Introduction

Welcome to Andress on Security! I will be using this space to provide insight, tips, and tricks that will help you improve your corporate security infrastructure. I will be discussing policies, procedures, architecture, products, tools, and scripts in a number of different areas, such as network security, patch management, authentication, authorization, forensics, and intrusion detection. If you have any specific topics you would like to see covered, send me an email at mandy@arcsec.com.

So you know a little about me, I am a member of Network World’s Global Test Alliance and President of ArcSec Technologies, a security consultancy primarily focused on product reviews and analysis. I am the author of Surviving Security. (The second edition is being published next month.) I have also spoken at numerous conferences, including Black Hat and Networld+Interop.

To start things off, I want to discuss what I see as one of the biggest issues in security today – remote access security. Remote access, especially VPN access, allows employees to work from just about anywhere, but does management understand the risks this introduces to company networks and systems? Simply stated, just about every remote access connection is another Internet entry point to your network. Do you have a defined remote access security policy? Are you taking proper precautions?

In my consulting, I often get called in to help clean up the outbreak of the latest virus or worm. At least 85% of the time, the virus was introduced to the company through a remote access connection. I have also seen targeted hacking attempts against employee’s home networks when an attacker wanted access to the company’s network. When implementing remote access, securing the end points (or ensuring the end points are secure) should be part of the project. Purchasing a VPN product is only the first step.

Remote access precautions can include a variety of policies and technologies, many of which I will discuss in future postings. A few examples include only company-owned systems can connect remotely, every system must be running personal firewall software, and installing an inline IPS device to block malicious traffic that comes across the remote connection.

What does your company do to ensure remote access connections are not the cause of the latest security incident?

Post a comment

RSS feed
Put Network World Comdex 2002 headlines on your site.