Triple your remote office protection

We all know that two-thirds of corporate hacks come from inside the firewall, making internal security as important as external. But what about your remote offices and SOHO workers? Are they as vulnerable to attacks as your corporate workers?

Yes. Definitely.

A new offering from LinkSys, Zone Labs, and Trend Micro aims to protect them all.

The layered approach

This past May, LinkSys, Zone Labs, and Trend Micro announced they're combining several award-winning products and technologies in a layered security solution for small to mid-sized businesses and home offices. Between LinkSys' outstanding NAT-based routers, Zone Labs' solid ZoneAlarm Pro personal firewall software, and Trend Micro's proven PC-cillin software, you have an effective multilevel solution against a variety of hacks, spyware, trojan horses, viruses, and other malicious code.

Why layered? Nearly two-thirds of all security breaches are caused by insiders accessing unauthorized information - something a corporate firewall can't stop. Most security experts believe layered security is the way to go, as it's only a matter of time before someone finds their way through any single layer. Furthermore, a good layered security system not only protects your key network access points, but also protects them against different avenues of attack, known as vectors, including insider attacks.

LinkSys' new firmware is key to its version of the layered approach. When you install a new LinkSys router (or upgrade your older LinkSys router's firmware), it checks to ensure the client PCs are protected with the right policies and security measures. If not, the users are automatically directed to a Web site where they can download and install ZoneAlarm Pro and PC-cillin.

Test time

I installed the LinkSys BEFSR11 router between my client PC and my switch, upgraded to the latest firmware (1.39), and configured it as a separate subnet. The router is easily configured via any browser on its subnet, and provides a wide range of options, including IPSec pass-through, a demilitarized zone (DMZ), PPPoE (for ADSL users), a DHCP server, filters for port, IP, and MAC addresses, port forwarding (lets you set up public services on your network), RIP1 and RIP2 routing (both dynamic and static), and the ability to manually enter the router's MAC address, which is a handy way of getting around the fact that some ISP's require you to register your network card's MAC address.

Next, I loaded PC-cillin and ZoneAlarm Pro on my client PC, and configured all three layers to provide maximum protection while still allowing routine Internet access and file and print sharing over the LAN. PC-cillin's set-up was simple, but ZoneAlarm Pro's settings are fairly granular, so I configured it to ignore all traffic except that coming from the router and the file and print server.

We then tested the ability of the systems to withstand all the kinds of attacks. I loaded Internet Security Systems' Internet Scanner 6.1, and installed all express updates. I wanted to create a comprehensive suite of tests, so I began with its L3 Router & Switch policy and added all denial-of-service, security probes, and other attacks you're likely to experience. Finally, I began attacking my test subnet. Even though I specifically targeted it toward my subnet, Internet Scanner's 955 hacks are very comprehensive, and can wreak havoc on unsuspecting systems, so I pulled the plug on my ISP during the initial test for my peace of mind.

Incredibly, the LinkSys unit hardly seemed to notice. I reconnected to my ISP, and repeated the tests. I was able to surf the Internet without any noticeable drop in performance. I tested file transfer performance using a large (105 MB) file between the two machines. The performance hit was only 7% while the unit was under attack.

Next, I removed the LinkSys router and connected my target computer to the same subnet as the one employing Internet Scanner. Even without the protection of the router, ZoneAlarm had no difficulty keeping the attack at bay, although the performance hit on the file transfer increased to 17%.

PC-cillin isn't as well known as Norton or MacAfee, but it's comparable in features and ability to stop bugs cold. Although I didn't have any way to test PC-cillin itself, it's won several awards, so I've little doubt it can hold its own.

Room for improvement

This winning combination is being offered in LinkSys' entire line of EtherFast 1- and 4-Port Cable/DSL Routers, including their wireless routers.

One thing I'd like to see is an enhanced encryption and authentication standard to protect the data flowing over the LAN. Although it's overkill for wired LANs, this feature is needed in LinkSys' 802.11b wireless equipment (BEFW11P1, BEFW11S4, WAP11). The Wired Equivalent Privacy specified in the IEEE 802.11b standard was designed to provide a wireless LAN with a level of security similar to that of a wired LAN. Unfortunately, several exploits have been published that render it ineffective for determined individuals with the right equipment. Some leading makers of wireless networking products, including Cisco and 3Com, have developed their own security enhancements to plug the holes. Hopefully, LinkSys and others who provide wireless networking equipment to home, home office, and small office users will follow suit. Expect IEEE to publish an enhancement to the 802.11b standard by year's end.

Another improvement I'd like to see is a different interface for some of ZoneAlarm Pro's advanced security features. While the features are very thorough and allow the administrator to control nearly every detail of the network traffic entering and exiting the computer, novice users will find it difficult to properly configure ZoneAlarm to block all unnecessary traffic.

Janss is the president of Jansys Information Systems, a consulting firm specializing in IS technologies for small businesses. He can be reached at bizcom@jansys.com.