Suggestions Needed: Protecting My Users

[Greg9497]

I've recently started my first System Admin job at a small company (<30 users at our corporate office, for which I am responsible) and am trying to address a couple of big issues, not the least among them security.

Anti-virus protection throughout my company is a hodge-podge of whatever people got loaded on their computer when they got the machine...for those who have it. Some folks have *nothing*, which is obviously not good.

My duties have been handled by my current boss, an engineer and a fellow with quite bit of IT aptitude but not a &quot;techie,&quot; and a series of temp consultants. Hence, uniformity of, and documentation on, AV software (like most stuff) is practically non-existant. Not only do I not know for sure who has what, I'm sure some people are not compliant in terms of their licenses (software license compliance being another problem I'm supposed to be getting sorted out).

SOOOO I'm thinking of how best to handle this, and so far I was thinking of getting a Nortan Small Business pack-- install media for Norton AV and enough licenses out of the box to cover every install. This way, I figure, I will know everyone is covered, know they're all compliant, and know to the day when any needs to be upgraded or updated.

Additional wrinkle: we sometimes (like right now) have guest users, mostly lugging in their own laptops, who come on-site for days or weeks at a time to collaborate on business proposals and so forth. In addition to having no way of knowing what protection *they* have, I'm loathe to go installing anything on their machines if for no other reason than if anything goes wrong after I touch one, I gotta listen to griping about how &quot;everything worked great until the IT Guy touched it.&quot; And since most of them are government hacks, their computers tend to be quite secure and the users have limited rights to change anything (or install software).

My questions:

1) is this a good idea?
2) anyone with a little more experience have a better one, or other suggestions I may wish to explore?
3) how might I consider addressing the guest user issue?

 

[glacierxx]

Sounds like you have alot of fun ahead. The first thing is to make sure you have Management Support. I think your first order is to get the AV situation to where you can manage the updates. Then you need to sit down and come up with a security policy which will cover what you have just talked about. Other things to include are:
password policy
email policy
Firewalls??
Guest using your networks. We have guest on our very large network and they don't attach unless we have checked and scanned their boxes. Definitions must be up-to-date. I have refuse many laptops from our network.
When you create your policy keep your management and user involved. Change is difficult and if they are use to doing what ever they won't on their systems they probably won't like change.

http://WWW.SANS.org

have security policy templates, also do a search in google for security policies and you will get more info than you can use.

Good Luck

&quot;evil prospers when good men do nothing”

 

[Xemus]

NAV corporate edition sounds like a good idea for you. It will allow you to install on all the machines (you will need licenses unless you get a site license, but I don't believe you would need that), push updates to any computer on the domain at regular intervals (check every five minutes and update any computer not updated) as well as remote scanning of computers (less user interaction).
I agree with glarier on the &quot;non-secure computers don't get to connect&quot; theory, but getting this passed will most likely depend on your boss. You might want to arm yourself with some studies on the increasing number of virus/worm attacks as of late and California's new law that states that any company that is compromised must reveal that fact to it's customers.
The California Law here:

http://www.threatfocus.com/sb1386.php

Basic article on increasing trends in virus attacks here:

http://news.com.au/common/story_page/0,4057,8500680%5E15306,00.html

The other action to take would be to develop a scan/test for computers coming in to verify that they are clean before they connect. Got an extra cheapo router to use as a staging area to scan them before they connect to the actual network? There are a plethora of tools available (NMAP, Nessus, NEWT- Nessus for Windows, etc) that will make this easier.
If you have secure government computers coming in, the secure before connecting aspect should be easier to sell.

http://www.closedsocket.com