of a doc open can be enough to spoil your HIPAA party depending on the data these users have access to. Really, there's nothing you can do about this other than disallowing their home systems.
>
> You do have to pretend two things:
> 1) Assume you have the filthiest, most infected, worm-ridden home PC ever connecting to your network.
> 2) Assume one of these workers will be wanting to sell this data or maliciously gather and use it.
>
> You can take action against 1, but you're not going to be able to audit 2 unless you own the devices they are allowed to use.
>

[marc]

Sorry in advance for anything stupid. I'm still just a wannabe newbie in
security :)

Wouldn't a regular vpn just open for all kinds of badware they have on
their home computer? And if you issue a work computer for them it will
be used as their normal computer and properly be as infected as their
home computer anyways. Why not use a product that can be used with their
home computer but one that don't have to be installed. I have this usb
key I have been issued at work from this company.

http://www.giritech.com/

It's mighty fancy. It will allow me to connect to our citrix server and
do my work without any risk of our citrix server being infected by any
thing on my work issued laptop.

Disclaimer: I do have any relations with giritech I'm just a happy user
of their product.

And sorry for spelling mistakes, none native English speaker here. :)

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of Shawn
Sent: 11. maj 2007 19:06
To: ***@gmail.com
Cc: security-***@securityfocus.com;
security-basics-return-***@securityfocus.com
Subject: RE: Home laptops on a corporate network

I take it assigning the users who need to work from home company
owned/managed laptops, and then providing VPN access to these laptops,
is just not an option?

Setting up -somewhat- secure access to the corporate network from a
staffers home computer just seems like too much trouble and too much
risk
for what you gain...it'd just be easier to buy/image/issue laptops.

On Fri, 11 May 2007, ***@gmail.com wrote:

> If this scenario is an absolute must, even in the face of HIPAA (and
if this were my data, I'd be highly concerned about this company...),
then I do like having users VPN into an isolated network segment and
then connect to a Terminal Server to do their work.
>
> However, not to throw monkeywrenches in, but this solution still does
nothing about keyloggers, screenscrapers, or even a full-blown screen
capture program running to record all this data. Even just one frame of
a doc open can be enough to spoil your HIPAA party depending on the data
these users have access to. Really, there's nothing you can do about
this other than disallowing their home systems.
>
> You do have to pretend two things:
> 1) Assume you have the filthiest, most infected, worm-ridden home PC
ever connecting to your network.
> 2) Assume one of these workers will be wanting to sell this data or
maliciously gather and use it.
>
> You can take action against 1, but you're not going to be able to
audit 2 unless you own the devices they are allowed to use.
>

[Shawn]

>> Wouldn't a regular vpn just open for all kinds of badware they have on
> their home computer? And if you issue a work computer for them it will
> be used as their normal computer and properly be as infected as their
> home computer anyways.

No.

At least not if your company properly manages it's laptops...our user's
privileges are extremely, extremely restricted through group policy/local
security settings. They can't web browse. They can't install any software/apps.
They can't modify any system settings. They are not at all used in
the same manner that the user's "normal" computers are. They do not pose
nearly the same risk that the user's "normal" computers do.

Furthermore, users are required to bring their laptops into the office on
a regular basis for virus scanning/WSUS patching.

Obviously, you can tailor your own company's group policy to suite your
own specific needs.

Again, I don't think comparing company managed equipment to home equipment
is a fair comparison at all if the company exercises any decent means of
control.


