InfoExpress is coming out with packages to protect LANs from infections brought in by laptops that have been used outside a network.

CyberGatekeeper LAN (CG LAN), which is expected to be available in January, makes sure LAN workstations have the proper security in place before they are allowed access to the local network. This is similar to the company's original CyberGatekeeper Remote, which protects networks from WAN attacks coming through corporate-issued computers that access business networks via the Internet.

The difference is that CG Remote must be placed between the WAN gateway and the LAN, and blocks that path to any unsecure machine. CG LAN is attached anywhere to the LAN and enlists LAN switches to block particular ports to keep unsecure machines from accessing the LAN at large.

Laptops that access the Web or personal e-mail accounts outside the LAN run the risk of being infected if appropriate security software has been disabled. If they are equipped with CyberGatekeeper, such laptops are audited for compliance with corporate security policies when they attempt to log on to the LAN. If a laptop is non-compliant, CyberGatekeeper denies access and informs the user why and can redirect the user to a secure virtual LAN where the necessary updates can be obtained.

One interested executive is the vice president of IT at a major investment firm. "Our intranet is wide open today to employees, and we have infections coming in from roaming laptops," says the vice president, who spoke on condition of anonymity. His company uses the WAN version of CyberGatekeeper.

Before using CG LAN, he would want to make sure of two kinds of interoperability. First, he would want to automate downloads of updates needed by the machines that required them to use software distribution tools the company uses. He says it is important to make the added security CG LAN would provide as transparent as possible to end users. He said he would also want to make sure it was integrated with 802.1x LAN authentication, which his company uses.

Because enforcement of the policies relies on CG LAN talking to LAN switches, updating CG LAN as switch vendors update their code could result in more work for administrators, says Mark Bouchard, senior program director for technology research services at Meta Group.