Can I connect our network to the internet but only allow connections to certain servers?

Question

At work we have a network that is not connected to the internet however it is exposed to the outside work through USB drives and employees cell phones. I'd like to connect our system to the internet to get automatic Symantec & windows updates. Currently I have to update these manually which I don't have time to do as frequently as I'd like. We also run some record management software that is diminished by not having access to the internet.

Is there any way for me to utilize a firewall to specify that our network is only allowed to connect to the Symantec live update server, the windows update server and our records management companies server and deny all other incoming and outgoing traffic? If that is possible how hard (or how common) is it for someone to spoof that they are the Windows update server?

I realize that there is no system that is completely safe but my goal is to find a safe way to streamline keeping our software up to date (and possibly expand the capability of our computers) without having to constantly monitor the system.

We are running Windows Server 2003 with workstations running XP. We have Symantec Endpoint 12.1 and currently have no hardware based firewall.

Answer 1

Limiting access to certain addresses

A firewall that connects your network to the Internet can do exactly this. You whitelist the IPs that you want, and default deny any other communications (in or out). I don't normally suggest going to a custom firewall (Linux OS on a computer that only does firewall and is used for nothing else) right away, but I think it may give you the simplicity and power that you need. The upside is that you might be able to use equipment you already have for this purpose, considering the throughput you suggest (providing it is not too old).

pfsense is highly regarded.

That said, you will have to write the firewall rules. So, it is not 'point-and-click', and requires a moderate level of skill, but totally doable.

Spoofing Windows Update

It is possible to spoof a software update site, but programs such as Windows Update and Symantec update verify the address it is connecting to, so the risk is very low.

EDIT

Oh, and I'm sure someone will point out, so I'll beat them to the punch: you are likely exposing your network to more security issues by allowing USB keys and personal electronics in your network than with a poorly configured firewall (given the right conditions). So, by limiting (eliminating) those things and having a good firewall, you will be miles ahead than where you are now.

Answer 2

An alternative to consider is that you can run your own private Symantec Update and Windows Update servers in-house. They need to be able to access the Internet, in order to get the updates from Symantec and Microsoft, but your client machines don't.

(People usually implement these services to cache Internet traffic and so they can control what updates are distributed when, but it'll work in this scenario too.)