On Fri, 11 May 2007, marc wrote:

> Sorry in advance for anything stupid. I'm still just a wannabe newbie in
> security :)
>
> Wouldn't a regular vpn just open for all kinds of badware they have on
> their home computer? And if you issue a work computer for them it will
> be used as their normal computer and properly be as infected as their
> home computer anyways. Why not use a product that can be used with their
> home computer but one that don't have to be installed. I have this usb
> key I have been issued at work from this company.
>
> http://www.giritech.com/
>
> It's mighty fancy. It will allow me to connect to our citrix server and
> do my work without any risk of our citrix server being infected by any
> thing on my work issued laptop.
>
> Disclaimer: I do have any relations with giritech I'm just a happy user
> of their product.
>
> And sorry for spelling mistakes, none native English speaker here. :)
>
> -----Original Message-----
> From: ***@securityfocus.com [mailto:***@securityfocus.com]
> On Behalf Of Shawn
> Sent: 11. maj 2007 19:06
> To: ***@gmail.com
> Cc: security-***@securityfocus.com;
> security-basics-return-***@securityfocus.com
> Subject: RE: Home laptops on a corporate network
>
> I take it assigning the users who need to work from home company
> owned/managed laptops, and then providing VPN access to these laptops,
> is just not an option?
>
> Setting up -somewhat- secure access to the corporate network from a
> staffers home computer just seems like too much trouble and too much
> risk
> for what you gain...it'd just be easier to buy/image/issue laptops.
>
> On Fri, 11 May 2007, ***@gmail.com wrote:
>
>> If this scenario is an absolute must, even in the face of HIPAA (and
> if this were my data, I'd be highly concerned about this company...),
> then I do like having users VPN into an isolated network segment and
> then connect to a Terminal Server to do their work.
>>
>> However, not to throw monkeywrenches in, but this solution still does
> nothing about keyloggers, screenscrapers, or even a full-blown screen
> capture program running to record all this data. Even just one frame of
> a doc open can be enough to spoil your HIPAA party depending on the data
> these users have access to. Really, there's nothing you can do about
> this other than disallowing their home systems.
>>
>> You do have to pretend two things:
>> 1) Assume you have the filthiest, most infected, worm-ridden home PC
> ever connecting to your network.
>> 2) Assume one of these workers will be wanting to sell this data or
> maliciously gather and use it.
>>
>> You can take action against 1, but you're not going to be able to
> audit 2 unless you own the devices they are allowed to use.
>>
>
>

[marc]

The places I come as a systems consultant don't use the measures you are
talking about here. I of cause tell them that they should but they just
look at me as if I was from the moon or what not. To make matters worse
my boss seems to think that's it a good idea to give all users local
admin rights on their pc's and tells me to do the same. I did try do
tell him that it is more then normal stupid but he wont listen to me. He
is the senior consultant and I'm the junior consultant and as such not
taken to serious even though it seems I to know more about real life
security then he does. The best solution I can offer our clients must be
the G/ON usb key. But it's also very expensive so not to many of our
costumers want it.

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com]
On Behalf Of Shawn
Sent: 11. maj 2007 20:50
To: marc
Cc: ***@gmail.com; security-***@securityfocus.com;
security-basics-return-***@securityfocus.com
Subject: RE: Home laptops on a corporate network

>> Wouldn't a regular vpn just open for all kinds of badware they have
on
> their home computer? And if you issue a work computer for them it will
> be used as their normal computer and properly be as infected as their
> home computer anyways.

No.


At least not if your company properly manages it's laptops...our user's
privileges are extremely, extremely restricted through group
policy/local
security settings. They can't web browse. They can't install any
software/apps.
They can't modify any system settings. They are not at all used in
the same manner that the user's "normal" computers are. They do not pose

nearly the same risk that the user's "normal" computers do.

Furthermore, users are required to bring their laptops into the office
on
a regular basis for virus scanning/WSUS patching.

Obviously, you can tailor your own company's group policy to suite your
own specific needs.

Again, I don't think comparing company managed equipment to home
equipment
is a fair comparison at all if the company exercises any decent means of

control.


