Message-ID: <6199A25648C5CF4596C8577AC6D20313351E@osiris.wetgoat.net>
From: james at wetgoat.net (James P. Saveker)
Subject: Re: Microsoft Security? Real LANs[Scanned]

Random letters said...

<snip>
No,  but people do use their laptops outside the office. It can be quicker
to get infected than get either Windows or virus updates. When they bring
their laptop onto the LAN (either through VPN or physically) then they are
an internal source of infection that an external firewall can't filter. 
(Sh)It happens.
</snip>

I do respect what you have said.  Yes indeed a weak point on many networks
are remote roaming users. However I am not sure I fully agree.  Let me
explain my thoughts...

Remote user takes laptop home.  This laptop must have a independent
application level and stateful firewall as it's being used from in front of
the corporate firewall appliance.  It will receive updates whilst connected
to the internet in respect to AV definitions.

In my environment when the remote clients VPN (via IP not dial up) into the
network there AV definitions are updated via HTTP before the client is
assigned an internal address from the DHCP server.

Now if a new virus infects this machine which the AV and firewall does not
stop then surely on the same premise the internal network in the company is
also still at risk, whilst also not being protected internally or indeed at
the perimeter.

So it very much an oxymoron is it not?  

So lets take this a little further.  Lets say that the laptop is not
connected to the internal network or indeed the internet and so does not get
any AV updates for perhaps a week.  The user slaps in a floppy or CDR with a
virus on it.  The machine is then infected.  The user unknowingly returns to
work and connects the machine to the lan.  The lan will be up to date in
respect to AV defs and therefore *should* not be affected.  Rather internal
AV systems will light up like xmas trees.

If neither the internal network or laptop is protected then yes, machines
are going to be raped.  However if that's the case then there not much hope
anyhow.  

That's my five pence,

James Saveker
www.wetgoat.net 

"The only thing which helps me maintain my slender grip on reality is the
friendship I share with my collection of singing potatoes..."

The information contained in or attached to this correspondence is intended
only for the use of the individual or entity to which it is addressed. If
you are not the intended recipient, or a person responsible for delivering
it to the intended recipient, you are not authorised to and must not
disclose, copy, distribute, or retain this message or any part of it. It may
contain information which is confidential and/or covered by legal
professional or other privilege (or other rules or laws with similar effect
in jurisdictions outside England and Wales).

This e-mail has been virus checked by Sophos Mail Monitor. There are
inherent dangers in the opening any Attachments contained within e-mails.
wetgoat.net cautions you to make sure that you completely understand the
potential risks before opening any of the Attachments. You are solely
responsible for adequate protection and backup of the data and equipment
used in connection with this e-mail service, and wetgoat.net will not be
liable for any damages that you may suffer in connection with using,
modifying or distributing any of the Attachments.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3024 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040318/381e8d90/smime.bin

Powered by blists - more mailing lists