Ways to protect ‘always-on’ teleworker connections

We recently discussed the anticipated boost in always-on connections for corporate teleworkers due to the introduction of DSL lite services (from BellSouth) and lower-priced asymmetric DSL services (from Verizon and SBC).  While these services provide always-on access at a very attractive price point, they also provide some challenges for the enterprise.

The major one is that an always-on connection could create an always-on back door to your corporate network.  Consequently, at a minimum, you need to make sure that you have some form of router at the remote site to provide network address translation (NAT).  NAT provides a pretty effective firewall, and SOHO routers that support the feature are inexpensive. 

If you want to standardize on your corporate firewall solution, that’s fine. 

Alternatively, you might want firewalling as a part of a service.  For instance, BellSouth offers the Home Networking Gateway for an additional $10 per month.

At the same time, you’ll need to establish policies for appropriate security – and those policies are often tougher to develop than the technology implementation.  For instance, once you’re providing the router, perhaps with a secure IPSec tunnel for corporate access, you have to make sure that the kids’ computer sharing the connection doesn’t have access.

And the kids’ computer on the home network could cause additional problems.  For instance, assume a teleworker’s computer is appropriately secured.  However, the teleworker has chosen to share non-business files with the rest of the family.  A virus infects one of the family computers, and then reaches the corporate computer via a file share.

As we’ve mentioned in previous newsletters, this is why antivirus software on mobile and remote worker computing devices is likely a good idea for the overall corporate IT/network security plan. In addition, many IT departments are realizing that, in addition to authentication, authorization and accounting verification of remote and mobile users, the corporate site should run a virus check on the remote client before allowing the remote worker access to the corporate network.

Overall, the always-on connections are a great asset to the corporate network, but you have to make sure that you have the appropriate safeguards in place – even if they approach a level that some employees might consider an invasion of privacy.