On Fri, 11 May 2007, marc wrote:

> Sorry in advance for anything stupid. I'm still just a wannabe newbie
in
> security :)
>
> Wouldn't a regular vpn just open for all kinds of badware they have on
> their home computer? And if you issue a work computer for them it will
> be used as their normal computer and properly be as infected as their
> home computer anyways. Why not use a product that can be used with
their
> home computer but one that don't have to be installed. I have this usb
> key I have been issued at work from this company.
>
> http://www.giritech.com/
>
> It's mighty fancy. It will allow me to connect to our citrix server
and
> do my work without any risk of our citrix server being infected by any
> thing on my work issued laptop.
>
> Disclaimer: I do have any relations with giritech I'm just a happy
user
> of their product.
>
> And sorry for spelling mistakes, none native English speaker here. :)
>
> -----Original Message-----
> From: ***@securityfocus.com
[mailto:***@securityfocus.com]
> On Behalf Of Shawn
> Sent: 11. maj 2007 19:06
> To: ***@gmail.com
> Cc: security-***@securityfocus.com;
> security-basics-return-***@securityfocus.com
> Subject: RE: Home laptops on a corporate network
>
> I take it assigning the users who need to work from home company
> owned/managed laptops, and then providing VPN access to these laptops,
> is just not an option?
>
> Setting up -somewhat- secure access to the corporate network from a
> staffers home computer just seems like too much trouble and too much
> risk
> for what you gain...it'd just be easier to buy/image/issue laptops.
>
> On Fri, 11 May 2007, ***@gmail.com wrote:
>
>> If this scenario is an absolute must, even in the face of HIPAA (and
> if this were my data, I'd be highly concerned about this company...),
> then I do like having users VPN into an isolated network segment and
> then connect to a Terminal Server to do their work.
>>
>> However, not to throw monkeywrenches in, but this solution still does
> nothing about keyloggers, screenscrapers, or even a full-blown screen
> capture program running to record all this data. Even just one frame
of
> a doc open can be enough to spoil your HIPAA party depending on the
data
> these users have access to. Really, there's nothing you can do about
> this other than disallowing their home systems.
>>
>> You do have to pretend two things:
>> 1) Assume you have the filthiest, most infected, worm-ridden home PC
> ever connecting to your network.
>> 2) Assume one of these workers will be wanting to sell this data or
> maliciously gather and use it.
>>
>> You can take action against 1, but you're not going to be able to
> audit 2 unless you own the devices they are allowed to use.
>>
>
>

[Scott Ramsdell]

Additionally, a corporate asset taken home would likely have a VPN client installed. The gateway can then check (through the client) that the laptop is still running anti-malware tools, that the tools are at the proper revision levels, and can require the client be used for all Internet communication. Failing any of those checks, the gateway would not allow the connection. The gateway will also check periodically that the conditions are still true, and if not, disconnect.

But, yes, to your first point, you would not open up a VPN connection for their personal home computer. In that case, you would want to use terminal services or Citrix.

Kind Regards,
 
Scott Ramsdell
CISSP, CCNA, MCSE
Security Network Engineer


-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com] On Behalf Of Shawn
Sent: Friday, May 11, 2007 1:50 PM
To: marc
Cc: ***@gmail.com; security-***@securityfocus.com; security-basics-return-***@securityfocus.com
Subject: RE: Home laptops on a corporate network

>> Wouldn't a regular vpn just open for all kinds of badware they have on
> their home computer? And if you issue a work computer for them it will
> be used as their normal computer and properly be as infected as their
> home computer anyways.

No.

At least not if your company properly manages it's laptops...our user's
privileges are extremely, extremely restricted through group policy/local
security settings. They can't web browse. They can't install any software/apps.
They can't modify any system settings. They are not at all used in
the same manner that the user's "normal" computers are. They do not pose
nearly the same risk that the user's "normal" computers do.

Furthermore, users are required to bring their laptops into the office on
a regular basis for virus scanning/WSUS patching.

Obviously, you can tailor your own company's group policy to suite your
own specific needs.

Again, I don't think comparing company managed equipment to home equipment
is a fair comparison at all if the company exercises any decent means of
control.


