At work we have a network that is not connected to the internet however it is exposed to the outside work through USB drives and employees cell phones. I'd like to connect our system to the internet to get automatic Symantec & windows updates. Currently I have to update these manually which I don't have time to do as frequently as I'd like. We also run some record management software that is diminished by not having access to the internet.
Is there any way for me to utilize a firewall to specify that our network is only allowed to connect to the Symantec live update server, the windows update server and our records management companies server and deny all other incoming and outgoing traffic? If that is possible how hard (or how common) is it for someone to spoof that they are the Windows update server?
I realize that there is no system that is completely safe but my goal is to find a safe way to streamline keeping our software up to date (and possibly expand the capability of our computers) without having to constantly monitor the system.
We are running Windows Server 2003 with workstations running XP. We have Symantec Endpoint 12.1 and currently have no hardware based firewall.