General Firewall Advice Please

[rosieb]

Suddenly, I've got operational responsibility ror security. Talk about being in over my head. 4 weeks ago my knowledge of security was close to zero.

Looks like some laptops which dial in aren't firewalled. Am I wrong to be concerned?

My instincts, supported by what I've read, scream "panic", but I'd appreciate advice.

 

[carrr]

Dial in? Then the sense of urgency need not be so immediate...IMHO. Some argue that ANY internet user needs a firewall, but I believe that it's far more necessary for high-speed connections. With dial-up, you get a new connection, a new IP address, every time you connect. Hackers tend to prefer fixed IPS.

Here's some basic info:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/centri4/user/scf4ch2.htm

http://media.wiley.com/product_data/excerpt/83/07645404/0764540483.pdf

"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[rosieb]

carrr

Thanks, interesting reading. (A big part of my problem is working out where to start on the research, there'e just too much information available so useful pointers like this are a real help).


Rosie
"Never express yourself more clearly than you think" (Niels Bohr)

 

[Dalong]

You should be concerned. Really. Even with dynamic IPs, on the average a connected computer is scanned once per 5 to 10 minutes. And it takes only a few seconds to install a backdoor or trojan on a laptop. Once the laptop will get back to your network, this will mean the insider will be inside.
For the story, lots of companies have been hacked this way (and some of the biggest in town, too).

 

[endwarde]

Please forgive me if I am naieve about this point, but isn't an un-firewalled laptop fairly safe from attacks from viruses and trojans out in the field if it has the latest anti-virus definitions?

 

[netmanrick]

Your core network should have security devices between it and any device which will access the core. Whether that is a firewall,IDS,IPS,vulnerability assessment tool is up to you.
At a MINIMUM,I suggest a firewall.
Thats my 2 cent's worth.

Rick Harris
SC Dept of Motor Vehicles
Network Operations

 

[SpiderElls82]

I would advise a firewall. If only for the saying "better safe then sorry". Those 2 cents should be considered.
Ben

 

[Stevehewitt]

Invest in a decent AV and a good software firewall for your laptops. Worth investing in a spyware checker as well.

Make sure that the firewall isn't some standard home edition either - has to support your networking infrastructure.

I also agree with Rick - all core network services should be at least firewalled, ideally have a good IDS on the system as well.

Steve.

 

[Apache03]

If you are talking about a corporate or business that allows outside laptops to dial into the core of your network, or even to check email via OWA of some type. You should be concerned.
Your organization should be running some type of corporate firewall device already, check and see what you are using. Most of the major firewall manufactures have client software that you can install on your laptops that will create a VPN back to your firewall creating a safe tunnel. The are other software apps out there that also give you the security of a VPN connection.

The laptops can pose a threat to your network because you have no control over where they have been, at a minimum you should have an antivirus product installed and some type of firewall also.

 

[Hawk111]

There are a number of freeware firewalls available if you would like to have a look:

http://soho.sygate.com/products/spf_standard.htm

http://www.fwnetwork.com/description/tpf.html

http://www.webattack.com/get/zonealarm.html

As far a freeware AV goes, suggest you look at this:

http://www.grisoft.com/us/us_dwnl_free.php

If you d/l, make sure to update before running.


Hawk111

 

[rosieb]

Thanks all, not ignoring suggestions, just digesting them!!
Much appreciated.

Rosie
"Never express yourself more clearly than you think" (Niels Bohr)

 

[Stevehewitt]

If your using Windows 2000 or higher, you can also use Group Policies to lock the system down.

Passwords, whats stored on it, what programs can/can't be ran etc. Really helps control what can be let onto the network by using this method, physcial access (no floppy/CD's etc.) and secuirty as mentioned above.

Steve.

 

[GlenJohnson]

I and several others I know use Zone Alarm Lite. It's free and works great. I've got a wireless network and I can't tell you how many times ZA has blocked people trying to hit my machines. Also Stevehewit is correct about anti-virus software. I can't tell you the number of times I've seen laptops in the field get infected then hook up to the network and start infecting it. Good luck.

Zone Alarm Lite

Glen A. Johnson
If you're from Northern Illinois/Southern Wisconsin check out Tek-Tips in Chicago, Illinois Forum.

TTinChicago

http://www.johnsoncomputers.us