Babysitting network access Enterprise challenges How it works Five critical decision points Tool sample

A developer takes her laptop home to get extra work done. Before she starts, she disables her antivirus software, because it scans every file and tends to bog down the compile. The code compiles, she checks her work and is done with it for the evening. She then reads a few e-mails in her personal account and surfs a couple of Web sites. Before logging off for the night, she decides to upload her just-finished code to the office server, so she accesses the corporate LAN remotely via VPN. Unfortunately, she forgets to reactivate her antivirus software, and unbeknownst to her, the laptop has become infected with the Nimda worm. The result is Nimda wreaks havoc across the corporation.

Welcome to Dennis Peasley's nightmare. A scenario much like this one led Peasley, corporate information security officer at Zeeland, Mich., office furniture giant Herman Miller, to roll out a new breed of security tool - remote policy enforcement software - to 900 remote users worldwide.

"If we had remote policy enforcement in place at the time, Nimda never would have gotten into the network," says Peasley, who now uses Zone Labs' Integrity remote policy enforcement tool. "We never would have let the developer in until the firewall and antivirus [signatures] were up to date."

Babysitting network access

Within the last year or so, remote policy enforcement tools have become available from vendors such as InfoExpress, Sygate Technologies and Zone Labs . The tools consist of client software, which has personal firewall and management pieces, and server software that communicates with the client and integrates with the corporate VPN. The tool checks whether remote VPN users have specific files installed, active and working properly, such as personal firewalls and antivirus programs. If the remote machine doesn't meet corporate security requirements, network access is denied.

Offending users are then redirected to a "quarantine" area on the remote policy enforcement server, from where they are prompted to turn on the firewall, restart the antivirus program or download the latest signatures - whatever is required to come into compliance. Only when the remote machines meet the specified security profile are they granted access to the corporate network.