Laptop Endpoint Security

Hi All,

Our company was evaluating Websense Remote filtering tool for our
laptop users so that we can enforce the Internet security policy on
the laptops.
But while doing Risk assessment it was noticed that if the hacker is
able to compromise the Websense Remote Filtering server in the DMZ he
may try to get into the internal LAN since the direct connection is
established between DMZ machine and the internal server for doing user
based filtering with the help of Active Directory.This is a risk.

I wanted your suggestions on the following:

1. What are the other products which can be evaluated for internet filtering?

2. What are the chances of the above risk materializing ?

3. Any other best practices you can suggest?


Thanks in advance.

I use websense and I force my laptop users to use MY gateway for Internet access (Cisco VPN) Pisses them off but I don't give a ****.

I also use TrendMicro OfficeScan on the remote laptops. Trend is releasing version 10 in a few months and their marketing department explains that there are lots of end point security measures in place with that version. I will be looking at that, perhaps you should also.

Another thing WebSense has is the WDC agent. If a program or process isn't registered with WDC it is not allowed to run. I found that too restrictive in that it hampered authorized business needs, especially in the sales departments.

Quote:

---

I force my laptop users to use MY gateway for Internet access (Cisco VPN)

---

dino, do you mean all internet traffic for your remote users goes through your gateway? e.g. no split tunnel?

Nope I do not split the tunnel. Which pisses off a few but I really don't care.

Dino-a true bastard.........and my hero ;)

MLF

Quote:

---

Originally Posted by morganlefay

Dino-a true bastard.........and my hero ;)

MLF

---

Heh, I leave for ONE month, and THIS is what I come back to? Ugh.

If making someone use that is considered harsh, I guess that time I made the password policy with a generator so each password resembled pronounceable line noise and had a minimum of 12 chars I was being nice? (The line noise idea I got from Simon Travaglia himself) the 12 chars minimum password length was mine.

If someone didn't obey, well, FreeBSD lets you chsh to anything technically ;) like rm -rf /usr/home/luser

;)

Quote:

---

Heh, I leave for ONE month, and THIS is what I come back to? Ugh.

---

I am not sure what your issues is with that post Gore........maybe you can clarify it for me without going on some oxycontin fueled rant

IMHO....you need to lighten the fook up....

MLF

Quote:

---

Originally Posted by morganlefay

I am not sure what your issues is with that post Gore........maybe you can clarify it for me without going on some oxycontin fueled rant

IMHO....you need to lighten the fook up....

MLF

---

Clarified version:

Dino is a friend, we both get into BOFH, we have friendly competition as to who is the real BOFH here, we've been buddies ever since.

Who the hell rants while on Oxy?

How come his bastardness was hero like and mine was considered a rant?

I wasn't here because of a family tragedy I'm not going into, and have lightened up like a cool mountain rain since.

Crystal?

Quote:

---

Crystal?

---

Meth?
Blue Persuasion?
Carrington?
Ship?

You missed "Method" who put out a new album a while back with a Doors tribute song, which is what I think you meant by Ship.

Quote:

---

Originally Posted by gore

How come his bastardness was hero like and mine was considered a rant?

---

Oh dude - YOU SO LEFT YOURSELF WIDE OPEN WITH THAT ONE!


HAHA! But I shall leave it alone.

For now - cause I'm going on VACATION!

if i disable spilt tunnel then the vpn will force the traffic to pass through the corporate network but if i am not using VPN then i still will be able to browse the sites on the company given laptop which i should not isnt it?

What can be the solution to this?