- Microsoft will float cloud OS this month
- Top 16 Chinese iPhoneys
- Pimp your ride: Cool car technology
- Laptop stolen from McCain campaign
- Cisco, Microsoft roll out server, networking appliance
Newsletters | Podcasts | Chats | Opinions | RSS Feeds | This Week In Print | IT Careers | Community | Reports | Downloads | Slideshows | New Data Center
Partner Sites:Application Performance Solutions | App Performance | Networking Solution | SafeGuard Enterprise Solution Center | SOA | Value of WDS
Editor's Note: There's far more to securing your network than just plugging in the latest devices and patches. In our new bi-weekly Network Guardian column, we'll explore the nitty-gritty of locking down your network.
Question: We have contractors perform a number of critical services, such as managing our IBM blade servers. These staff have to be on the LAN, and they're long-time contractors, so trust levels run pretty high, but I know they shouldn't be able to go everywhere on the LAN. How can I limit their access while still letting them do their jobs, and most important, not making them feel like I don't trust them?
Contractors definitely represent a unique security challenge. Unlike typical guests, who are there for just a short time and need only Internet access, contractors - especially long-term contractors - are much closer to employee status.
The problem, of course, is that they're not employees. So for regulatory reasons, or for just common-sense reasons, you can't give them wide-open access to your entire enterprise network. Yet in nearly all cases, they have to be on your LAN to do their jobs.
In my industry, auditors are a great example - they need to access several financial systems, and they're onsite for as long as a month at a time. In hospitals, the service technicians that come in to work on the x-ray machines and other medical devices are a great example of this issue. Similarly, lots of companies have outsourced portions of their IT functions, such as managing blade servers. Very often, those third-party contractors end up at your facility for years, with a company business card, desk, and e-mail address.
But it's not appropriate for these workers to be able to access your company's source code or other intellectual property, your financial data (unless they're the auditors), or future product plans. Often, these workers move from company to company within the same industry, so their ability to relay information to a very interested competitor isn't hard to fathom.
To limit contractor access, I relied on the trusty network segmentation tools of virtual LANs (VLANs) and access control lists (ACLs) for years. But ultimately, the problems with this approach forced me to look for more automated tools.

The Vista era of Windows is here. Yet most organizations will retain Windows XP alongside new Vista...
Vulnerability Management For DummiesDownload this concise book "Vulnerability Management for Dummies," to learn about the simple steps...
Security Considerations When Deploying Remote Access SolutionsEffective network security is most successful when you use a layered approach, with multiple...

The Vista era of Windows is here. Yet most organizations will retain Windows XP alongside new Vista...
Turning information into a Competitive AdvantageCompanies today are realizing that competitive advantage is harder to sustain when based solely on...
PoE Plus: Impact on the PoE MarketThe standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...

Discover why Unified Threat Management Firewalls are ready for the enterprise today. High...
The Evolution of Network SecurityWe have so many holes punched in our firewalls today that many industry insiders question the value...
The self-managed networkWe aren't there yet, but advances in network and systems management tools are making it possible to...
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.
Download the white paper.
Applications: taking back control
Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.
Learn more today.
Comment