On Fri, 11 May 2007, marc wrote:

> Sorry in advance for anything stupid. I'm still just a wannabe newbie in
> security :)
>
> Wouldn't a regular vpn just open for all kinds of badware they have on
> their home computer? And if you issue a work computer for them it will
> be used as their normal computer and properly be as infected as their
> home computer anyways. Why not use a product that can be used with their
> home computer but one that don't have to be installed. I have this usb
> key I have been issued at work from this company.
>
> http://www.giritech.com/
>
> It's mighty fancy. It will allow me to connect to our citrix server and
> do my work without any risk of our citrix server being infected by any
> thing on my work issued laptop.
>
> Disclaimer: I do have any relations with giritech I'm just a happy user
> of their product.
>
> And sorry for spelling mistakes, none native English speaker here. :)
>
> -----Original Message-----
> From: ***@securityfocus.com [mailto:***@securityfocus.com]
> On Behalf Of Shawn
> Sent: 11. maj 2007 19:06
> To: ***@gmail.com
> Cc: security-***@securityfocus.com;
> security-basics-return-***@securityfocus.com
> Subject: RE: Home laptops on a corporate network
>
> I take it assigning the users who need to work from home company
> owned/managed laptops, and then providing VPN access to these laptops,
> is just not an option?
>
> Setting up -somewhat- secure access to the corporate network from a
> staffers home computer just seems like too much trouble and too much
> risk
> for what you gain...it'd just be easier to buy/image/issue laptops.
>
> On Fri, 11 May 2007, ***@gmail.com wrote:
>
>> If this scenario is an absolute must, even in the face of HIPAA (and
> if this were my data, I'd be highly concerned about this company...),
> then I do like having users VPN into an isolated network segment and
> then connect to a Terminal Server to do their work.
>>
>> However, not to throw monkeywrenches in, but this solution still does
> nothing about keyloggers, screenscrapers, or even a full-blown screen
> capture program running to record all this data. Even just one frame of
> a doc open can be enough to spoil your HIPAA party depending on the data
> these users have access to. Really, there's nothing you can do about
> this other than disallowing their home systems.
>>
>> You do have to pretend two things:
>> 1) Assume you have the filthiest, most infected, worm-ridden home PC
> ever connecting to your network.
>> 2) Assume one of these workers will be wanting to sell this data or
> maliciously gather and use it.
>>
>> You can take action against 1, but you're not going to be able to
> audit 2 unless you own the devices they are allowed to use.
>>
>
>

[p***@gmail.com]

This is not a bad idea.

As long as the laptop cannot in any way connect without it, it may make for a effective way for them to work.

The real question then is, why do they need to bring this laptop onto the network in the first place?

If they can get to and use different apps from this CD then we reduce most security issues and have more control over where and what they can and cannot do.

I know several outsource call center companies that create this exact thing for their agents that work out of their houses.

[d***@hotmail.com]

We use Cisco ASA for remote access and we have setup following solutions:

Full client with full access - by policy allowed only for company owned devices, no home laptops allowed!

Full client with limited (ACL) access - for 3rd party partners and devices that difficult to support(field force).

WebVPN (SSL) - provides reverse proxy access to Web services such as Intranet and file shares - this is open for company users from any devices, including home PCs. Security is provided by Cisco Secure Desktop (which will wipe all data after logoff). Since it is reverse proxy virus risks are low.

Webmail - reverse proxy only for Email - you can get your email from any PC.

[m***@vsnl.net]

Hi Adam,

I guess I am stepping in a bit too late, but then I read through the replies and landed on your question.

What I would suggest is to use a document control software like Documentum or something that would provide you the facility to control the document sharing and such other stuff. You can actually control the access levels for various documents right from the basic availability to read to final printing and copying on to the desktop/laptop.

Also, you might consider deploying a NAC device between the core network and the wireless network for the Personal Laptops that are being allowed. Though in your post you yourself have identified it to be an expensive element.

So, a very simple to implement and manage Document Control Tool like Documentum would be the best choice in this case.

Regards

Mayank

PS - I am somehow not convinced with the management decision to allow personal Laptops to connect to company network. My personal Take would have been to conduct a detailed risk assessment on this side and then deploy controls like - NAC device, user profiles, and similar other controls which would neutralize the negative impact emanating from the usage of personal laptop in the corporate environment.